Privacy Policy

Privacy Policy – Addendum

Bloume Health Ltd
Effective date: 28 October 2026

1. Scope and Application

This Addendum supplements the existing Bloume Health Privacy Policy and explains how personal information is collected, used, stored and shared in connection with Bloume Health's website and additional services.

The Bloume Health website, built using Lovable, provides access to educational webinars, psychotherapy, care navigation, support groups and an online service-matching questionnaire.

The Bloume Health mobile application operates separately. Existing app-specific privacy provisions remain applicable, including those concerning Firebase, RevenueCat, Apple App Store, Google Play and other mobile application technologies (see below).

2. Service-Matching Questionnaire – Typeform

The Bloume Health website uses Typeform to administer a service-matching questionnaire designed to help individuals identify services that may be relevant to their needs.

The questionnaire collects personal information including:

• - Name and email address.
• - Age.
• - Health-related concerns and symptoms.
• - Duration of symptoms or concerns.
• - Whether the individual has previously consulted a healthcare professional.
• - Types of support sought.
• - Preferences relating to available services.

Responses may reveal information about an individual's health and are treated as special category personal data under UK GDPR.

Users provide explicit consent to the processing of health-related questionnaire information for the purposes of generating service recommendations and administering related enquiries. Consent to processing health information is separate from any optional consent to receive marketing communications.

Users may withdraw their consent by contacting Bloume Health. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The questionnaire is intended for informational and service-navigation purposes only. It does not constitute a medical assessment and does not provide medical advice, diagnosis, prescriptions or treatment.

3. Klaviyo and Communications

Bloume Health uses Klaviyo to manage communications with individuals who complete the service-matching questionnaire and, where appropriate permission has been obtained, to send marketing communications.

Only names and email addresses are transferred from Typeform to Klaviyo. Health-related questionnaire responses are not transferred to Klaviyo. Bloume Health may contact users about their questionnaire submission, results and potentially relevant services.

Communications relating to a user's enquiry or requested recommendation are distinguished from optional marketing communications. Users may unsubscribe from marketing communications at any time.

4. Appointment Booking and Payments

Bloume Health uses Calendly to manage bookings for psychotherapy, care navigation and gynaecological webinars.

Booking information may include names, contact details, appointment dates and times, and information voluntarily provided during booking.

Stripe processes payments for individual appointments and recurring support-group memberships.

Bloume Health may receive payment confirmations, billing information, transaction records, refund details and subscription status information necessary to administer these services.

5. Services

Bloume Health provides the following services:

• - Gynaecological Educational Webinars: Delivered through Zoom or google meet. These appointments provide educational information relating to gynaecological health and associated concerns.
• - Psychotherapy Appointments: Delivered through Google Meet by appropriately qualified practitioners working through Bloume Health.
• - Care Navigation Appointments: Delivered through Google Meet and intended to help individuals understand available healthcare and support options.

Information shared during appointments may include personal circumstances, health concerns and psychological wellbeing information.

Bloume Health maintains confidential clinical notes relating to appointments. These records are securely stored, with access restricted to authorised individuals who require the information for legitimate professional purposes. Bloume Health does not record individual appointments. Professional confidentiality applies, subject to applicable legal, safeguarding and professional exceptions.

6. Support Groups

Bloume Health provides facilitated online support groups through Google Meet.

Google Forms is used to collect participation consent and relevant administrative information. This information may include health-related personal data.

Stripe processes recurring monthly support-group membership payments.

Support-group sessions are not recorded by Bloume Health.

Participants are expected to respect the confidentiality of other members. However, Bloume Health cannot guarantee that other participants will maintain confidentiality.

7. Lawful Basis and Special Category Information

Bloume Health processes personal information under an applicable lawful basis under Article 6 UK GDPR and, where health-related or other special category information is involved, an applicable condition under Article 9 UK GDPR.

For health-related information collected through the Typeform service-matching questionnaire, Bloume Health relies on explicit consent as its Article 9 condition.

Psychotherapy records and other health-related information are processed under the lawful bases and special category conditions applicable to the relevant services, taking account of professional confidentiality and legal requirements.

Booking administration, payment processing and service communications are undertaken in accordance with applicable data protection requirements.

8. Data Retention

Typeform questionnaire responses: Identifiable personal information, including health-related responses, is retained for two years from the date of submission. After this period, the information is securely deleted or anonymised unless further retention is legally justified.

Clinical notes (appointments): Clinical records are securely retained for 10 years, subject to applicable legal or professional requirements that may necessitate a different period. At the end of the applicable retention period, records are securely deleted or anonymised unless further retention is legally justified.

Other personal information, including appointment bookings, payments, support-group administration and mobile application data, is retained for periods appropriate to the relevant purposes and applicable legal requirements, as further described in the main Privacy Policy.

Individuals may request earlier deletion of their information, subject to applicable legal obligations and exemptions.

9. Website Infrastructure and Third-Party Services

The Bloume Health website is built using Lovable.

Bloume Health website uses providers including:

• - Lovable: Website development and associated platform services.
• - GoDaddy: Domain management and related infrastructure, where applicable.
• - Typeform: Service-matching questionnaires.
• - Calendly: Appointment scheduling.
• - Stripe: Payment processing and subscriptions.
• - Google Forms: Support-group consent and administrative forms.
• - Google Meet: Psychotherapy, care navigation and support groups.
• - Zoom/Google meet: Gynaecological webinars.
• - Klaviyo: Email communications.
• - Google Analytics 4 and Hotjar: Website analytics and interaction insights, where enabled.

These providers may process personal information according to their respective functions and configurations.

Where required, Bloume Health implements appropriate contractual, technical and organisational safeguards, including measures relating to international data transfers.

The mobile application continues to use its own app-specific providers as described in the main Privacy Policy.  The mobile app uses:  - Firebase Analytics / Firebase Crashlytics Firebase Cloud Message for push notifications  - Firebase Authentication and Cloud Storage for user accounts and secure storage  - RevenueCat for subscription management  - App Store / Play Store for app distribution and purchases  - Sendgrid for transactional emails  - Sensitive health and wellbeing data is collected only within the mobile app, and only after explicit consent.   If you're unsure how this applies to your data, please reach out at info@bloumehealth.com.

10. Security and Data Protection Rights

Bloume Health uses appropriate technical and organisational measures to protect personal information, including health-related data.

Access to sensitive information is restricted to authorised individuals with a legitimate need to access it.

Individuals may exercise applicable rights under UK GDPR, including access, rectification, erasure, restriction, objection and data portability.

Where processing relies on consent, consent may be withdrawn at any time without affecting earlier lawful processing.

For privacy enquiries or requests, contact:

info@bloumehealth.com