Privacy Policy
Last Updated: 2026-09-09
1. Introduction
This policy explains how Bua Health handles your personal data, including your health data, and the rights you have. It applies to our website, the evaluation journey and the patient platform.
2. Who we are and our role in your care
Bua Health: Bua Digital Health Limited (CRO 823859), Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland ("Bua", "we", "us"). We run the platform: your account, questionnaires, messaging, progress tracking, appointment booking and payments.
Clinical Partner: An independent provider of regulated clinical services whose Medical Council-registered doctors assess your suitability for treatment, prescribe, and provide clinical follow-up, and whose CORU-registered dietitians can provide dietary plans for you. Our current Clinical Partner is MedicOnline Limited (CRO 780156), 77 Camden Street Lower, Dublin 2, D02 XE80.
Dispensing Pharmacy: The pharmacy that receives your prescription from the Clinical Partner and dispenses your medication. We tell you which pharmacy is fulfilling your order at the time.
If we change or add a Clinical Partner or pharmacy, we will update this policy and tell you if the change affects your data.
3. Who controls your data
Bua is the independent data controller for your treatment record: your questionnaire answers, progress and tracking data, symptoms and side effects, messages about your treatment and appointment history. We hold this record to run the platform and manage your care with us, and we share it with the Clinical Partner so that its clinicians can assess and treat you.
Bua is the independent data controller for your account, payment, technical and usage data, cookie choices, marketing preferences, and the aggregated data described in Section 8.
The Clinical Partner is the independent data controller for its clinicians' own consultation notes and clinical correspondence, under its own privacy notice.
The Dispensing Pharmacy is the independent data controller for your prescription and dispensing decisions and records.
4. Confidentiality
We hold your health information in confidence to the standard required of a registered medical practitioner, as Irish law requires of any non-clinician holding health data for care purposes. All staff and contractors with access to patient data are bound by a confidentiality clause to that standard; access is restricted to those who need it and is logged. This commitment also forms part of our terms of service.
5. What we collect
- Account and identity data: name, date of birth, email, phone number, address, login details.
- Health questionnaire answers: height, weight, BMI, medical history, medications, allergies, pregnancy or breastfeeding status, and other information relevant to whether treatment is safe for you.
- Progress and tracking data: weight logs, measurements, symptoms, side effects and adherence you record.
- Messages and correspondence between you and us, through any channel.
- Payment data, processed by Stripe.
- Service data: eligibility check result, appointment and order history, and prescription status from the Clinical Partner.
- Technical data: IP address, device and browser information, and cookie data (Section 9).
Our service is for adults aged 18+; we do not knowingly collect data from anyone under 18.
6. How we use your data
| Purpose | Legal basis |
|---|---|
| Provide your account and the platform, collect your questionnaire and progress data, make it available to the Clinical Partner, hold your treatment record, take payment | Our contract with you. For health data: the provision and management of health care, under the duty of confidentiality in Section 4 |
| Run the automated eligibility check | Your explicit consent (Section 7) |
| Keep records the law requires (treatment records, financial and tax records) | Legal and professional obligations |
| Secure the platform, prevent misuse, fix problems | Our legitimate interest in running a safe service |
| Produce aggregated clinical data | Our legitimate interest in improving treatment and understanding outcomes (Section 8) |
| Invite you to research using individual-level data | Your explicit consent (Section 8) |
| Send marketing emails; set non-essential cookies | Your consent, withdrawable at any time |
We follow Data Protection Commission guidance in applying these bases. You may object to any use based on our legitimate interests (Section 13).
7. Initial eligibility check
As the first step in assessing your suitability, our system checks your questionnaire answers against clinical protocols defined by the Clinical Partner. These generally concern whether treatment is licensed and safe for you, for example BMI range, certain conditions or medications, and pregnancy, and may change with clinical guidance. If you are found ineligible at this stage, we will tell you and no payment is taken. If you pass, your suitability is then assessed by a Clinical Partner clinician.
Because the first step is a decision made by automated means using your health data, we ask for your explicit consent before the questionnaire starts. If you believe the result is wrong, email dpo@buahealth.ie within 12 months and a Clinical Partner clinician will review your answers. We keep the answers of those found ineligible for 12 months for this purpose.
8. Aggregated clinical data and research
Aggregated data: We produce statistics from patient data describing groups rather than individuals, generally treatment patterns and outcomes across cohorts. These cannot identify you and are not personal data. We use them to improve the service, support clinical governance, publish results and provide reports to partners. We apply recognised anonymisation techniques. Producing them is based on our legitimate interests as a use compatible with your care; you may object (Section 13), and your data will be excluded from future statistics.
Research: We may invite you to take part in specific research projects using data at an individual rather than group level. Where we do, we ask for your explicit consent through a separate step. Participation is optional and declining or withdrawing does not affect your treatment.
9. Cookies
We use cookies on our public website, the evaluation journey and the platform. Control non-essential cookies through the banner; select "Manage preferences" at any time.
- Strictly necessary: sign-in, session security, remembering your cookie choices. Cannot be switched off.
- Analytics (consent required): understanding how our pages are used so we can improve them.
- Marketing (consent required, public pages only): measuring our advertising impact.
10. Who we share your data with
- The Clinical Partner, for your care, and the Dispensing Pharmacy, which receives your prescription and order details.
- Service providers acting on our written instructions: hosting and database, payments (Stripe), questionnaire and scheduling tools, email delivery, technical monitoring, and analytics (with your consent). They may not use your data for their own purposes.
- Professional advisers, where we need advice or must demonstrate compliance.
- Regulators, courts and law enforcement, where required by law.
- A replacement Clinical Partner or pharmacy, so your care can continue if we change partners.
- A buyer or successor in a sale, merger or reorganisation, under confidentiality protections and with notice to you.
We do not sell your personal data to third parties for their own marketing purposes.
11. Where your data is stored
Your data is stored in the European Union. Where a service provider accesses it from outside the EEA, we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses.
12. How long we keep your data
| Data | Retention |
|---|---|
| Treatment record | 8 years from your last interaction with us, in line with HSE and Medical Council norms for adult patient records |
| Answers of people turned away by the eligibility check | 12 months |
| Account data | Life of your account plus 3 years |
| Payment and financial records | 6 years from the end of the relevant financial year, as company and tax law require |
| Consent records (cookies, marketing, research) | Life of your account plus 3 years |
| Marketing preferences | Until you withdraw or object |
| Technical logs | 12 months |
| Anonymous statistics | Indefinitely; they do not identify you |
At the end of a retention period we delete the data or make it anonymous.
13. Your rights
You can ask us to: give you access to your data; correct it; delete it (except your treatment record, which we must keep for the period above but will restrict to record-keeping); restrict its use; object to uses based on our legitimate interests or to marketing; give you a portable copy; and withdraw any consent you have given. You also have the protections in Section 7 regarding automated decisions.
Email dpo@buahealth.ie. We respond within one month, or up to three months for complex requests, and may need to confirm your identity. For your treatment record you may contact either us or the Clinical Partner. Requests concerning the Clinical Partner's own notes or the pharmacy's records will be passed to the right controller. In rare cases the law allows a clinician to withhold part of a health record where disclosure would be likely to cause serious harm to your health; that judgement is the Clinical Partner's, not ours.
14. Contact and complaints
Data Protection Officer: dpo@buahealth.ie, Bua Digital Health Limited, Venture Hub, 136 Capel Street, Dublin 1, D01 T2C9, Ireland.
You may complain to the Data Protection Commission at any time: www.dataprotection.ie ("Raise a Concern"), 6 Pembroke Row, Dublin 2, D02 X963, or (01) 765 0100 / 1800 437 437.
15. Changes
We will update this policy when our practices change and tell you through the platform or by email before any material change takes effect.