Legal
Privacy policy
Last updated 31 March 2026
Who we are
Healum Ltd (“Healum”, “we”, “us”) makes software that helps people manage their health, used by the NHS, councils and other health and care organisations.
Healum Ltd is registered in England and Wales (company number 09261020). Our registered office is 28 Mason Street, Manchester M4 5EY. We are registered with the Information Commissioner’s Office (ICO), registration number ZA254966.
What this policy covers
- Part 1 covers this website: what we collect when you visit it, fill in a form or sign up to our newsletter.
- Part 2 covers the Healum app: how we handle your information if your GP practice, hospital or another health provider has given you access to Healum.
Our data protection policy sets out how our staff handle personal data. Our cookies policy lists the cookies this website uses.
Part 1: this website
What we collect
- When you fill in a form to request a demo, contact us or register for an event: your name, email address and organisation and, depending on the form, your phone number, sector, role, the topics you are interested in and your message.
- When you sign up to our newsletter: your email address, and your first name if you give it.
- Where your visit came from, sent with any form you fill in: the page you landed on, the website that linked to it and any campaign tags in its address. If you accept marketing cookies, we also remember which campaign or ad brought you here for up to 90 days, and send the ad’s click reference.
- How the site is used: Google Analytics counts page views and clicks. It is on unless you switch it off in Cookie settings, at the bottom of every page.
- Security checks: Google reCAPTCHA checks that our forms are sent by a person, not a program. To do this, Google collects information about your browser and how you use the page.
Why we use it
What we do | Our lawful basis |
|---|---|
Reply to your enquiry, arrange a demo or register you for an event | Legitimate interests: responding to people who contact us |
Keep a record of enquiries and follow them up, in our customer system (HubSpot) | Legitimate interests: running and growing our business |
Send you our newsletter | Consent: you can unsubscribe at any time with the link in every email |
Measure how the site is used, to improve it | Legitimate interests: knowing which pages help people lets us improve the site. You can switch site statistics off at any time in the cookie settings |
Measure our advertising, and show our ads to people who have visited | Consent: given by accepting marketing cookies |
Protect our forms from spam and abuse | Legitimate interests: keeping the site secure |
Who we share it with
These companies help us run the website. They handle your information on our behalf:
- HubSpot: our customer system, where enquiries and newsletter sign-ups are kept.
- Google: Google Analytics (site statistics), Google Ads (advertising, only with your consent) and reCAPTCHA (security).
- Google Cloud: hosts this website and its database, in London.
- SparkPost: delivers the website’s emails, such as passing your enquiry to our team.
We do not sell your information.
Some of these companies may handle your information outside the UK. Where they do, we rely on the UK’s adequacy regulations, or on the ICO’s international data transfer agreement or addendum, to protect it.
How long we keep it
We keep enquiries and newsletter sign-ups for two years after we last hear from you, or until you unsubscribe. Google Analytics keeps site statistics for 14 months.
Part 2: the Healum app
Our role
Healum is provided to you by your GP practice, an NHS hospital or another health or care organisation. That organisation is the controller of your personal data: it decides how your data is used. Healum is its processor: we only use your data on its written instructions, and at the end of our contract with it we return or destroy your data.
Where we use data from the app to improve Healum, through machine learning, Healum and your GP practice act as joint controllers, under an agreement that sets out each one’s responsibilities.
What we use it for
Purpose | Healum’s lawful basis | Your GP practice’s lawful basis |
|---|---|---|
Providing the Healum app | Article 6(1)(f), legitimate interests; Article 9(2)(h), provision of health and social care | Article 6(1)(e), public task; Article 9(2)(h), provision of health and social care |
Improving Healum through machine learning | Article 6(1)(f), legitimate interests; Article 9(2)(j), scientific research | Article 6(1)(e), public task; Article 9(2)(j), scientific research |
The articles are those of the UK General Data Protection Regulation (UK GDPR). The legitimate interests we pursue are making sure people living with long-term conditions can get support through Healum, and improving Healum so that it gives a more personal service.
Where it is kept
Your personal data stays in the UK.
How long we keep it
We keep your personal data while you use Healum, and for one year after your last activity.
Research studies
If you are taking part in a research study that uses Healum, the study’s participant information explains how your data is used.
The study Enhancing type 2 diabetes treatment through digital plans of care (REC reference 20/NW/0203, IRAS ID 272569), run by Vernova CIC and Healum, has ended. For the data it collected:
- Healum, Vernova CIC and your GP practice are joint controllers, under an agreement that sets out each one’s responsibilities.
- For the research itself, Healum and Vernova CIC rely on Article 6(1)(f), legitimate interests, and your GP practice on Article 6(1)(e), public task; all three rely on Article 9(2)(j), scientific research.
- Your data is shared with Vernova CIC as chief investigator, and with no other organisation unless there is a lawful basis to do so. If there is, we will tell you before it happens, unless the law prevents us.
- Research data is anonymised where possible and kept for no longer than 20 years. As the study’s sponsor, Healum keeps only a pseudonymised subject ID.
- You can withdraw from the study at any time. No more data will then be collected from you; data collected up to that point is anonymised where possible and kept, to protect the integrity of the research.
Your rights
You have the right to:
- ask for a copy of your personal data
- ask us to correct it
- ask us to delete it
- object to how we use it, or ask us to restrict it
- ask for it in a format you can take elsewhere
- withdraw your consent at any time, where we rely on it
Some rights apply only in certain circumstances. If we cannot do what you ask, we will tell you why and how to appeal.
If you use the Healum app, please contact your GP practice or health provider first: as the controller, it handles your request, and we help it. You can also contact us. Making a request is free.
Contact us
Our Data Protection Officer, Data Privacy Services, independently monitors how we comply with data protection law. You can contact them at info@dataprivacyservices.co.uk, or at Data Privacy Services, 124 City Road, London EC1V 2NX.
You can also write to us at Healum Ltd, 28 Mason Street, Manchester M4 5EY.
Complaints
If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by email to casework@ico.org.uk, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes to this policy
We update this policy when the way we use personal data changes. The date at the top shows when it last changed.