Privacy Policy

Effective date: 27th August 2026 Last updated: 27th August 2026

Onna Health Ltd (trading as "Onna", "we", "us", "our") is committed to protecting your privacy and handling your personal information with care. This policy explains what information we collect, how we use it, who we share it with, and the rights you have over it.

Onna Health Ltd is the "data controller" of your personal information. Our details:

This policy applies to our website, our membership services, our communications with you, and any other interaction where we collect your personal information. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR) where applicable, and includes provisions for residents of the United States (see Section 12).

1. Information we collect

Information you give us:

  • Identity and contact details — name, email address, phone number, postal address.

  • Account information — login details, membership type, preferences.

  • Health and wellbeing information — information you share about your symptoms, health history, wellbeing goals and lifestyle (for example during your introductory call, in intake forms, or in communications with us or with practitioners booked through Onna). This is "special category data" and is treated with additional protections (see Section 4).

  • Payment information — payments are processed by our payment provider; we do not store your full card details. We keep records of your subscription, billing history and payment status.

  • Communications — messages, emails, feedback, survey responses, reviews and call notes.

Information we collect automatically:

  • Technical and usage data — IP address, device and browser type, pages visited, time on site, referral source, and interactions with our emails, collected via cookies and similar technologies (see Section 11).

Information from third parties:

  • Limited information from our service providers (for example booking confirmations, payment status, appointment attendance) and, where you consent, from practitioners regarding your care (see Section 5).

We do not knowingly collect information from anyone under 18. Our services are designed for adults.

2. How we use your information and our lawful bases

We use your personal information to:

  • Create and manage your account and membership — performance of a contract

  • Provide our services, including your consultation and support with practitioners — performance of a contract; explicit consent for health information

  • Process payments and manage billing — performance of a contract; legal obligation

  • Communicate with you about your membership, bookings and account — performance of a contract

  • Send marketing communications (where you have opted in) — consent

  • Improve our services, website and member experience — legitimate interests

  • Ensure the safety, security and integrity of our services — legitimate interests; legal obligation

  • Comply with legal and regulatory obligations — legal obligation

  • Establish, exercise or defend legal claims — legitimate interests; legal claims basis for special category data

  • Create anonymised data to build an evidence base for non-hormonal perimenopause support — explicit consent (for the underlying health information used to create it)

  • Check in on your experience and gather feedback on the service — legitimate interests

3. What we will never do

  • We will never sell your personal information.

  • We will never share your health information for advertising purposes.

  • We will never send you marketing without your consent, and every marketing message includes a simple way to opt out.

4. Health information (special category data)

Because of the nature of our services, some of the information you share with us relates to your health and intimate wellbeing. Under UK and EU law this is "special category data" and receives extra protection.

  • We process your health information only with your explicit consent, which we ask for when you join.

  • Your consent also covers using your health and wellbeing information to create anonymised research data and insights — output that can no longer identify you — which we use, and may share (for example in reports, research or with partners), to help build an evidence base for non-hormonal support through perimenopause. Once genuinely anonymised, this data is no longer personal data and can no longer be linked back to you.

  • You may withdraw your consent at any time by contacting support@withonna.com. If you withdraw consent, we may no longer be able to provide some or all of our services to you, and we will explain the consequences before acting on your request.

  • We limit access to health information to those who need it to deliver your care: our care team and the practitioner(s) you book with.

  • In limited circumstances, we may also process health information where necessary to protect your vital interests (for example, a safeguarding emergency) or in connection with legal claims.

5. Who we share your information with

We share personal information only as described below, and never sell it.

  • Practitioners. When you book a session, we share with that practitioner the information they need to deliver your care — typically your name, contact details, relevant health and wellbeing information, and care notes where you have consented to shared records. Practitioners are independent professionals responsible for their own clinical/session records, and are bound by contractual confidentiality and data protection obligations to us, alongside any professional obligations they hold.

  • Service providers (processors) who help us run Onna, under contracts requiring them to protect your information. These currently include: Squarespace (website hosting), Momence (bookings), Stripe (payments), Google Workspace (email and documents), Zoom (delivering your online sessions), Google Analytics (website analytics).

  • Professional advisers — accountants, lawyers, insurers — where necessary.

  • Authorities and regulators — where required by law, court order, or to protect vital interests.

  • Business transfers — if Onna Health Ltd is involved in a merger, acquisition, restructuring or sale of assets, personal information may be transferred as part of that transaction. We will ensure the recipient honours this policy or notifies you of changes.

6. International transfers

Your information is primarily stored and processed in the UK and European Economic Area. Some of our service providers are located in, or store data in, other countries including the United States. Where information is transferred outside the UK/EEA, we protect it using legally recognised safeguards, including: UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, and/or transfers to organisations certified under the EU–US and UK–US Data Privacy Framework. You can contact us for more information about the safeguards used.

7. How long we keep your information

We keep personal information only as long as necessary for the purposes described in this policy:

  • Account and membership records — for the life of your membership and up to 6 years afterwards (to meet legal, tax and contractual obligations and handle any claims).

  • Health and care information — for the duration of your membership and up to 6 years after your last interaction, unless you request earlier deletion (which we will honour except where law requires retention).

  • Marketing preferences — until you opt out or your consent lapses.

  • Technical/usage data — typically 13–26 months.

When information is no longer needed, we securely delete or anonymise it. Anonymised data (which can no longer identify you) may be retained and used for research, service improvement and outcome analysis.

8. How we protect your information

We use appropriate technical and organisational measures to protect your information, including encryption in transit, access controls, reputable hosting providers, staff/practitioner confidentiality obligations, and the principle of least access. No system is completely secure, but we work to protect your information and will notify you and the relevant regulator of any breach where legally required.

9. Your rights (UK and EEA)

You have the right to:

  • Access the personal information we hold about you.

  • Rectify inaccurate or incomplete information.

  • Erase your information ("right to be forgotten") in certain circumstances.

  • Restrict or object to processing, including any processing based on legitimate interests.

  • Data portability — receive your information in a structured, commonly used format.

  • Withdraw consent at any time, where processing is based on consent (including explicit consent for health data), without affecting the lawfulness of processing before withdrawal.

  • Not be subject to solely automated decisions with legal or similarly significant effects. We do not currently make such decisions.

To exercise any right, email support@withonna.com. We will respond within one month. We may need to verify your identity first. Exercising your rights is free of charge except in limited circumstances permitted by law.

If you are unhappy with how we handle your information, you can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, your local supervisory authority. We would welcome the chance to resolve your concern first.

10. Marketing

We only send marketing where you have opted in (or, for existing members, about similar services under the "soft opt-in", with an opt-out at sign-up and in every message). You can opt out at any time via the link in any email or by contacting support@withonna.com. Opting out of marketing does not affect service communications (bookings, billing, account notices), which we send as part of your membership.

11. Cookies and similar technologies

This section explains how we use cookies and similar technologies on www.withonna.com.

What are cookies? Cookies are small text files placed on your device when you visit a website. They help the site work properly, remember your preferences, and understand how the site is used. Similar technologies (pixels, local storage, tags) work in comparable ways, and we refer to them all as "cookies" in this section.

How we use cookies. We group the cookies on our site into four categories:

  • Strictly necessary cookies (always on). Essential for the website to function — they keep the site secure, enable core features such as page navigation, your cookie preferences, the booking system and checkout, and remember you between pages. Because the site cannot work without them, they do not require consent. These include cookies set by our website platform (Squarespace), our scheduling system (Momence) and our payment provider (Stripe) when you book or pay.

  • Functional cookies. Remember your choices (such as preferences and settings) to improve your experience. Set only with your consent.

  • Analytics cookies. Help us understand how visitors use the site — which pages are visited, how people find us, and where the site can be improved. The information is aggregated and does not directly identify you. Set only with your consent. We currently use: Squarespace Analytics / Google Analytics.

  • Marketing cookies. May be used to measure the effectiveness of our marketing and, if used, to show relevant content on other platforms. Set only with your consent. 

Your choices. When you first visit our site, our cookie banner asks for your consent before any non-essential cookies are set. You can accept all, reject all, or choose categories via the banner; change your mind at any time and delete or block cookies through your browser settings (this may affect how the site works). If you reject non-essential cookies, the site will still work — you may simply see less relevant content and we learn less about how to improve the site.

Cookies we use:

  • Squarespace (site cookies) — Strictly necessary. Site functionality, security, load balancing, your cookie preferences. Duration: session – 2 years.

  • Momence — Strictly necessary. Enables appointment booking and remembers your booking session. Duration: session – 1 year.

  • Stripe — Strictly necessary. Fraud prevention and secure payment processing. Duration: session – 1 year.

  • Google Analytics — Analytics. Understanding site usage and improving the site. Duration: up to 26 months.

  • Momence — Marketing. Measuring email and campaign effectiveness. Duration: session – 1 year

12. Additional information for US residents

If you access our services from the United States, the following applies in addition to the rest of this policy, to the extent required by applicable US state privacy laws (such as the California Consumer Privacy Act as amended):

  • Categories of information collected: identifiers (name, email, IP address), customer records (account and billing information), health and wellbeing information you provide, internet activity (usage data), and communications — as described in Section 1.

  • We do not sell your personal information, and we do not share it for cross-context behavioural advertising. If this ever changes, we will update this policy and provide the required opt-out mechanisms first.

  • Your rights may include the right to know, access, correct, delete, and receive a copy of your personal information, and the right not to be discriminated against for exercising your rights. To exercise them, contact support@withonna.com. We will verify your request and respond within the timeframes required by applicable law. You may use an authorised agent where the law allows.

  • Sensitive personal information (including health information) is used only to provide our services and for the purposes permitted by applicable law, and can be limited on request where the law provides that right.

13. Third-party links and services

Our website and communications may contain links to third-party websites or services (including practitioners' own websites). This policy does not cover those third parties, and we encourage you to read their privacy policies.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our services or the law. We will post the updated version on this page with a revised "last updated" date, and where changes are significant, we will notify members directly (for example by email) before they take effect.

15. Contact us

Onna Health Ltd (trading as Onna) Email: support@withonna.com Privacy contact: Anna Kracewicz