Who I am
Performance Health AI Ltd, trading as Performance Health and PerformanceIQ, is the data controller. It's my company: Lou Nicholettos, HCPC registered physiotherapist (PH80785). ICO registration ZB978346. Email lou@performancehealth.uk.
What I collect
- Your details: name, date of birth, sex, email, phone, address, GP practice.
- Your health data: blood results from the laboratory, your answers to the Performance Health Blueprint questionnaire, the health history, medications and supplements you tell me about, and anything you share in calls or messages.
- What I produce for you: your report, scores, and any food, lifestyle or supplement plan.
- Consent records: the exact version of the consent form you signed, your signature, the time, and the device details, kept as evidence that consent was given.
- Payments: handled by Stripe. I never see or store your card number.
- How you found me: if you ordered through a partner clinic's page, the clinic's name is recorded against your order.
Why, and the legal basis
- Producing your report and delivering the service you bought: your explicit consent (UK GDPR Article 9(2)(a)) for the health data, and performance of our contract for the rest.
- Keeping a professional record: legal obligation and legitimate interest, because I'm a registered health professional and my insurer and regulator expect records to be kept.
- Flagging anything that needs medical attention: part of the service, and my professional duty of care.
- Improving the analysis using anonymised data: only if you tick that option. Everything that could identify you is removed first.
- Emails about guides, webinars and services: only if you tick that option. Every email has an unsubscribe link.
- Paying partner clinics: legitimate interest. The clinic receives a monthly count of orders from its page, never your results.
Who else handles your data
I use a small number of providers, each under a contract that limits what they can do with your data:
- Your Blood and its partner phlebotomy clinics and UKAS accredited UK laboratory: they take and analyse your sample. Your name and date of birth go on the order; your results come back to me. Their own privacy notice covers the blood draw itself.
- Supabase (database hosted in London) for your records, consent evidence and questionnaire answers.
- GoHighLevel (LeadConnector) for email, appointment booking and keeping track of where you are in the process. It stores your contact details and the status of your order, not your health data. It is based in the United States; the transfer is covered by the UK International Data Transfer Addendum.
- Stripe for payment.
- Google Workspace for email and the secure folder your report is delivered to.
- WhatsApp (Meta) only if you choose it as a contact channel.
- Vercel hosts these pages and the forms.
- Your partner clinic, if you ordered through one: a count of orders each month, and your finished report only if you ask me to send it to them.
I don't sell data, and I don't share it with anyone else unless the law requires it or you ask me to (for example, a letter to your GP).
How long I keep it
Health records are kept for 8 years after our last contact, in line with the record keeping standards that apply to registered health professionals, then securely deleted. Consent records are kept for the same period as the record they relate to. Financial records are kept for 6 years as HMRC requires. If you ask me to delete your data earlier, I'll delete everything I'm not legally or professionally required to keep, and tell you what remains and why.
Your rights
You can ask for a copy of your data, have it corrected, ask for it to be deleted, object to or restrict how it's used, take it elsewhere, and withdraw any consent you've given. Email lou@performancehealth.uk and I'll respond within a month. If you're not happy with how I've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Data is encrypted in transit and at rest. Access is limited to me and, where a task needs it, the providers above. The public forms can write a record but cannot read anything back. If a breach ever put your rights at risk, I would tell you and the ICO within 72 hours.
Cookies
These pages set no advertising or tracking cookies. The forms use your browser's local storage only to save a half finished questionnaire on your own device.
Changes
If this notice changes in a way that matters to you, I'll email you. The version and date are at the top of the page.