Privacy Policy

Who we are

SUPR.BIO LTD ("SUPR", "we", "us") is the data controller for the personal data described in this policy. We are a company registered in England and Wales, company number 17526607. Contact: hello@supr.bio

This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have over it. It is written to comply with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

What data we collect

Depending on how you use SUPR, we may collect:

Contact and account data: name, email, phone number (if provided), billing address, and the name of any coach you choose to work with.

Waitlist and founding-place data: your email and anything else you choose to share when joining the waitlist or reserving a founding place.

Intake and Dashboard entries: what you declare at intake and keep updated in the Dashboard. This includes your protocol (what you take, the dose, and since when), body measures (weight, body fat, waist and similar), training and lifts, diet, sleep, alcohol, stress, supplements, medications and other context.

Health and biomarker data: blood test results processed by our laboratory partner (Randox Health) and shared with us to build your Dashboard. Up to 97 individual markers per test.

Order data: purchases, subscription status, transactions, refunds and related payment metadata (processed by Stripe, see Sub-processors below).

Technical and usage data: device and browser information, IP address (used for approximate location), pages visited, referring site and interactions with the Website and Dashboard. Collected by our hosting providers to serve and secure them, and by our analytics and advertising measurement providers (for example Google Analytics and Meta's measurement tools) where you have accepted non-essential cookies.

Communications: messages you send us by email or through forms, and our responses.

Your protocol declarations

We treat everything you declare about what you take as health data under UK GDPR Article 9, with the same protection as your blood results. We record it for one purpose: so your results can be read against it. We do not share it with anyone except as set out in this policy, and we never sell it.

Possession of anabolic steroids for personal use is not an offence in the UK. SUPR records what you declare for monitoring only. We do not record, ask about or infer supply, and we will not use your declarations for any purpose other than your own Dashboard.

How we use your data

We use your data to:

• Respond to enquiries and provide support
• Manage the waitlist and founding list, and send product updates
• Process and fulfil orders and subscriptions, including arranging blood testing with Randox
• Build and update your Dashboard. Your results are placed against reference and guardrail ranges, compared with your earlier tests, and lined up against the protocol, body and training entries you have declared
• Share your Dashboard with a coach you have named, and only while that consent stands
• Send you your results notification, a note when your next test is ready to book, and communications about your plan, by email and, where you have given us a number for it, by SMS or a messaging app
• Send you marketing communications where you have consented, which you can stop at any time
• Improve the Website, the Dashboard and the thresholds we use, using de-identified data
• Measure how the Website performs and how our marketing performs, where you have accepted non-essential cookies
• Maintain the security and performance of our systems
• Meet legal, accounting and regulatory obligations

AI-assisted processing of your data

Parts of your Dashboard are generated using AI-assisted analysis, then reviewed by a member of the SUPR team before delivery. Specifically:

• Your intake data, your declared protocol and your blood test results are sent to our AI processing partner (currently Anthropic, the provider of the Claude language model) to generate Dashboard content
• A SUPR team member reviews the output before it is delivered
• The AI is used to identify patterns, surface priorities and produce narrative text; the human review pass exists to catch errors, ensure safety language is correct, and ensure the content is appropriate for delivery
• AI outputs are not deterministic and not infallible. Human review is a meaningful safeguard but not a substitute for the medical disclaimers in our Terms and Conditions

Your rights regarding automated processing: under UK GDPR Article 22, you have the right to obtain meaningful human review of any conclusion in your Dashboard, to express your view, and to contest any output. To exercise this right, contact hello@supr.bio and a member of the SUPR team will re-review the relevant content with you.

Legal bases for processing (UK GDPR)

We process personal data under one or more of the following lawful bases:

• Contract: processing necessary to deliver the service you purchased (arranging your tests, building and maintaining your Dashboard).
• Explicit consent (Article 9): for the processing of your health data, which includes your blood results and your protocol, body and training declarations. Consent is captured by tick-box at intake. You can withdraw it at any time (see "Your rights").
• Explicit consent: for sharing your Dashboard with a coach you have named.
• Consent: for waitlist signup, marketing communications, and non-essential cookies.
• Legitimate interests: to operate and improve the Website and Dashboard, respond to enquiries, prevent misuse and secure our systems, balanced against your rights.
• Legal obligation: where we are required to retain or process data by law (for example accounting and tax records).

Who we share your data with

Your coach. If you name a coach, that coach can see your results, your declared protocol, your body and training entries, and comments they leave for you. They cannot see your payment details. Your coach processes what they see under their own responsibility; the terms they agree with us prohibit onward sharing and marketing use. You can withdraw their access at any time from the Dashboard or by emailing us.

Sub-processors. We use the following third parties to operate SUPR. Each only processes the data necessary for its role:

We have data processing agreements in place with each sub-processor, requiring them to process data only on our instructions and to maintain appropriate security measures. As SUPR grows we may add or change sub-processors, for example messaging, support or app providers; this list is kept current and material changes are notified by email.

Randox is named explicitly because it is the laboratory performing the test. Randox processes some data under its own privacy notice as a separate data controller for the laboratory testing activity. Randox's privacy notice is available at https://www.randoxhealth.com/.

We do not sell personal data and we do not share it with advertisers.

International data transfers

Some of our sub-processors process data outside the UK, specifically Anthropic (USA) for AI-assisted Dashboard content and, when enabled, Google and Meta (USA) for analytics and advertising measurement. Where data is transferred outside the UK, we rely on the UK International Data Transfer Agreement ("UK IDTA") or the UK Addendum to the EU Standard Contractual Clauses, together with the provider's own safeguards, to ensure adequate protection.

How long we keep your data

We keep personal data only as long as we need to:

• Contact and support messages: typically 12 to 24 months from your last interaction
• Waitlist and founding-list data: until you unsubscribe or we no longer need it
• Intake and Dashboard entries: for the duration of your active membership plus 24 months, so a returning member keeps their history
• Blood results and your Dashboard: 7 years from the last test, to support long-term comparison and to meet record-keeping standards relevant to health-related data. You may request earlier deletion at any time (see "Your rights")
• Order and transaction data: 7 years, for accounting and tax purposes (UK statutory requirement)
• Coach access records: for as long as the access stands, plus 24 months

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data (subject to legal retention obligations)
• Restrict or object to processing
• Data portability: receive a copy of your data in a structured, machine-readable format
• Withdraw consent where consent is our lawful basis (this will not affect the lawfulness of processing before withdrawal)
• Withdraw coach access at any time, by email, with immediate effect
• Obtain human review of any AI-assisted output in your Dashboard, express your view, and contest the output (Article 22)
• Lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data lawfully (see below)

To exercise any right, contact hello@supr.bio. We will respond within one month.

Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, email-verified access to the Dashboard, access controls and contractual safeguards with our sub-processors. No system is fully impervious to risk; if we become aware of a personal data breach affecting your rights, we will notify you and the ICO where required by UK law.

Complaints

If you are unhappy with how we handle your data, please contact us first at hello@supr.bio so we can try to resolve it.

If you remain unhappy, you have the right to complain to the UK Information Commissioner's Office (ICO):

• Website: https://ico.org.uk
• Helpline: 0303 123 1113

Cookies

We use cookies and similar technologies to operate the Website and Dashboard, such as remembering your Dashboard access, and, with your consent, to measure performance and marketing effectiveness. A cookie banner on the Website lets you accept or reject non-essential cookies, and no analytics or marketing cookie is set until you accept. You can also set your browser to refuse cookies or to alert you when cookies are being sent; doing so may affect some site functionality.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent change. Material changes affecting members will be notified by email.

Contact

If you have questions about this policy, or about how we process your data, contact us at: hello@supr.bio