Your information.
Your choices.

Who is responsible?

Shelly Brackner trading as LoseWell
Unit 7 Derby Road, Stapleford, Nottingham NG9 7ED, United Kingdom.
Email: [email protected].

LoseWell is the controller responsible for deciding how LoseWell uses your personal information.

What we collect and why

• Account and access: name, email, account identifier, authentication records, membership status (including early-access, gifted or paid, and Standard or Premium if you subscribe) and invitations, to create and protect your account and manage access. Card numbers are not collected on these information pages.
• Personalisation and health information: the age, body measurements, weight, activity, abilities, limitations, treatment context, food preferences, exclusions and goals you enter, to build and adjust your plan. Health-related answers are special-category data.
• Body-fat estimate: if you record a waist measurement, we combine it with your height and the sex value in your profile to show an estimated body-fat range and your waist-to-height ratio on your Progress screens. The sex value is used only where a formula differs for female and male bodies (this estimate and your energy estimate). The estimate is shown to you as general wellness information; it is not used for diagnosis, treatment decisions or advertising.
• Steps from Health Connect (Android app): only if you choose Connect steps and allow it in Android’s Health Connect permission screen, the app reads your daily step totals (today and the previous 7 days, when you open the app) and saves them in your step log, where you and your coach can see them. LoseWell reads step counts only. It does not write to Health Connect, read in the background, share step data with third parties or use it for advertising. You can disconnect in the app and remove the permission in Health Connect at any time; steps already saved stay in your log until you ask us to delete them.
• Your optional records: food and drink logs, appetite, actual injection dates, workouts, check-ins, measurements and progress photos, where you choose to use those features. Photos and injection logging are not required for membership.
• Coaching: messages, requests, relevant notes and review outcomes, to respond and support your plan.
• Privacy and service records: consent choices and their wording version, support correspondence, security logs and access history, to respect your choices, investigate problems and meet our responsibilities.

Most information comes from you. An administrator may supply your email to invite you, and authorised staff may add relevant coaching records. Please do not upload information about someone else.

Our lawful bases

We use account and service information where necessary to provide the membership you request (UK GDPR Article 6(1)(b)). For health-based personalisation and optional health tracking, we ask for consent under Article 6(1)(a) and explicit consent under Article 9(2)(a). Accepting membership terms is separate from that consent.

Our legitimate interests (Article 6(1)(f)) are keeping accounts secure, preventing misuse and resolving service complaints, balanced against your rights. Where a specific legal obligation requires us to keep or disclose information, we rely on Article 6(1)(c). Health information is not used for advertising.

Your health-data choice

Before using personalised member features, you are asked for a separate, unticked health-information consent. You can decline and continue using public information. You can withdraw through Privacy choices or contact us. Withdrawal pauses personalised processing; it does not affect processing already lawfully carried out. It is not automatic account deletion. Contact us to request deletion or a copy of existing records. We do not treat an older account or an invitation as consent.

Who can receive information?

Authorised LoseWell staff access information needed for their role. Assigned coaches receive relevant support context; ordinary coaching access does not include private progress photos, daily weigh-in records or billing controls. Separately authorised reviewers may receive relevant information for a requested review. Technical administration and handling your privacy requests may require controlled access.

Service providers include Supabase for accounts, database and private file storage; Cloudflare for hosting and security; Resend for account emails; and Stripe to take membership payments and show invoices. Card numbers are collected by Stripe, not on these information pages. Emailing our contact address also uses Google’s email service. Public font and script resources use Google Fonts and jsDelivr, which receive normal connection information such as IP address. Product searches may use Open Food Facts; do not type private health information into product searches. We may disclose information where legally required or necessary to establish or defend a legal claim. We do not sell member information.

Where information is processed

The live Supabase project uses the London region. This does not mean every service, support operation or backup stays in the UK. Providers and their subprocessors may process information internationally. Their data-processing terms provide for applicable transfer mechanisms, including adequacy arrangements or standard contractual clauses with UK provisions where needed. Contact us for information about the safeguards relevant to your records.

How long we keep information

We keep your active member record while it is needed to provide your membership and the history you ask us to retain. On account closure or a deletion or withdrawal request, we review and remove information no longer needed. The criteria are whether it is necessary for an active service request, an unresolved complaint, a specific legal duty or a legal claim—not merely whether storage is available. Where an exception requires retention, we will explain the reason and relevant period when responding to your request.

Consent evidence is retained only as needed to demonstrate and manage your choices. Deletion from active systems is not a promise of immediate removal from provider backups; residual backup copies are restricted and expire through the provider’s backup cycle. Browser copies may remain on your device until cleared. Account closure and privacy requests are currently handled by a person, not an automatic deletion timer.

Cookies and your device

LoseWell uses browser storage for sign-in sessions and member functionality, and a first-party session-routing cookie called lumina_edge_session that lasts up to 30 days and is cleared on sign-out. That cookie is not the security permission for your records. Browser storage can also hold plan or display state. Sign out on shared devices; clearing site data may remove local information and require you to sign in again. Optional advertising or product-analytics tracking is not enabled in this release.

Plans and automated processing

Software uses your answers to suggest targets, recipes and exercise. These are coaching suggestions, not diagnosis or a decision about medical treatment. You can change your answers or ask for a human plan review. We do not use these suggestions to make decisions with legal or similarly significant effects about you.

Your rights and how to use them

Depending on the circumstances, you can request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent at any time. Email [email protected] or write to the address above. To delete your account, follow the steps on our delete your account page. We may need proportionate information to verify identity; do not send identity documents unless requested through an appropriate route. We normally respond within one month; if a lawful extension is needed, we will explain it.

You can complain to the Information Commissioner’s Office (ICO). You do not have to complain to us first, although we welcome the opportunity to help.

Changes

This is version 2026-10-07. We will make updated notices available and explain material changes. New consent will be requested where a changed purpose requires it. Questions: [email protected].