Privacy Notice

We have not set a launch date. We will email you when membership opens.

Updated 13 November 2026. This notice covers the waiting list only. It will be replaced by a full notice before any service launches.

Who we are

Lyria Health Ltd (company number 17447033) is the controller of the personal information described here. We are registered with the Information Commissioner's Office, registration number ZC256186. You can contact us at hello@lyriahealth.co.uk.

What we collect

Your first name and email address.

If you choose to give it: the membership tier you are interested in, and how you heard about us.

A record of your consent: the date and time you signed up and confirmed, the version of the consent wording you saw, the page you signed up from, and a hashed (scrambled) version of your IP address. We do not store your IP address in readable form.

When you join, we record the campaign source, medium and campaign name in your link, and the referring website origin where available. We exclude referrer paths, queries and fragments. This helps us understand where requests come from, works without cookies or optional analytics, and is kept with your consent record. Browsers and social platforms may omit the referrer.

Your email preferences, including if you unsubscribe.

We do not ask for health information and do not want it. Please do not include any in the form or in replies.

Why we use it and our lawful basis

We use your details only to email you about Lyria's launch and to tell you when membership opens. Our lawful basis is your consent (UK GDPR Article 6(1)(a)), and we send emails in line with the Privacy and Electronic Communications Regulations. We keep a record of your consent so that we can show it was given. You can withdraw consent at any time. Withdrawing does not affect anything we did before.

Who we share it with

We do not sell your information or share it for others' marketing. Our processors act on our written instructions. Cloudflare also processes Turnstile information under its own privacy notice.

Supabase stores waiting-list and consent records. Our production database is in London (eu-west-2). A restricted recovery copy is retained in Ireland. Database location does not determine the location of provider support or other services.

Brevo sends confirmation, welcome and launch emails. Data is stored in the EU only: France and Germany on OVH, and Belgium on Google Cloud. Staff in the US, India and Canada may access data remotely for support and maintenance, under Standard Contractual Clauses with the UK Addendum, and the EU-US Data Privacy Framework with its UK Extension where certified.

Google Workspace handles correspondence sent to hello@lyriahealth.co.uk, in Google data centres that may be outside the UK.

Netlify hosts this website and runs its server functions in London. Its wider content delivery network and supporting operations are international and are not exclusively UK-based. Cloudflare Turnstile protects forms from automated abuse and processes browser and device signals, including IP addresses. Cloudflare operates internationally; we do not claim UK-only or EU-only processing. See Cloudflare’s Turnstile privacy notice.

Optional website analytics

With your separate consent, Cabin provides aggregate visitor, page and referring-site statistics. We send public page addresses without query strings or fragments, external referring website origins where available, screen width, page-load timing and cache-based visit counts. We do not send subscriber details, form values, consent records, campaign parameters or private links. These statistics are not individual signup attribution. You can reject or withdraw through Privacy settings; Global Privacy Control is respected. Our Cookie Notice explains browser storage and your choices.

Cabin is operated by Nic Mulvaney LTD. It stores analytics in AWS Ireland. Collection endpoints in Stockholm, Montreal and Seoul forward requests to Ireland without writing them to disk. Cabin says IP addresses are used briefly in memory for country lookup and configured exclusions, then discarded. Collection can therefore involve processing outside the UK and EU; see Cabin's privacy policy for transfer safeguards. Cabin's plan limits how far back reports can be viewed, not a guaranteed deletion period. Aggregate traffic data can remain until removed through the service; we do not promise its deletion after 30 days. See Cabin's terms.

Transfers outside the UK

Where data is transferred outside the UK, we rely on Standard Contractual Clauses including the UK Addendum where applicable, and on the EU-US Data Privacy Framework and its UK Extension where the provider is certified. Email us to ask which safeguard applies or request a copy.

How long we keep it

Unconfirmed requests are deleted after 7 days. Confirmation links are valid for 7 days and work once.

Confirmed entries are kept until the earliest applicable event: unsubscribe or deletion request; 3 calendar months after membership opens; or 12 calendar months after joining if membership has not opened by then.

Consent evidence, including timestamps, wording/version, source page, hashed IP address and campaign attribution, is kept for the same lifetime as the entry.

After withdrawal, a protected email hash prevents further contact for as long as Lyria sends marketing emails. Fresh signup and confirmation are required to rejoin.

Complaint and bounce holds are kept for the same period as the do-not-contact list, for as long as Lyria sends marketing emails. The director of Lyria Health Ltd will review these holds at least once every 12 months. A review does not authorise further email. Opening paid membership or opening or temporarily pausing the waiting list does not remove these holds. Provider-held complaint and bounce blocks are managed separately.

Mailbox correspondence is kept for 12 months after the last exchange. Our retention policy limits Lyria-controlled recovery copies of deleted data and application logs to 30 days. Netlify provides access to function logs covering up to 7 days. Its separate platform security logging policy retains logs online for 90 days and offline for 1 year; these provider security logs are not controlled by our application cleanup.

Your rights

You can request access, correction, deletion, restriction or data portability; object to processing based on legitimate interests; and withdraw consent at any time without affecting earlier processing. Email hello@lyriahealth.co.uk to unsubscribe or make a request, or use the unsubscribe link in any email. We aim to reply within one month and may take up to two further months for complex requests, telling you if so. We do not charge a fee and may ask you to verify your identity. You can complain to the Information Commissioner's Office at ico.org.uk.

Children

This waiting list is for adults aged 18 or over.

Complaints

If you are unhappy with how we use your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

We will update this notice when our service or the processors we use change, and we will tell people on the list about material changes.

Lyria Health is not yet registered with the Care Quality Commission. We will not offer consultations or tests until we are registered.