Privacy Notice

Glenhurst Holdings Limited (trading as Arlen Health)

Last updated: [Insert Date]

1. Introduction

Glenhurst Holdings Limited, trading as Arlen Health (“Arlen Health”, “we”, “our” or “us”), is committed to protecting your privacy and handling your personal information responsibly.

This Privacy Notice explains how we collect, use, store and share your personal information when you enquire about, book or participate in an Arlen Health Executive Health Assessment or otherwise interact with us.

The Arlen Health Executive Health Assessment is delivered under the Arlen Health brand.

Arlen Health coordinates the assessment and provides the non-clinical elements of the service. Certain clinical services forming part of your assessment are provided by independent clinical providers in association with Arlen Health.

This Privacy Notice relates to the information processed by Arlen Health.

The independent clinical providers involved in your assessment are responsible for the personal information they process in connection with the clinical services they provide and will provide their own privacy information where appropriate.

2. Who We Are

Data Controller

Glenhurst Holdings Limited

Trading as Arlen Health

Email: hello@arlenhealth.com

3. Information We Collect

Depending on the services you receive, Arlen Health may collect:

Personal Information

• Name

• Date of birth

• Sex

• Email address

• Telephone number

• Postal address

• Employer details (where participating through an employer-sponsored programme)

• Emergency contact details

Assessment Information

• Pre-assessment questionnaires

• PAR-Q responses

• Lifestyle information

• Exercise history

• Nutrition information

• Sleep and recovery information

• Physical performance assessment results

• Dashboard information

• Coaching and programme notes (where applicable)

• A limited lifestyle or goals summary provided by your GP provider where you have consented to this being shared

Arlen Health does not routinely maintain your GP consultation records, laboratory records or detailed clinical notes.

Technical Information

When you use our website or participant dashboard, we may collect:

• IP address

• Device and browser information

• Login activity

• Dashboard access records

• Security and audit log information

4. How We Collect Information

We collect information:

• directly from you;

• through onboarding forms and questionnaires;

• during physical performance assessments;

• through communications with you;

• through our website and participant dashboard; and

• where appropriate, from the independent clinical providers involved in your assessment where this is necessary to coordinate your assessment or where you have authorised information to be shared.

5. How We Use Your Information

Arlen Health uses your information to:

• coordinate your Executive Health Assessment;

• arrange appointments with clinical partners where appropriate;

• deliver physical performance assessments;

• prepare and maintain your Arlen Health dashboard;

• provide lifestyle and performance support;

• communicate with you regarding your assessment;

• administer your programme;

• maintain business and assessment records;

• improve our services;

• comply with legal and regulatory obligations; and

• maintain the security of our systems.

Where information provided by an independent clinical provider is displayed within your dashboard, Arlen Health presents that information as supplied by the clinical provider and does not edit or exercise clinical judgement over the clinical advice provided.

6. Special Category Information

Some of the information processed by Arlen Health constitutes special category personal data under UK GDPR because it relates to your health.

Arlen Health only processes this information where permitted by applicable data protection legislation, including where processing is necessary for the provision and coordination of health-related services or where you have provided consent where required.

7. Lawful Bases for Processing

Our lawful bases under Article 6 UK GDPR may include:

• performance of a contract;

• legitimate interests;

• compliance with legal obligations; and

• consent where required.

Where we process health information, the applicable conditions under Article 9 UK GDPR may include:

• the provision or management of health-related services;

• preventive health purposes where applicable; and

• explicit consent where required.

8. Independent Clinical Providers

Certain clinical services forming part of your assessment are provided by independent clinical providers in association with Arlen Health.

These providers are responsible for the clinical services they provide, including their own clinical records, clinical governance, clinical advice and clinical follow-up.

Depending on your assessment, this may include:

• Inuvi Diagnostics Limited (or another appropriate clinical or diagnostic provider) for blood collection and laboratory services; and

• Endura Health Ltd (ThanksDoc) or another independent GP provider, including Dr Lafina Diamandis practising from The Phoenix Consulting Rooms, for GP consultation services.

These providers act as independent data controllers in relation to the personal information they process for the clinical services they provide.

9. Who We Share Information With

Where necessary to arrange and deliver your assessment, Arlen Health may securely share relevant information with:

• independent GP providers;

• blood collection providers;

• diagnostic laboratories;

• physiotherapists;

• nutrition professionals;

• technology providers supporting the Arlen Health platform; and

• carefully selected service providers supporting our business operations.

Information is shared only where necessary for the delivery of your assessment, compliance with legal obligations or the operation of our services.

Where you participate through an employer-sponsored programme, your employer will not receive your individual health information, blood test results, GP report, dashboard or personal recommendations unless you provide separate explicit consent or disclosure is otherwise required by law.

Employers may receive anonymised or aggregated programme information that does not identify individual participants.

10. International Transfers

Some of our technology providers may process information outside the United Kingdom.

Where international transfers occur, we ensure appropriate safeguards are in place in accordance with UK GDPR, including where appropriate:

• International Data Transfer Agreements (IDTAs);

• the UK Addendum to the EU Standard Contractual Clauses; or

• transfers to countries benefiting from UK adequacy regulations.

11. Data Security

We use appropriate technical and organisational measures to protect personal information.

These include:

• role-based access controls;

• secure authentication;

• encrypted communications;

• secure cloud infrastructure;

• audit logging;

• restricted staff access; and

• regular security monitoring.

Although no system can guarantee absolute security, we take reasonable steps to protect information against unauthorised access, alteration, loss or disclosure.

12. Data Retention

Arlen Health retains information only for as long as reasonably necessary to:

• provide our services;

• comply with legal obligations;

• manage complaints or disputes; and

• meet legitimate business requirements.

Clinical records maintained by independent clinical providers are retained in accordance with their own legal and professional obligations.

13. Your Rights

Subject to applicable law, you may have the right to:

• access your personal information;

• request correction of inaccurate information;

• request erasure of information;

• restrict processing;

• object to processing;

• request data portability; and

• withdraw consent where processing relies on consent.

Requests should be sent to:

hello@arlenhealth.com

14. Complaints

If you have any concerns about how Arlen Health has handled your personal information, please contact us first so that we can try to resolve the issue.

You also have the right to complain to the Information Commissioner’s Office (ICO).

Information Commissioner’s Office

Website: https://ico.org.uk

Telephone: 0303 123 1113

15. Changes to this Privacy Notice

We may update this Privacy Notice from time to time.

The most recent version will always be available through the Arlen Health website and participant communications.

Glenhurst Holdings Limited

Trading as Arlen Health