Privacy Policy
Last updated: 15 August 2026
Who we are
This client portal is operated by Vitalife Clinic Ltd, a company registered in England and Wales (company number 16777077), registered office at 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom ("we", "us", "our"). We are the data controller for the personal data described in this policy, and we are registered with the Information Commissioner's Office as a data controller under reference ZC220213.
The portal exists to support your wellness journey: programmes, health check-ins, messaging with your coach, appointments, purchases and account management. This policy explains what personal data we collect through it, why, and the rights you have under UK data protection law (UK GDPR and the Data Protection Act 2018).
What we collect
| Category | Examples |
|---|---|
| Account details | Name, email address, date of birth, phone and WhatsApp numbers, profile photo, login records |
| Health & wellbeing data | Check-ins (weight, mood, energy, sleep and any custom metrics), wellness wheel self-scores, goals, habits, progress photos you choose to upload |
| Programme activity | Stages completed, quiz answers and scores, practice and habit logs, poll votes, wins you post to a group wall, streaks and badges |
| Personal writing | Journal reflections, commitments and private question answers (see "Private by default" below) |
| Communications | Messages with your coach in the portal and, if you opt in, over WhatsApp; appointment bookings; notifications we send you |
| Purchases | Orders, subscriptions and refunds. Card details are handled by Stripe and never touch our servers |
Your health data
Much of what makes this portal useful is health data, which UK GDPR treats as special category data deserving extra protection. We process it for two different reasons, and it is worth being clear which is which, because they give you different control.
To provide your care. Your check-ins, your coach’s notes, your goals, your appointments and your correspondence with us are processed because we are providing you with health care, under Article 9(2)(h) of the UK GDPR. That work is done by, or under the responsibility of, a clinician bound by a duty of confidence. This is not something you consent to and then withdraw: it is the basis on which a clinic keeps a record of the care it gave you, and it is why your clinical record is kept for six years after we last saw you even if you ask us to delete everything else.
For the optional extras. The AI features that work over your own material, and any use of what you have written for marketing or publication, are done on the basis of your explicit consent. You can withdraw that at any time in your settings or by contacting us, and withdrawing it genuinely stops it. Nothing you have written is ever published without your explicit written agreement first.
Private by default
Some things you write in the portal are yours alone. Your journal reflections, sealed commitments, private question answers, wellness wheel scores and progress photos are not visible to your coach or to anyone else at Vitalife Clinic. Coaches can see that you have been journalling (how often, and roughly how much), but never what you wrote.
Two optional switches in My account → Privacy choices let you share a little more if you want to: sharing your wellness wheel trend (the direction only, never your scores) with your coach, and allowing our AI assistant to draw on short excerpts of your journal when drafting summaries for your coach. Both are off unless you turn them on, and you can turn them off again at any time.
How we use your data
- To run your programmes: unlocking stages, tracking progress, awarding badges and keeping your streaks.
- To let your coach support you: they see your check-ins, goals, habits, programme progress and the messages you send them.
- To compute progress insights: engagement, learning, consistency and wellbeing indicators derived from your activity, shown to you and, in a privacy-filtered form, to your coach.
- To send you helpful notifications, including gentle reminders if your programme goes quiet. These stop after a few unanswered reminders.
- To process purchases, subscriptions and refunds.
- To keep the service secure, diagnose problems and meet our legal obligations.
We do not sell your data, and we do not use it for third party advertising.
AI assistance
Some portal features are AI assisted: coaches can generate draft progress summaries and message suggestions, programme content can be AI drafted before a coach reviews it, and you can ask for a short AI written "story so far" about your own progress.
All of it is written on our own computers. Every AI assisted feature in the portal runs on hardware Vitalife owns and controls in the United Kingdom: the coach's progress note, your own "story so far", drafted programme content and the illustrations on our articles. Your check-ins, your progress and anything you have written are not sent to any AI company, and nothing about you is used to train any model.
We still minimise what those features are given. Your name is not included, and your private writing is only ever used in your own story, or in a coach summary if you have explicitly switched that on in your privacy choices.
Security
Your health data, personal writing, contact details and other sensitive fields are encrypted at rest in our database, and all traffic to the portal is encrypted in transit (HTTPS). Access within the clinic is limited by role: coaches see only their side of the privacy line described above, and administrative access is restricted and logged.
How long we keep it
We keep your data for as long as you hold an account with us, so your history and progress remain available to you. If you close your account or ask us to erase your data, we delete or anonymise your personal data within a reasonable period, except where we are required to keep records longer by law or by professional guidance, for example for clinical record keeping, accounting and tax.
Your rights
Under UK GDPR you have the right to access a copy of your personal data, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to data portability, and to withdraw consent at any time without affecting the lawfulness of earlier processing. To exercise any of these rights, contact us using the details below. We will respond within one month.
Visitor measurement
We count visits to our website and to this portal so we know which pages are useful and which are not. We do it ourselves, on our own servers. We do not use Google Analytics or any other third party measurement service, and no information about your visit is sent to anyone outside Vitalife Clinic Ltd.
This measurement sets no cookies and stores nothing at all on your device. For each page view we record the page address, whether it was the first page of your visit, the site and page that linked you to it and any campaign tag carried in the link, your general device type, browser and operating system, the width of your browser window, how long the page was open, how far down it you scrolled, and whether we judged the visit to be automated rather than a person.
To count one person visiting three pages as one visitor rather than three, we need to recognise repeat views within a single day. We do this without identifying you: your IP address and browser description are combined with a secret that changes every day and turned into an anonymous code by a one way process. Your IP address itself is never written to disk, and the daily secret is destroyed after two days, at which point the codes from that day cannot be traced back to any address by anyone, including us. The result is that we can count visitors within a day and cannot follow anyone from one day to the next.
We may also work out roughly where a visit came from: the country, and where our reference table carries that much detail, an approximate town, a coordinate rounded to about eleven kilometres, the type of internet connection and the name of the internet provider. It is approximate by design rather than by accident, and it can be some distance out: a visitor on a mobile network resolves to their provider's gateway, so somebody browsing in Bournemouth can read as London.
All of that is worked out on our own server from a downloaded reference table (IP Geolocation by DB-IP, CC BY 4.0), so no third party is ever asked anything about you. Your IP address is used for that lookup and then discarded along with everything else, and none of this is ever combined with your account.
Detailed records are deleted after 90 days. Only anonymous daily and monthly totals are kept beyond that. Because nothing is stored on your device and nothing identifies you, this does not require your consent, and it continues to work whether or not you accept cookies. We also honour the "Do Not Track" and "Global Privacy Control" settings in your browser: if either is switched on, your visits to the portal are not counted at all.
Our lawful basis is legitimate interests: understanding how our own site is used so we can improve it. Given that no personal data is retained by this process, the impact on your privacy is minimal.
Contact & complaints
For anything about your data, email our data protection contact at privacy@vitalifeclinic.co.uk. You can also use the contact page at vitalifeclinic.co.uk/contact, message your coach in the portal, or write to our registered office above.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.
We may update this policy from time to time. Material changes will be flagged in the portal, and the date at the top always shows the current version.