Privacy Policy
Effective Date: 03 March 2026 | Last Updated: 4 June 2026
INTRODUCTION
────────────────────────────────────────────────────────────
This Privacy Policy explains how Product Earth Health and its partners collect, use, store, and share your personal data when you use our website, register interest, use our digital services (including the patient app or portal), book consultations, receive clinical services, or receive pharmacy fulfilment.
We are committed to processing personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
By continuing to use our website, app, and Services, you agree to the collection and processing of your personal data as described in this Policy. Please note that consent given for the purposes of medical consultation is separate from consent granted for the processing of your personal data.
This Policy should be read alongside our Terms and Conditions and any privacy notices displayed to you at the point you provide data (for example, during onboarding, booking, or within the app).
We may update this Policy from time to time. The current version will always be available on our website with an updated effective date.
Important Information About Clinical Services
────────────────────────────────────────────────────────────
Product Earth Health provides information about healthcare services and acts as a referral and patient engagement platform.
Clinical consultations, medical assessments, prescribing decisions, and patient records are provided and managed by Leva Clinic Ltd, a regulated healthcare provider.
Prescription fulfilment, dispensing, and pharmacy services are provided by Clarity Pharma Limited.
When you access clinical services, book appointments, create a patient account, receive treatment, or purchase medication, your personal data will be processed in accordance with the privacy policies and terms of the relevant service provider.
Please review:
-
Leva Clinic Privacy Policy: https://www.levaclinic.com/privacy-policy
-
Clarity Pharma Privacy Policy: https://clarity-pharma.com/privacy-policy/
1. WHO WE ARE
────────────────────────────────────────────────────────────
Product Earth Health operates as a healthcare information, education, and patient engagement platform. Clinical services are delivered by Leva Clinic Ltd and pharmacy services are delivered by Clarity Pharma Limited. Product Earth Health does not itself provide regulated healthcare services.
Privacy contact: support@productearthhealth.com
2. DATA PROTECTION ROLES
────────────────────────────────────────────────────────────
Because our service involves multiple regulated entities, your data may be handled by more than one organisation acting as a Data Controller:
Clarity Pharma Limited
Acts as Data Controller for personal data collected via the Product Earth Health website and Platform, and for pharmacy-related operations including dispensing and fulfilment.
Leva Clinic Ltd
Acts as Data Controller for personal data processed to deliver regulated clinical services, including all clinical consultations, clinical decision-making, and the creation and maintenance of clinical records.
Technology and Service Suppliers
Some third-party suppliers (technology providers, analytics platforms, payment processors) act as Data Processors and process data only under our instructions and subject to contractual safeguards.
If you would like to understand which organisation is responsible for a specific element of your data, please contact us at support@productearthhealth.com
3. WHAT PERSONAL DATA WE COLLECT
────────────────────────────────────────────────────────────
Depending on how you use the Service, we may collect:
Identity and Contact Details
Name, date of birth, email address, telephone number, home address.
Account and Technical Data
Login events, device type, IP address, browser and app details, usage and diagnostic logs.
Health and Clinical Data (Special Category Data)
Medical history, symptoms, GP or medical records you upload or share, consultation notes, clinical decisions, prescription details, treatment outcomes, and follow-up information.
Note: Health data is treated as special category data under UK GDPR and is handled with additional safeguards and under strict confidentiality obligations.
Payments and Transactions
Consultation payment confirmations, medication payment confirmations, refunds, cancellations, invoices, and receipts. We do not store full card details.
Communications
Messages to support, emails, call notes, and complaint handling records.
Children's Data
Our Services are available to individuals aged 18 and over only. We do not knowingly collect personal data from anyone under 18. If you become aware that a child has provided us with personal data, please contact us immediately.
4. HOW WE COLLECT PERSONAL DATA
────────────────────────────────────────────────────────────
We collect data when you:
- Submit forms on our website (for example, eligibility, waitlist, or contact forms);
- Create an account and use the patient app or portal;
- Upload documents or complete questionnaires;
- Book and attend consultations;
- Pay for consultations or medication;
- Contact our support team or provide feedback;
- Are referred by a clinician or share information from your GP (where you request or authorise it).
We only collect data that is necessary for delivering healthcare services, operations, and regulatory compliance. We also collect limited data automatically when you visit our website, such as your IP address, browser type, and usage behaviour (see Section 11 on Cookies).
5. HOW WE USE YOUR DATA
────────────────────────────────────────────────────────────
We use your personal data to:
- Provide access to the website, app, and Services;
- Assess suitability for consultation and support safe onboarding;
- Deliver clinical consultations and maintain clinical records;
- Issue prescriptions where clinically appropriate and permitted under UK law;
- Support dispensing and fulfilment by the Dispensing Partner;
- Process payments, refunds, cancellations, and service communications;
- Provide customer support and manage complaints;
- Verify identity and prevent fraud and protect Platform security;
- Comply with legal, regulatory, safeguarding, and clinical governance obligations;
- Improve our services through aggregated analytics (using anonymised or pseudonymised data where possible);
- Record consultations (audio or video) for clinical governance, training, and audit purposes.
We do not sell your personal data.
6. LAWFUL BASIS FOR PROCESSING
────────────────────────────────────────────────────────────
We rely on different lawful bases under UK GDPR depending on the context:
Purpose: Service delivery
Data involved: Identity, contact, health data
Lawful basis: Contract + Article 9(2)(h)
Purpose: Identity verification / fraud prevention
Data involved: Identity, account data
Lawful basis: Legal obligation + Legitimate interests
Purpose: Payment processing
Data involved: Payment and transaction data
Lawful basis: Contract
Purpose: Clinical records
Data involved: Health data, consultation notes
Lawful basis: Legal obligation + Article 9(2)(h)
Purpose: Sharing with pharmacists / HCPs
Data involved: Health and identity data
Lawful basis: Contract + Article 9(2)(h)
Purpose: Platform operation and account management
Data involved: Account, technical data
Lawful basis: Contract
Purpose: Clinical governance and recordings
Data involved: Consultation recordings
Lawful basis: Legal obligation + Article 9(2)(h)
Purpose: Service improvement and analytics
Data involved: Usage data (anonymised)
Lawful basis: Legitimate interests
Purpose: Marketing communications
Data involved: Contact details
Lawful basis: Consent
Purpose: Regulatory and safeguarding reporting
Data involved: Health, identity data
Lawful basis: Legal obligation
Where we rely on consent (for example, for marketing communications or non-essential cookies), you may withdraw your consent at any time without affecting the lawfulness of processing already carried out.
Where special category health data is processed, we rely on UK GDPR Article 9(2)(h) — processing for the provision of health or social care — and maintain appropriate professional confidentiality safeguards.
7. PRESCRIPTION-ONLY MEDICINES AND REGULATED CARE
────────────────────────────────────────────────────────────
We provide consultations for patients who may be eligible for treatment with prescription-only medicines, including medicinal cannabis, in accordance with UK law. Clinical decisions are made by qualified clinicians at Leva Clinic Ltd, and are subject to eligibility and clinical appropriateness criteria.
If you are prescribed medication, dispensing and fulfilment is handled by the Dispensing Partner in accordance with applicable UK medicines and pharmacy regulations.
8. SHARING YOUR DATA
────────────────────────────────────────────────────────────
We do not sell or rent your personal data. We may share data only when necessary, including with:
- Leva Clinic Ltd (the regulated clinical provider), for the delivery of clinical services;
- Clinicians and HCPs involved in your care;
- Clarity Pharma Limited (as Dispensing Partner), for prescription fulfilment;
- Technology suppliers supporting scheduling, video consultations, secure hosting, analytics, and customer support — all under GDPR-compliant contracts;
- Payment providers (such as Stripe) for processing transactions;
- Your NHS GP or other specialists involved in your care (with your consent, or where this is in your best clinical interests);
- Regulators or authorities (such as the CQC, MHRA, or ICO) where required by law or to protect safety;
- Any successor business, in the event of a merger, acquisition, or restructuring, under the same data protections.
All data shared with third parties is limited to what is strictly necessary for the relevant purpose.
8.1 Anonymised and Aggregated Data
We may use and share anonymised or aggregated data for lawful business improvement, reporting, or research purposes. No personally identifiable information will be published without your explicit consent.
8.2 Healthcare Scheme Arrangements
If you receive Services through a healthcare scheme or partnership arrangement, we may share limited information with the relevant partner to verify your eligibility and monitor service quality. Such information will never be used to affect your insurance underwriting, premiums, or cover eligibility.
9. MEDICAL INFORMATION
────────────────────────────────────────────────────────────
All health and medical information you provide to us is treated as strictly confidential and processed only in accordance with UK medical standards, applicable data protection law, and our internal clinical governance policies.
9.1 Sharing with Your GP
We will seek your consent before sharing information about your care with your NHS GP. If you withhold consent, this may limit the treatment options available to you. In exceptional circumstances where sharing is necessary to protect your vital interests or to comply with legal obligations, we may share information without prior consent.
9.2 Consultation Recordings
Consultations may be recorded (audio or video) for clinical governance, training, and audit purposes. You will be notified at the time of recording. Recordings are stored securely, treated as confidential, and deleted after the minimum legally required period. They will not be shared outside the clinical governance process without your consent.
10. MARKETING
────────────────────────────────────────────────────────────
We may send service-related communications that are necessary for your care (such as appointment confirmations, clinical reminders, and safety notices).
Marketing communications (such as newsletters and promotional offers) will only be sent where permitted by law and, where required, with your prior consent. You can opt out of marketing communications at any time by using the unsubscribe link in any marketing email or by contacting us at support@productearthhealth.com.
11. COOKIES
────────────────────────────────────────────────────────────
Our website uses cookies and similar technologies to ensure the site works properly, to improve performance, and to understand how visitors use the site.
11.1 Types of Cookies We Use
Strictly necessary cookies: required for core functionality and security. These cannot be disabled.
Analytics cookies: help us understand traffic and improve content (for example, how many visitors, which pages are used). Consent required.
Functional cookies: remember your preferences and settings. Consent required.
We do not use cookies to target advertising relating to prescription medicines.
11.2 Managing Cookies
When you first visit our website, you will be asked to consent to non-essential cookies via a cookie banner. You can manage or withdraw cookie consent at any time through your browser settings or our cookie preferences tool. If you block some cookies, parts of the website may not function as intended.
A detailed list of cookies used on our website is available in our Cookie Policy, which forms part of this Privacy Policy.
12. DATA SECURITY
────────────────────────────────────────────────────────────
We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption, access controls, secure digital storage, regular security audits, and network security protocols.
Access to health data is restricted to authorised personnel only. No online system can guarantee absolute security. You should ensure your own devices and connections are secure when accessing our Platform.
Where we become aware of a security incident that is likely to affect your personal data, we will notify you and the Information Commissioner's Office (ICO) in accordance with our legal obligations.
13. DATA RETENTION
────────────────────────────────────────────────────────────
We retain your personal data only for as long as is necessary for the purposes described in this Policy, or to meet legal and regulatory obligations.
Medical and clinical records
Retention: 8 years from last contact (NHS standard), or longer if required by law
Consultation recordings (audio/video)
Retention: Minimum period required for governance, then deleted
Account and profile data
Retention: 7 years after last account activity
Support communications
Retention: Up to 3 years
Marketing preferences
Retention: Until you withdraw consent
Cookie data
Retention: As per Cookie Policy (varies by cookie type)
Payment records (non-card data)
Retention: 7 years (financial compliance obligations)
You may request deletion of non-medical personal data. Requests will be fulfilled subject to any legal and regulatory obligations that require us to retain your information.
14. INTERNATIONAL DATA TRANSFERS
────────────────────────────────────────────────────────────
Your data is primarily stored on secure servers located in the United Kingdom or the European Economic Area (EEA). Some of our service providers may process limited personal data outside the UK or EEA, including in the United States.
Where such international transfers occur, we ensure appropriate safeguards are in place, including:
- UK Addendum to the EU Standard Contractual Clauses (SCCs);
- ICO International Data Transfer Agreement (IDTA);
- Additional technical and organisational measures such as encryption and access controls;
- Providers subject to approved certification or recognised adequacy decisions.
You may request a copy of the relevant transfer safeguards by contacting us at support@productearthhealth.com.
15. AUTOMATED DECISION-MAKING
────────────────────────────────────────────────────────────
We do not use automated decision-making that produces legal or similarly significant effects on you without human involvement.
Where digital tools or algorithms are used to assist clinicians (for example, in eligibility screening), all final clinical decisions are made by qualified, regulated human professionals.
You always have the right to request human review if you believe an automated process has been applied to your case.
16. YOUR RIGHTS
────────────────────────────────────────────────────────────
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access: to receive a copy of the personal data we hold about you.
- Right to rectification: to request correction of inaccurate or incomplete data.
- Right to erasure: to request deletion of your data in certain circumstances (subject to medical and legal retention obligations).
- Right to restrict processing: to ask us to limit how we use your data.
- Right to object: to object to processing based on legitimate interests, including profiling.
- Right to data portability: to receive your data in a structured, machine-readable format in certain circumstances.
- Right to withdraw consent: where processing is based on your consent, you may withdraw it at any time.
- Right not to be subject to automated decision-making with significant effects without human review.
To exercise any of these rights, please contact us at support@productearthhealth.com. We may need to verify your identity before responding. We will respond within one month of receipt.
17. COMPLAINTS
────────────────────────────────────────────────────────────
If you are unhappy with how we have handled your personal data, we would appreciate the opportunity to resolve your concern first. Please contact us at support@productearthhealth.com.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at any time:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113 | Website: www.ico.org.uk
18. CHANGES TO THIS POLICY
────────────────────────────────────────────────────────────
We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data protection practices. The latest version will always be posted on our website with an updated effective date.
We will notify you of material changes by email or by posting a notice on the Platform. Your continued use of the Services after any changes take effect constitutes your acceptance of the updated Policy.
19. CONTACT US
────────────────────────────────────────────────────────────
For any privacy-related questions, concerns, or requests — including to exercise your data protection rights:
Email: support@productearthhealth.com
Our Data Protection contact can be reached at the same email address.
We aim to respond to all privacy enquiries as promptly as possible during normal business hours (Monday–Friday, 9:00 AM – 5:00 PM, excluding UK public holidays).
════════════════════════════════════════════════════════════
Product Earth Health is a trading brand of Clarity Pharma Limited.
Clinical services are regulated and provided by Leva Clinic Ltd (CQC-registered).
© 2026 Clarity Pharma Limited. All rights reserved.
════════════════════════════════════════════════════════════