Privacy Policy

Effective date: 8 May 2025

CutKilo – one-way path to better health

CutKilograms Ltd (Company No. 15916920)

Registered in England and Wales

1. Who We Are

At CutKilo, your privacy is central to everything we do. We are a UK-based digital health service offering clinically monitored weight loss programmes, under the supervision of GMC-registered doctors. This Privacy Policy explains how we collect, use, share, and protect your personal data.

For any privacy-related queries, contact us at: info@cutkilo.com

2. The Data We Collect

Depending on how you use our services, we may collect:

a. Identity & Contact Data
– Full name
– Date of birth
– Address
– Email
– Phone number
– Proof of ID (photo ID and selfie)

b. Health & Medical Data
– Weight, height, BMI
– Blood test results
– Medical history and medication usage
– Photos (for progress tracking)
– Clinical notes and consultation records
– Responses to health questionnaires

c. Technical & Usage Data
– IP address
– Device type and browser
– Operating system
– Log files and interaction data
– Cookies and usage analytics

d. Communication Data
– Emails, messages, and enquiries
– Feedback or survey responses

3. How We Use Your Data

We use your data to:

  • Deliver safe, effective weight loss support and prescriptions
  • Verify your identity and age before treatment
  • Coordinate services such as blood testing and pharmacy delivery
  • Maintain accurate and compliant medical records
  • Communicate with you via email or SMS
  • Improve our clinical care, website, and digital experience
  • Comply with legal and professional obligations
  • We do not sell your data or use it for third-party advertising.

4. Legal Basis for Processing

We rely on the following legal bases under UK GDPR:

  • Consent – when you actively opt into our services or communications
  • Contract – to provide healthcare services you’ve requested
  • Legal obligation – to comply with healthcare and regulatory laws
  • Vital interests – in urgent cases to protect your health
  • Legitimate interests – to ensure safe, secure, and functional service delivery (balancing your rights and freedoms)

5. Sharing Your Data

We share your data only when necessary, and always securely. We may share data with:

  • Clinicians involved in your care
  • Laboratories (e.g. Medichecks for blood testing)
  • Pharmacies (to dispense medication)
  • ID verification provider – Onfido: We use Onfido Ltd to confirm your identity and age. This involves processing your photo ID and a selfie using secure facial recognition and anti-fraud technology. Onfido acts as a data processor on our behalf.
  • Patient record system – Semble: We use Semble, a UK-based secure platform for managing patient records, appointment history, and medical documentation. Semble complies with GDPR and UK data security
  • standards for healthcare.
  • Cloud and IT providers who help us host and maintain our systems (e.g. website, analytics, communications)
  • Regulators or public authorities where legally required

All third parties are carefully vetted, GDPR-compliant, and bound by data processing agreements with strict confidentiality and security terms.

6. Data Security

We take data protection seriously. Your data is stored securely using:

  • End-to-end encryption
  • Role-based access controls
  • Multi-factor authentication
  • Secure, UK- or EU-based cloud infrastructure
  • Data minimisation and audit logging
  • Routine penetration testing and security reviews

Only authorised personnel have access to your data.

7. Data Retention

We retain your health records for a minimum of 8 years after your last interaction with us, in accordance with NHS and GMC guidelines. In some cases (e.g. for minors or specific medical reasons), we may need to retain it longer.

When data is no longer needed, it will be securely deleted or anonymised.

8. Cookies and Analytics

Our website uses essential and analytical cookies to:

  • Maintain platform functionality
  • Understand how users interact with content
  • Improve performance and design

You can manage your cookie preferences via your browser settings. View our Cookie Policy.

9. Your Rights

You have rights under data protection law, including:

  • Access – to request a copy of your personal data
  • Correction – to update or correct your information
  • Erasure – to request deletion where applicable
  • Restriction – to limit how your data is processed
  • Objection – to processing based on legitimate interests
  • Data portability – to receive your data in a usable format
  • Withdraw consent – where processing is based on your consent

To exercise your rights, email info@cutkilo.com.
You also have the right to lodge a complaint with the ICO: www.ico.org.uk

10. Children’s Privacy

Our services are intended for individuals aged 18 and over. We do not knowingly collect or process data from minors.

11. Changes to This Policy

We may update this Privacy Policy to reflect legal, regulatory, or service changes. If we make significant updates, we’ll notify you by email or on our website.

Last updated: 8 May 2025