Privacy Notice
How we collect, use, and protect your personal and health data under UK GDPR.
Last updated: 29 June 2026
1. Who We Are
PowerGut ("we", "us", "our") is a gut health education and wellness platform based in London, UK.
Contact Details:
- Email: contact@powergut.co.uk
- Website: https://powergut.co.uk
For data protection purposes, PowerGut is the data controller — meaning we decide how and why your personal data is processed.
2. What Data We Collect
We collect the following types of data:
Personal Information:
- Name and email address (when you create an account)
- Account credentials (password, authentication tokens)
Health Data (Special Category Data under UK GDPR):
- Symptoms (bloating, stomach pain, constipation, diarrhoea, nausea, heartburn)
- Bowel movement patterns and stool type
- Diet and nutrition information (food intake, supplements)
- Sleep patterns and quality
- Mood, stress levels, and mental health indicators
- Energy levels and physical activity
- Test results (omega-3, vitamin D, microbiome diversity)
Usage Data:
- Pages viewed, articles read, and content interactions
- Device information and browser type (for security and analytics)
3. Why We Process Your Data
We use your data for the following purposes:
- AI-Powered Health Insights: To provide personalised recommendations based on your symptoms, diet, and lifestyle patterns
- Progress Tracking: To show you trends in your gut health over time through dashboards and reports
- Personalised Content: To recommend articles, recipes, and resources relevant to your health goals
- Account Management: To maintain your account, authenticate logins, and provide customer support
- Service Improvement: To understand how users interact with our platform and improve features
- Security: To detect and prevent fraud, abuse, and security incidents
- Legal Compliance: To meet our obligations under UK law (e.g., tax, consumer rights)
4. Legal Basis for Processing
For Personal Data: We process your personal data under Article 6(1)(b) UK GDPR (performance of contract) — to provide the services you requested when creating an account.
For Health Data (Special Category Data): We process your health information under Article 9(2)(a) UK GDPR — explicit consent. This means:
- You actively opt in to sharing your health data with us
- Your consent is separate from general account creation
- You can withdraw consent at any time (see section 7)
- Withdrawal does not affect the lawfulness of processing before withdrawal
For Marketing Communications: We send newsletters and promotional content only with your explicit consent (Article 6(1)(a) UK GDPR). You can unsubscribe at any time.
5. How We Share Your Data
We do not sell your personal or health data. We only share data in the following circumstances:
AI Service Providers:
- Your health data may be processed by AI providers (e.g., LLM APIs) to generate personalised insights
- These providers act as data processors under contract with us
- They are prohibited from using your data for their own purposes
Hosting and Infrastructure:
- Our platform is hosted on secure cloud infrastructure (Base44)
- Data is encrypted in transit and at rest
Legal Requirements:
- We may disclose data if required by law, court order, or regulatory authority
- We may share data to protect our rights, safety, or property
Service Providers:
- Email delivery services (e.g., Resend) for transactional emails
- Analytics providers (anonymised data only)
All third parties are contractually bound to protect your data and comply with UK GDPR.
6. How Long We Keep Your Data
Account Data:
- We retain your personal data for as long as your account is active
- If you delete your account, we erase your personal data within 30 days
Health Data:
- We retain health data for 3 years after your last activity
- This allows you to return and see historical trends
- After 3 years, health data is automatically anonymised or deleted
Marketing Data:
- We retain newsletter subscription data until you unsubscribe
- Unsubscribe requests are processed immediately
Legal Requirements:
- We may retain certain data longer if required by law (e.g., tax records, consumer rights)
7. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right to Access: Request a copy of your personal data (Subject Access Request)
- Right to Rectification: Request correction of inaccurate or incomplete data
- Right to Erasure: Request deletion of your data ("right to be forgotten")
- Right to Restrict Processing: Request limitation of how we use your data
- Right to Data Portability: Request transfer of your data to another service
- Right to Object: Object to processing, including for direct marketing
- Right to Withdraw Consent: Withdraw consent for health data processing at any time
How to Exercise Your Rights:
- Email: contact@powergut.co.uk
- Use the GDPR Request form on our website
- We respond within 30 days (one month)
Right to Complain: You can complain to the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk
- Helpline: 0303 123 1113
8. How to Withdraw Consent
You can withdraw consent for health data processing at any time:
Via Your Account:
- Go to My Health → Settings → Data Preferences
- Toggle off health data processing
- This will disable AI insights and personalised tracking
Via Email:
- Email contact@powergut.co.uk with subject "Withdraw Consent"
- Include your account email address
What Happens When You Withdraw:
- We stop processing your health data within 7 days
- We delete your health data within 30 days (unless you request retention)
- Your account remains active, but AI features are disabled
- Withdrawal does not affect processing that occurred before withdrawal
9. Data Security
We implement appropriate technical and organisational measures to protect your data:
Encryption:
- All data is encrypted in transit using HTTPS/TLS
- Sensitive data is encrypted at rest
Access Controls:
- Only authorised personnel can access personal data
- Multi-factor authentication for admin accounts
Regular Reviews:
- We conduct regular security audits
- We maintain a Data Protection Impact Assessment (DPIA) for AI health processing
Data Breaches:
- We have procedures to detect, investigate, and report breaches
- We notify affected users and the ICO within 72 hours if required
10. International Transfers
Your data may be transferred outside the UK in the following circumstances:
AI Service Providers:
- Some AI providers may process data in the US or other countries
- We ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the ICO
- Provider certification under the EU-US Data Privacy Framework
Hosting:
- Our hosting provider may store data in servers outside the UK
- All transfers comply with UK GDPR Chapter 5 requirements
11. Children's Privacy
Our services are not intended for children under 16 years of age.
We do not knowingly collect data from children under 16. If we discover that we have collected data from a child under 16 without parental consent, we will delete it immediately.
If you are a parent or guardian and believe your child has provided us with data, please contact us at contact@powergut.co.uk.
12. Changes to This Notice
We may update this Privacy Notice from time to time to reflect changes in our practices, technology, or legal requirements.
How We Notify You:
- We post the updated notice on this page with a new "Last Updated" date
- For significant changes, we notify you via email or in-app notification
- We encourage you to review this notice periodically
Your Rights:
- If changes affect how we process your health data, we will seek fresh consent
- You have the right to object to new processing activities
13. Contact Us
Questions or Concerns: If you have questions about this Privacy Notice or our data practices, contact us:
- Email: contact@powergut.co.uk
- GDPR Request Form: Submit a request via our website
Data Protection Officer: We do not have a statutory requirement to appoint a Data Protection Officer (DPO), but we have designated a privacy lead responsible for data protection compliance.
Last Updated: 29 June 2026