your privacy, in plain words.

Avah and its clinical service are operated by ACTINOVA LIMITED. Some parts of this website are still in preview: the identity check, video appointments, shop, newsletter and contact form are clearly marked as demos and have the limitations described below. This notice explains what happens to your information and how we handle changes to these services.

who’s responsible for your information?

ACTINOVA LIMITED is the data controller for personal data collected through this website. Registered office: Unit E3 Seedbed Centre, Davidson Way, Romford, Essex, England, RM7 0AZ. Our pharmacy, Actinova, is registered with the General Pharmaceutical Council (GPhC) under number 9013150.

A direct privacy email address has not been published. You can raise a data request through our secure data request form or write to ACTINOVA LIMITED at the address above, and you can complain to the Information Commissioner’s Office (ICO) at any time.

what we collect

your account

To start or resume a consultation you create an account. We collect your email address and authentication details, your name and your date of birth. We use your date of birth to confirm you’re 18 or over. Avah is for adults only.

your consultation

When you start a consultation, we save what you tell us so you can pick up where you left off: the category you chose (for example weight & energy), your answers to the health questions (including medical history, current medicines and allergies, and for weight & energy, eating-pattern and mood screening answers), your height and weight if provided, which consents you gave, and the status of your consultation (for example draft, submitted or reviewed).

Health information is special category data. We collect it because you choose to share it for a consultation, with your explicit consent given on the consent screen before anything is submitted for clinical review.

your identity check

The safety check asks for a photo of your ID and a live selfie. Right now this is a demo: any image you upload is stored in a private area only you can reach, is never sent to an outside identity provider, and no real identity or liveness verification takes place. When a real provider (such as Onfido or Yoti) is connected, we’ll update this notice to say who receives your images, how long they keep them, and how the check works. Verification images are kept only while they’re needed for your consultation, and you can ask us to delete them sooner.

your video appointment

Where a video appointment is part of the journey (it’s required for weight & energy), we save the slot you choose. This is currently a demo calendar: choosing a slot saves a test reservation, not a real appointment. If a real video platform is connected, we’ll publish which platform is used, what happens to call recordings if any are made, and who can see them.

messages and dashboard

If a clinician sends you a message or a request (for example to book a video conversation), we keep it so it appears in your dashboard next to the consultation it belongs to. Submitted consultations are read-only for you; they can’t be edited after submission.

the rest of the website

The newsletter and contact forms don’t send or save anything yet. The shop shows concept products and no payment is taken; your basket lasts only for your current visit. Like any website, our hosting keeps standard technical logs (such as your IP address) to keep the site secure and working.

why we use your information, and our legal basis

• To provide the consultation and clinical review you request: performance of a contract, and, for health data, your explicit consent plus the provision of health care by UK-registered clinicians.
• To check you’re 18 or over: legal obligation and keeping the service safe.
• To keep your account and data secure: our legitimate interests in protecting the service.
• Marketing emails (when launched): only with your consent, and you can unsubscribe at any time.
• Record-keeping by our pharmacy and clinicians: legal and professional obligations.

You can withdraw a consent at any time by contacting us. Withdrawing consent doesn’t undo processing already carried out, and a clinician may still need to keep records they’re professionally required to keep.

who can see your information

Your consultation answers are stored privately and can only be read by you and by the clinicians involved in reviewing your consultation. Identity-check images stay in private storage. The services that run this website (our hosting and database providers) process data on our behalf under contracts that stop them using it for anything else. We don’t sell your data, and we don’t use your health answers for advertising.

Clinical care requires the clinicians who prescribe and the pharmacy that dispenses (Actinova, GPhC 9013150) to receive the information needed to care for you safely. The website demo does not send your information for clinical review. We’ll keep this list up to date.

how we protect your data

Access to private pages requires signing in. Consultation records, identity images and messages are stored privately, protected so only you can read your own rows, and travel over encrypted connections. A clinician reviews every submitted consultation; nothing is decided automatically.

how long we keep information

Submitted consultations and clinician messages are health records: our pharmacy and clinicians keep them for the period UK healthcare record-keeping rules require (currently at least 8 years after your last entry), even if you close your account. Drafts you never submit, and verification images, are kept only while your consultation is open and can be deleted sooner on request. Account details are kept while your account is active.

where data is stored, and international transfers

Your data is stored in our UK/EU-hosted database. If any provider we use ever processes data outside the UK, we’ll only allow it with an approved transfer safeguard and say so here.

your rights

You can ask to see the information we hold about you, correct anything wrong, delete what we’re not required to keep, restrict or object to certain uses, or receive a copy in a portable format. The quickest way is our secure data request form; you’ll get a reference confirming we’ve received it. You can also write to us using the details above. We’ll respond within one month. If we refuse, we’ll explain why. You can also complain to the ICO.

Make a data request

who this applies to

Avah is for adults aged 18 and over. We ask for your date of birth and kindly block anyone under 18 from continuing.

changes to this notice

We’ll update this notice as services change (for example when a real identity-check provider or video platform is connected) and show the change here. This version was published in October 2026.