Heatlhy Nation respects your privacy. Here is what that means in practice: what we collect, why, who we share it with, and how to ask us to stop.
The controller for personal data on this site is {{COMPANY_REGISTERED_NAME}} ({{COMPANY_REGISTERED_NUMBER}}), registered office LVAC 61 Meridian Way, London N9 0AR. Heatlhy Nation is the consumer arm of The Healthy Group and operates the movement, programmes and members area you see across this site. Our ICO registration is {{ICO_REGISTRATION_NUMBER}}.
For anything to do with your personal data (copies, corrections, deletions, complaints), write to our Data Protection Officer at support@heatlhynation.co.uk or by post to LVAC 61 Meridian Way, London N9 0AR. We aim to reply within ten working days and will always reply within one month, in line with UK GDPR.
We only collect what we actually use. In practice that is:
We do not buy personal data from data brokers. We do not run behavioural advertising. We do not profile you to predict future behaviour.
Under Article 6 of the UK GDPR we need a lawful basis for every use of personal data. Ours are:
Heatlhy Nation works with under-18s, so we follow the Information Commissioner's Age-Appropriate Design Code (the Children's Code). In short:
Some of our programmes touch nutrition and mental health. If you choose to record dietary notes or mood entries in the members area, that information is special category data under Article 9 of the UK GDPR. Our lawful basis is your explicit consent under Article 9(2)(a). You can withdraw that consent at any time and we will delete the related records within thirty days.
We do not use health-related information to make automated decisions about you. We do not share it with insurers, employers, or anyone else outside the programme team handling your enrolment.
We do not sell personal data. We do not transfer personal data to a buyer in the event of a corporate restructure without giving you advance notice and an opportunity to opt out.
| Category | Retention | Why |
|---|---|---|
| Account record (name, email, year of birth) | Life of the account, then twelve months in cold storage | Re-enrolment requests; safeguarding referrals. |
| Programme attendance | Three years from the last session | Reporting to funders; long-term outcome research. |
| Health-related entries (nutrition, mood) | Deleted within thirty days of consent withdrawal or account closure | Explicit consent is the only basis; we hold it no longer than needed. |
| Contact-form messages | Two years | Continuity of support; complaint handling. |
| Financial records (donations, paid tier) | Seven years | HMRC and Charity Commission requirements. |
| Safeguarding logs | Until the subject is twenty-five (or longer if guidance requires) | Statutory safeguarding guidance for children's services. |
| Server access logs | Ninety days | Security, abuse investigations. |
The UK GDPR gives you eight rights, all exercisable through support@heatlhynation.co.uk.
Most of our processing happens in the United Kingdom and the European Economic Area. Where a processor handles data outside those areas (for example, where a US-headquartered vendor uses regional infrastructure), we rely on the UK International Data Transfer Agreement (IDTA) or, where relevant, the EU Standard Contractual Clauses with the UK Addendum, plus the supplementary safeguards required by UK case law. We list each transfer in the data-sharing record kept by the DPO; ask us if you want to see it.
We update this notice when the law changes, when we add a new processor, or when we change what we collect. The version and date at the top of the page change every time. We will email registered members for any material change at least thirty days before it takes effect.
