Privacy Policy | Remedē Health

Last updated: 2 November 2026

1. Who we are

Remedē Health is the trading name of Remede Health Ltd, a company registered in England and Wales under company number 12984687.

Registered office:
108 8 Shepherd Market
London
United Kingdom
W1J 7QE

For applicable data-protection law, Remede Health Ltd is generally the “controller” of the personal information described in this Privacy Policy. This means that we determine why and how that information is processed.

You can contact us about privacy or data protection at:

Email: hello@remedehealth.com
Website: www.remedehealth.com

2. Scope of this policy

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you:

Visit or use the Remedē Health website, platform or digital services;
Enquire about or receive our healthcare-navigation, concierge or coordination services;
Become a member, client, provider, partner or supplier;
Join a Remedē Health community, directory, event or programme;
Communicate with us by email, telephone, video call, online form, social media or messaging service;
Apply to work, partner or collaborate with us; or
Otherwise interact with Remedē Health.

Our services may involve introductions to independent doctors, hospitals, clinics, laboratories, pharmacies, wellness providers, insurers, travel providers and other organisations. Unless we expressly state otherwise, these organisations are independent controllers of the information they receive and are responsible for their own privacy practices.

Remedē Health provides healthcare navigation, introductions, coordination and related support. We do not replace a doctor or other appropriately qualified healthcare professional.

3. Personal information we collect

The information we collect depends on your relationship with us and the services you request.

3.1 Identity and contact information

This may include:

Name and title;
Postal address;
Email address;
Telephone number;
Date of birth;
Gender or preferred form of address;
Nationality, country of residence and preferred language;
Passport or other identification information where necessary for travel, treatment coordination, identity verification or fraud prevention; and
Emergency-contact, family-member, representative or carer details.

3.2 Service and membership information

This may include:

Services, memberships or packages requested or purchased;
Healthcare, travel, accessibility and communication preferences;
Appointment and booking information;
Provider searches and introductions;
Case-management and coordination notes;
Event, directory or community participation;
Feedback, complaints and service history; and
Records of permissions, instructions and decisions.

3.3 Health and other sensitive information

Our website and online forms are designed to collect contact details only. Please do not enter medical information, symptoms, diagnoses, treatment details or records into the website, its forms or its AI tools.

Where it is necessary to provide a requested service outside the website, and where we have an appropriate lawful basis, we may collect:

Medical history;
Current or previous conditions, symptoms and treatments;
Medication and prescription information;
Allergies and accessibility requirements;
Laboratory results, diagnostic reports, medical images and clinical correspondence;
Details of current and previous healthcare providers;
Treatment preferences and objectives;
Genetic information where voluntarily provided and relevant to a requested service;
Information about physical or mental health; and
Other sensitive information you choose to share with us.

Health, genetic and certain other information is protected as “special category data” under UK and EU data-protection law.

We ask that you provide only information that is relevant to the service requested. We will normally obtain explicit consent before processing health information for concierge, navigation or coordination purposes unless another lawful condition applies.

3.4 Information about other people

You may ask us to assist a family member, dependant, employee, client or another individual.

If you provide information about someone else, you must have appropriate authority to do so and, where appropriate, make this Privacy Policy available to them. We may ask for evidence of consent, parental responsibility, legal authority or permission to act.

3.5 Payment and transaction information

This may include:

Billing address;
Payment status;
Transaction history;
Subscription and membership information;
Invoices and refunds; and
Limited payment-card information supplied by our payment processor.

Full payment-card details are normally collected and processed directly by payment providers such as Stripe. Remedē Health does not ordinarily retain complete payment-card numbers or security codes.

3.6 Professional and partner information

For healthcare providers, members, partners, speakers, suppliers and other professionals, we may collect:

Professional biography and contact details;
Qualifications, licences, registrations and accreditations;
Areas of practice and expertise;
Organisation and employment details;
Insurance or indemnity information;
Photographs, videos, articles and marketing materials;
Directory, marketplace and event information;
Due-diligence and compliance information; and
Commercial agreements and payment details.

We may verify information using public professional registers, regulatory records, company registers, provider websites and other legitimate sources.

3.7 Communications

We may retain:

Emails, messages and online-form submissions;
Call, meeting and consultation notes;
Messages sent through communication platforms;
Customer-service and complaint correspondence; and
Recordings or transcripts where we have provided appropriate notice and obtained consent where required.

3.8 Website and technical information

When you use our website or digital services, we may collect:

IP address;
Device and browser information;
Operating system;
Login and account activity;
Pages viewed and links selected;
Approximate location derived from an IP address;
Referral source;
Cookie identifiers; and
Security, diagnostic and performance data.

Section 13 explains the technologies we currently use.

3.9 Information obtained from other sources

We may receive information from:

Family members, authorised representatives or carers;
Employers, family offices or corporate clients arranging services;
Healthcare providers and partner organisations;
Referral partners;
Payment and identity-verification providers;
Public and professional registers;
Website, CRM, communications and analytics providers; and
Other sources where you have authorised disclosure or where the law permits it.

Where information is obtained from another source, we will provide appropriate privacy information unless an exemption applies.

4. How we use personal information

We may use personal information to:

4.1 Provide requested services

This includes:

Responding to enquiries;
Assessing service requirements;
Providing healthcare-navigation and concierge support;
Researching and presenting potential providers or pathways;
Facilitating introductions, consultations and appointments;
Coordinating records, second opinions, diagnostics, treatment, travel or aftercare;
Managing memberships, subscriptions and accounts;
Processing payments and issuing invoices;
Providing customer service; and
Communicating with clients, representatives and providers.

4.2 Operate our platform and organisation

This includes:

Maintaining provider and partner records;
Managing directories, communities and events;
Administering contracts and commercial relationships;
Verifying credentials and conducting due diligence;
Managing access and account security;
Improving our website, services and user experience;
Troubleshooting technical problems;
Maintaining business records; and
Developing new features and services.

4.3 Protect people and our services

We may process information to:

Verify identity;
Prevent fraud, misuse and unauthorised access;
Protect clients, staff, partners and the public;
Respond to an emergency;
Establish, exercise or defend legal claims;
Investigate complaints or suspected misconduct; and
Meet legal, regulatory, insurance and safeguarding obligations.

4.4 Communicate and market our services

Subject to applicable law and your communication choices, we may:

Send service and account communications;
Provide requested newsletters, invitations and updates;
Inform existing clients about related services where permitted;
Measure the performance of communications; and
Personalise website content where you have consented to relevant cookies.

You can withdraw marketing consent or unsubscribe at any time.

We do not use identifiable health information for direct marketing without an appropriate lawful basis and any consent required by law.

5. Our lawful bases

Under UK GDPR, we must identify a lawful basis under Article 6 before processing personal information. Depending on the purpose, we may rely on:

Contract: processing is necessary to enter into or perform a contract with you;
Consent: you have given clear consent for a specific purpose;
Legal obligation: processing is necessary to comply with a legal requirement;
Legitimate interests: processing is necessary for our legitimate business interests or those of another person, provided that your rights and interests do not override those interests;
Vital interests: processing is necessary to protect someone’s life; or
Another lawful basis made available under applicable data-protection legislation.

Our legitimate interests may include operating and improving our services, maintaining security, managing professional relationships, preventing fraud, responding to enquiries and protecting legal rights.

Where we rely on legitimate interests, we consider the necessity and proportionality of the processing and its potential effect on individuals.

6. Health and other special category information

In addition to an Article 6 lawful basis, we must have a condition under Article 9 of UK GDPR before processing health, genetic or other special category information.

Depending on the circumstances, we may rely on:

Your explicit consent;
Processing necessary for the establishment, exercise or defence of legal claims;
Processing necessary to protect vital interests where a person is physically or legally incapable of giving consent;
Processing necessary for health or social care where all legal and professional requirements are satisfied; or
Another condition permitted by applicable law.

For most client-directed concierge and navigation services, we expect to rely on your explicit consent to process and share health information.

You can withdraw consent at any time. Withdrawal will not affect processing already carried out lawfully. However, if the information is necessary to provide a requested service, withdrawal may mean that we cannot continue some or all of that service.

7. AI-assisted tools and automated processing

Remedē Health may use approved artificial-intelligence, search, automation and decision-support tools to assist with activities such as:

Organising and summarising information;
Administrative support;
Provider and service research;
Producing preliminary comparisons;
Matching stated preferences with potential services;
Supporting customer service; and
Improving workflow efficiency.

AI-generated output may be incomplete or inaccurate and is not a medical diagnosis, prescription or substitute for professional clinical judgement.

Where AI is used:

We apply the same data-protection principles and lawful bases that apply to the underlying processing;
We seek to minimise the personal information entered into an AI system;
We apply contractual, access and security controls where appropriate;
Material healthcare-navigation decisions remain subject to human review;
Users may request human assistance or challenge a significant recommendation; and
We do not intend to make decisions producing legal or similarly significant effects solely by automated means without a lawful basis, appropriate notice and required safeguards.

We may use genuinely aggregated or anonymised information for analytics, research, service development and innovation. Information that has only been pseudonymised remains personal information and continues to be protected.

We will not use identifiable health information to train a public or general-purpose AI model without providing separate, specific information and establishing an appropriate lawful basis and Article 9 condition.

8. When we disclose information

We disclose personal information only where necessary, proportionate and lawful.

Recipients may include:

8.1 Healthcare and service providers

With your instruction, approval or another appropriate lawful basis, we may disclose relevant information to:

Doctors and other healthcare professionals;
Hospitals, clinics and diagnostic providers;
Laboratories and pharmacies;
Second-opinion and specialist services;
Wellness, rehabilitation and care providers;
Travel, accommodation, transport and assistance providers;
Insurers and assistance companies; and
Other organisations involved in a service you request.

Independent providers will normally process information under their own privacy policies and professional obligations.

8.2 Technology and operational providers

We may use service providers for:

Website hosting, currently including Lovable;
Secure storage of accounts, enquiries and membership applications, currently including Lovable Cloud;
AI features on our website, such as the AI Navigator and the Dossier guide finder, currently including Google AI models provided through Lovable;
Team notifications about enquiries and membership activity, currently sent through Google Gmail;
Payment processing, currently including Stripe;
Secure cloud storage;
Email, telephone, video and messaging;
Electronic signatures and document management;
Cybersecurity, backup and technical support;
Analytics and cookie management;
AI and automation services; and
Accounting, legal, insurance and professional support.

These providers receive only the information reasonably necessary to perform their services and are subject to appropriate contractual or confidentiality obligations where required.

8.3 Corporate and membership arrangements

Where a company, family office, employer, insurer or another organisation purchases or sponsors a service, we will explain what information may be shared with that organisation.

We will not ordinarily disclose detailed health information to a sponsor or employer without your explicit consent unless the law permits or requires the disclosure.

8.4 Legal and safety disclosures

We may disclose information:

To comply with a court order, legal obligation or regulatory request;
To establish, exercise or defend legal rights;
To investigate suspected fraud, misuse or unlawful conduct;
To protect the vital interests or safety of an individual; or
In connection with a corporate restructuring, acquisition, financing or sale, subject to appropriate safeguards.

9. Sale and sharing of personal information

Remedē Health does not sell identifiable personal or health information for money.

Certain analytics or advertising technologies may be regarded as “sharing” under some US privacy laws even where no money changes hands. Where applicable, users will be able to manage non-essential cookies through our cookie-preference centre and exercise any legally available opt-out rights.

We do not use sensitive health information for cross-context behavioural advertising.

10. International transfers

Remedē Health operates internationally. Personal information may therefore be accessed, processed or stored outside the United Kingdom or the country where it was collected.

When restricted international transfers take place, we use an appropriate transfer mechanism where required, which may include:

A UK or EU adequacy decision;
The UK International Data Transfer Agreement;
The UK Addendum to the EU Standard Contractual Clauses;
EU Standard Contractual Clauses;
Contractual, organisational and technical safeguards;
A permitted legal derogation in limited circumstances; or
Your explicit consent where legally appropriate.

Where required, we assess the transfer and the protections available in the destination country.

You may contact us for further information about the safeguards relevant to your information.

11. Data security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration, misuse or disclosure.

Depending on the system and risk involved, these measures may include:

Encryption in transit and, where appropriate, at rest;
Access controls based on role and necessity;
Password and authentication controls;
Multi-factor authentication where available and appropriate;
Confidentiality requirements;
Secure backup and recovery procedures;
Supplier assessment and contractual controls;
Staff awareness and data-protection procedures; and
Incident-response and breach-management processes.

No internet transmission or storage system can be guaranteed completely secure. You should use secure channels when sending sensitive information and contact us if you are unsure how to provide it.

Where required by law, we will notify the appropriate regulator and affected individuals of a qualifying personal-data breach.

12. Data retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, contractual, accounting, insurance, complaints and claims requirements.

Our retention decisions take account of:

The nature and sensitivity of the information;
The services provided;
The risk of harm from unauthorised use or disclosure;
The expectations of the individual;
Professional and legal requirements;
Limitation periods for legal claims; and
Whether the purpose can be achieved using anonymised information.

Indicative retention periods may include:

General enquiries: normally up to 24 months after the last meaningful contact;
Client service and case-management records: normally for the service relationship and up to seven years afterwards, unless a shorter or longer period is appropriate or legally required;
Financial and transaction records: normally six years or for the applicable statutory accounting period;
Marketing records: until consent is withdrawn, an objection is received or the information is no longer needed;
Provider and business records: for the relationship and an appropriate period afterwards; and
Cookie and technical data: for the periods stated in our Cookie Policy or cookie-preference centre.

We may retain limited information to record an opt-out, comply with a legal obligation, resolve a dispute or establish or defend legal claims.

When information is no longer required, we delete it securely or anonymise it.

13. Cookies and similar technologies

At present, our website uses only strictly necessary technologies, such as local storage that keeps you signed in to your account and supports secure payment. We do not currently use advertising or third-party tracking cookies.

If we introduce non-essential technologies in future, they may be used for:

Essential website operation;
Security and fraud prevention;
Remembering preferences;
Analytics and performance;
Embedded content;
Personalisation; and
Advertising or campaign measurement, where used.

Strictly necessary technologies may operate without consent where permitted. Non-essential technologies will be activated only after the required consent has been obtained.

Before any non-essential technology is used, we will introduce a cookie banner allowing you to accept, reject and manage it, and a Cookie Policy describing each technology's purpose, provider and duration. Withdrawing consent will be as easy as giving it.

14. Your rights

Depending on your location and applicable law, you may have the right to:

Request access to personal information;
Request correction of inaccurate or incomplete information;
Request deletion of information;
Request restriction of processing;
Object to processing based on legitimate interests;
Object to direct marketing;
Request transfer of information in a portable format;
Withdraw consent;
Request information about automated decision-making;
Request human review of a qualifying automated decision; and
Complain to a data-protection authority.

These rights are not absolute. We may need to retain or continue processing certain information where the law permits or requires it.

We may request information to verify your identity and authority before responding. We will use verification information only for security and rights-request purposes.

For UK data-protection requests, we normally respond within one month, subject to lawful extensions for complex or multiple requests.

To exercise a right, contact:

hello@remedehealth.com

15. Additional information for California residents

This section applies only where Remedē Health is subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act, in relation to a California resident.

Subject to legal conditions and exceptions, eligible California residents may have the right to:

Know the categories and specific pieces of personal information collected;
Know the sources, purposes and categories of recipients;
Request deletion;
Request correction;
Opt out of the sale or sharing of personal information;
Limit certain uses or disclosures of sensitive personal information;
Use an authorised agent; and
Receive equal service and pricing when exercising privacy rights.

Remedē Health does not sell identifiable health information for money.

Where our use of analytics or advertising technology constitutes “sharing” under California law, an eligible user may exercise an opt-out through our cookie-preference centre or by contacting us.

We will honour legally recognised opt-out preference signals, such as Global Privacy Control, where required.

16. Additional information for Canadian residents

Where Canadian privacy law applies, including the Personal Information Protection and Electronic Documents Act or applicable provincial legislation, individuals may have the right to:

Receive meaningful information about our collection, use and disclosure practices;
Access personal information;
Correct inaccurate information;
Withdraw consent, subject to legal and contractual restrictions; and
Complain to the Office of the Privacy Commissioner of Canada or an applicable provincial regulator.

Because health information is sensitive, we will normally seek express consent where Canadian law requires consent for its collection, use or disclosure.

17. HIPAA and US health-information requirements

The US Health Insurance Portability and Accountability Act does not apply automatically to every organisation that handles health-related information.

Remedē Health may not be a HIPAA covered entity in all circumstances. Where we act as a business associate of a HIPAA covered entity, we will comply with applicable contractual and legal requirements, including any required Business Associate Agreement.

Our website is not designed to receive protected health information and is not a HIPAA-compliant platform. Please do not submit medical information through it.

18. Children and young people

Our website and services are not intended for children to use independently.

We may support healthcare arrangements for a child or young person when instructed by a parent, guardian or another person with appropriate legal authority. In those circumstances, we may:

Verify the adult’s identity and authority;
Provide age-appropriate privacy information;
Consider the child or young person’s capacity and rights;
Obtain parental or guardian consent where required; and
Collect only information reasonably necessary to provide the service.

We do not knowingly sell children’s personal information or use their health information for behavioural advertising.

If you believe that a child has provided information without appropriate authority, please contact us.

19. Third-party websites and services

Our website may link to external websites, providers, social-media services or other platforms.

We do not control the privacy or security practices of independent third parties. You should review their privacy information before submitting personal information or using their services.

A link, listing or introduction does not by itself make Remedē Health responsible for the independent organisation’s processing activities.

20. Changes to this policy

We may update this Privacy Policy to reflect changes in our services, technology, suppliers, legal obligations or data-processing practices.

The current version will be published on our website with the date it was last updated. Where a change is material, we may provide additional notice by email, account notification or a prominent website notice.

Where consent is required for a new use of information, we will request it rather than treating continued website use as consent.

21. Complaints

Please contact us first so that we can try to resolve your concern:

Email: hello@remedehealth.com

If you are in the United Kingdom, you may complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Website: https://ico.org.uk/make-a-complaint/

Individuals in the European Economic Area may complain to the supervisory authority in their country of residence, workplace or the place of an alleged infringement.

Individuals elsewhere may contact the relevant privacy or data-protection regulator in their jurisdiction.