Privacy Policy

Renally is owned and operated by Supportal Health Limited, who is the data controller.

Supportal Health Limited (hereby “we”, “Supportal Health”, “us” or “our”) is a private limited company registered in England with company number 14509034 and registered offices at Suite G04 1 Quality Court, Chancery Lane, London, England, WC2A 1HR. We are the Data Controller in respect of your personal information.

You can get hold of us by emailing renally@supportal.health.

We take the privacy, including the security, of personal information we hold about you seriously. This privacy notice is designed to inform you about how we collect personal information about you and how we use that personal information. You should read this privacy notice carefully so that you know and can understand why and how we use the personal information we collect and hold about you.

This version was last updated on August 2026

1. Key Definitions

The key terms that we use throughout this privacy notice are defined below, for ease:

Data Controller: under UK data protection law, this is the organisation or person responsible for deciding how personal information is collected and stored and how it is used.

Data Processor: a Data Controller may appoint another organisation or person to carry out certain tasks in relation to the personal information on behalf of, and on the written instructions of, the Data Controller. (This might be the hosting of a site containing personal data, for example, or providing an email marketing service that facilitates mass distribution of marketing material to a Data Controller’s customer-base.)

Personal Information: in this privacy notice we refer to your personal data as ‘personal information’. ‘Personal information’ means any information from which a living individual can be identified. It does not apply to information which has been anonymised.

Sensitive Information: certain very sensitive personal information requires extra protection under data protection law. Sensitive data includes information relating to health, racial and ethnic origin, political opinions, religious and similar beliefs, trade union membership, sex life and sexual orientation and also includes genetic information and biometric information.

2. Our role in processing personal information

Supportal Health acts as a Data Controller in relation to the personal information processed through the Supportal Health platform.

Our platform is designed and operates as a standardised service, and we determine the core purposes and means of processing personal information, including how the platform functions, what data is collected, and how it is stored and secured.

Organisations (such as healthcare providers, charities, or patient support organisations) that use the Supportal Health platform to provide services to their users may also act as independent Data Controllers in relation to personal information processed within their programmes.

In particular, these organisations may determine:

a) which users are invited to participate in the platform;
b) how they engage with users through the platform; and
c) the content and purpose of any surveys, questionnaires, or feedback requests they create.

Where organisations create surveys or collect information through the platform, they are responsible for determining the purpose of that data collection and how the results are used within their services.

Supportal Health and the organisation may therefore act as independent Data Controllers in relation to the same personal information, each with their own responsibilities under applicable data protection laws.

Supportal Health may also process personal information to:

d) operate, maintain, and improve the platform;
e) analyse anonymised and aggregated data;
f) ensure platform security and safeguard users; and
g) manage our direct relationship with users and customers.

3. Details of personal information which we collect about you and the legal basis for processing your personal information

3.1 Details of personal information which we collect about you and the legal basis for processing your personal information

General Category	Types of Personal Data in that category	Purpose	Legal Basis
Identity Information	This is information relating to your identity such as your name, date of birth, location/address, profile picture, gender	To create and manage your account, verify your identity, and provide access to services.	Article 6(1)(b): Performance of a contract or steps prior to entering a contract with you.
Contact Information	This is information relating to your contact details such as email address.	To communicate service messages with you regarding your account, provide updates, and respond to your enquiries.	Article 6(1)(b): Performance of a contract or steps prior to entering a contract with you.
Account Information	This is information relating to your account with us (including username and password)	To provide access to and manage your account, ensure security, and facilitate login processes.	Article 6(1)(b): Performance of a contract or steps prior to entering a contract with you. Article 6(1)(f): Legitimate interests (e.g., to facilitate the login and onboarding process
Platform, Device and Technical Information	This is information about your use of our platform and technical data which we collect (including your IP address, the type of browser you are using and the version, the operating system you are using, details about the time zone and location settings on the device and other information we receive about your device) commonly collected via cookies and other similar technologies	To monitor, optimise, and improve the performance and security of our platform, troubleshoot technical issues, and gather usage insights.	Article 6(1)(f): Legitimate interests (e.g., to improve services, ensure security, and monitor performance). In the UK, there are other types of cookies which do not need consent such as: cookies that are strictly necessary to provide a function required or requested during use of the website/platform. This includes: protecting user-related service information (e.g. security tools used to protect personal contact details inputted at onboarding stage); ensuring security (e.g. multi-factor authentication); preventing or detecting fraud or technical faults with the website/platform; and enabling automatic user identity authentication (e.g. saving a recent search) or maintaining records of user choices on the website/platform (e.g. location settings). cookies used to collect statistical data to improve our Website/platform; and cookies used to adapt website display or functionality to user preferences or enhance Website performance (e.g. language preferences or accessibility preferences). You can find more information about the individual cookies we use and the purposes for which in our cookies policy Article 6(1)(a): We may rely on your consent to deploy non-strictly necessary cookies such as functional cookies or analytical cookies to help understand the traffic on our website and/or platform . You have the right to withdraw your consent for this specific processing at any time without affecting the lawfulness of any processing undertaken prior to you withdrawing such consent.
Survey and Feedback Information	This is information you provide when responding to surveys, questionnaires, or feedback forms within the Supportal platform. This may include health-related data, wellbeing data, demographic information, and free-text responses.	To gather insights, improve services, and support the organisation running the Supportal platform.	Article 6(1)(a): Consent. Article 9(2)(a): Explicit consent (for processing sensitive data such as health or wellbeing information).
Marketing information	Information collected when we promote our services or the Supportal platform via direct marketing communications such as email.	To promote our services and provide marketing communications based on your preferences	Article 6(1)(f): Legitimate interests (e.g., to promote services to current users and other users who have engaged with us previously where we have provided you with an opportunity to opt out at the time of collecting your details and in every marketing email thereafter.) Article 6(1)(a): Consent (where required by law, e.g., for email marketing to users who are not current users and have never engaged with us).
Correspondence	Data that has been anonymised and cannot identify you. Used for analysis, improving services, and developing insights.	To analyse trends, evaluate platform effectiveness, improve services, and develop insights into user needs and engagement.	Not applicable provided this data is anonymised and no longer constitutes personal data under data protection laws
Safeguarding Information	Personal and sensitive information processed where necessary to protect the vital interests of a user or another person, including health, safety, or wellbeing concerns.	To protect the health, safety, or wellbeing of users or others, and to address safeguarding concerns.	Article 6(1)(d): Vital interests. Article 6(1)(c): Compliance with a legal obligation. Article 6(1)(f): Legitimate interests. Article 9(2)(c): Vital interests. Article 9(2)(g): Substantial public interest. Schedule 1, DPA 2018: Preventing or detecting unlawful acts; protecting individuals at risk.

4. Details of sensitive information which we collect and hold about you

4.1 Sensitive information is explained in section 1 above. We may collect and hold the following types of sensitive information about you, including information you choose to provide through surveys or feedback forms within the platform:

a) religion
b) health
c) ethnicity

4.2 Where we do hold the above sensitive information our retention periods are as follows:

Type of Sensitive Information	Purpose	Legal Basis
Religious Beliefs	We store religious belief data of mentors so that patients can match with mentors of the same religion if that is important to them. We will retain this information with your explicit consent and will remove this data should such consent be withdrawn.	Article 6(1)(a): Consent. Article 9(2)(a): Explicit consent. Article 9(2)(g): Substantial public interest may apply for diversity monitoring purposes where it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained, under Schedule 1, Part 2, Paragraph 8 of the Data Protection Act 2018: Equality of opportunity or treatment
Health Information	Health information derived from chosen support areas such as the condition, disease or procedure a patient or mentor has had, or has experience with, is made available to the Supportal Platform. We will retain this information with your explicit consent and will remove this data should such consent be withdrawn.
Ethnicity Information	We store ethnicity data of mentors so that patients can find support from mentors of specific ethnicities if that is important to them. We will retain this information with your explicit consent and will remove this data should such consent be withdrawn.	Once a mentor has provided such consent and the information is made available to registered mentees on their profile, we rely on Article 9(2)(e): processing relates to personal data which are manifestly made public by the data subject.

Type of Sensitive Information

Purpose

Legal Basis

Religious Beliefs

We store religious belief data of mentors so that patients can match with mentors of the same religion if that is important to them. We will retain this information with your explicit consent and will remove this data should such consent be withdrawn.

Article 6(1)(a): Consent.

Article 9(2)(a): Explicit consent.

Article 9(2)(g):
Substantial public interest may apply for diversity monitoring purposes where it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people specified in relation to that category with a view to enabling such equality to be promoted or maintained, under Schedule 1, Part 2, Paragraph 8 of the Data Protection Act 2018: Equality of opportunity or treatment

Health Information

Health information derived from chosen support areas such as the condition, disease or procedure a patient or mentor has had, or has experience with, is made available to the Supportal Platform. We will retain this information with your explicit consent and will remove this data should such consent be withdrawn.

Ethnicity Information

We store ethnicity data of mentors so that patients can find support from mentors of specific ethnicities if that is important to them. We will retain this information with your explicit consent and will remove this data should such consent be withdrawn.

Once a mentor has provided such consent and the information is made available to registered mentees on their profile, we rely on Article 9(2)(e): processing relates to personal data which are manifestly made public by the data subject.

5. How long we retain your personal information

5.1

We are only able to use your personal information for certain legal reasons set out in data protection law. There are legal reasons under data protection law other than those listed above.

5.2

So that we are able to provide you with our services, we will need your personal information. If you do not provide us with the required personal information, we may be prevented from supplying our services to you. We may also be prevented from complying with our legal obligations.

5.3

We will only keep your personal information for as long as we need to in line with our retention criteria taking into consideration: legal obligations, best industry practice, limitation periods, our business needs and for the establishment, exercise or defence of legal claims. It is important that you keep your personal information up to date. If any of your personal information changes, please update your information on your account or contact us as soon as possible to let us know.

5.4

Where we rely on consent for a specific purpose as the legal reason for processing your personal information, you have the right under data protection law to withdraw your consent at any time. If you do wish to withdraw your consent, please contact us using the details set out at the beginning of this notice. If we receive a request from you withdrawing your consent to a specific purpose, we will stop processing your personal information for that purpose, unless we have another legal reason for processing your personal information, in which case, we will confirm that reason to you.

5.5

Sometimes we may anonymise personal information so that you can no longer be identified from it. We may also combine your information with that of other users to create aggregated datasets.
We may use such anonymised and aggregated information to:

a) analyse trends across user groups;
b) evaluate the effectiveness of the Supportal platform;
c) improve our services and features; and
d) develop insights into patient support and community engagement.

This information does not identify you and cannot reasonably be used to identify you.

5.6

Under data protection laws we can only use your personal information for the purposes we have told you about, unless we consider that the new purpose is compatible with the purpose(s) which we told you about. If we want to use your personal information for a different purpose which we do not think is compatible with the purpose(s) which we told you about then we will contact you to explain this and what legal reason is in place to allow us to do this.

5.7 Survey and Feedback Data

Supportal Health may provide functionality that allows organisations (such as healthcare providers, charities, or patient support organisations) to create surveys, questionnaires, or feedback forms within the platform.
Where you choose to participate in such surveys:

(a) your responses may include personal information, including sensitive information such as health or wellbeing data;
(b) your responses will be shared with authorised administrators of the organisation operating the Supportal service you are part of;
(c) that organisation is responsible for how it uses your survey responses in accordance with its own privacy policies.

Supportal Health processes survey data only where necessary to:

a) operate and maintain the platform;
b) provide the service to the organisation;
c) ensure platform quality and performance;
d) provide technical support; or
e) address safeguarding concerns or risks to user safety.

Supportal Health does not use identifiable survey responses to contact users for external marketing purposes.

5.8 Safeguarding

We may process personal and sensitive information where necessary to protect the vital interests of a user or another person, including where there are concerns relating to health, safety, or wellbeing. This may also be in compliance with our legal obligations and our legitimate interests to run a safe service.

6. Details of how and when we collect personal information and sensitive information

6.1 We collect and process personal information when you:

a) visit our platform (including when registering on our site, completing forms, signing up for communications or creating an account);
b) contact or request information from us in any way;
c) participate in surveys, questionnaires, or feedback forms within the platform, which may include profile data about your interests, preferences, feedback and survey responses;
d) interact with us, including where we may collect and/or generate certain data about you as part of our interactions with you; and
e) communicate with us via social networking websites, third-party applications or similar technologies; and
f) technical information collected from your device when you are browsing on our Website, platform or our digital marketing communications. This includes: your IP address, your location (by country, state and city), device type, browser type, operating system, interaction with, and responses to, our marketing communication and activity on our Website or platform. Please see our Cookie Policy for more information.

6.2

We may also collect information about you from third-party sources, such as from the organisations operating the Supportal service or from related third parties such as sub-processors. We may also collect personal data from publicly available sources such as social media.

6.3

We may collect personal and sensitive information through surveys, questionnaires, or feedback forms that you choose to complete within the platform. These may be created by the organisation providing your Supportal service.

7. Details about who personal information may be shared with

7.1 We may need to share your personal information with other organisations or people. These organisations include:

a) Other companies in our group which require access to personal information, e.g. for IT services or management reporting.
b) Third parties who may include:

(i) Suppliers: such as IT support services, analytics providers, payment providers, administration providers and marketing agencies;
(ii) Government bodies and regulatory bodies: such as HMRC, fraud prevention agencies.
(iii) Our advisors: such as lawyers, accountants, auditors, insurance companies.
(iv) Our bankers.
(v) Credit Reference Agencies.
(vi) Email platforms.

c) any organisations which propose to purchase our business and assets, in which case we may disclose your personal information to the potential purchaser; or if we or substantially all of our assets are acquired by a third party, in which case personal information held by us will be one of the transferred assets.
d) Where necessary, user data may be shared with client organisation(s) offering the Supportal support service in order for the support services to be provided appropriately and safely.
e) Government authorities, courts, law enforcement, fraud prevention agencies, the police or other regulatory bodies as required by law in connection with the investigation of crimes. This is on the basis of our legitimate interests for the establishment, exercise or defence of legal claims to protect our business or in compliance with applicable legal obligations where we believe it is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of a third party.

7.2

Depending on the circumstances, the organisations or people who we share your personal information with will be acting as either Data Processors or Data Controllers. When we share your personal information with a Data Processor we will ensure that we have contracts in place, which set out the responsibilities and obligations of both parties, including in respect of security of personal information.

7.3

We do not sell or trade any of the personal information which you have provided to us.

7.4

Please note that our website does not itself collect and/or store your financial information (such as bank account details and/or payment card details). Where applicable, this information is collected and handled by a third-party payment processor on our behalf.

7.5 Organisations operating the Supportal service

Information you provide within the Supportal platform, including survey responses, may be accessible to authorised administrators of the organisation providing your Supportal service.
These organisations may act as Data Controllers in respect of your information and are responsible for how they use that information within their programmes and services.

8. Details about transfers to countries outside of the UK and the EEA

If any transfer of personal information by us will mean that your personal information is transferred outside of the UK or the EEA, we will ensure that adequate safeguards are in place to ensure that a similar degree of protection is given to protect your personal information and to make sure it is treated securely and in accordance with this privacy notice. In these cases, we rely on approved data transfer mechanisms (such as standard contractual clauses, adequacy decisions, approved frameworks such as the US Data Privacy Framework, and legal exceptions known as 'derogations' under data protection laws) to ensure your information is subject to adequate safeguards in the recipient country. If you are located in the UK or the EEA, you may contact us for a copy of the safeguards which we have put in place to protect your personal information and privacy rights in these circumstances.

9. Security and Passwords

9.1

You must keep your password and any other authentication information for our website and platform confidential. If you know or suspect that anyone other than you knows your password or any other authentication information, you must promptly notify us using the contact details set out at the beginning of this privacy notice.

9.2

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your information transmitted during your use of our website or platform.

10. Your Rights Under Data Protection Law

10.1

Under data protection laws you have certain rights in relation to your personal information, as follows:

a) Right to request access: (this is often called 'subject access'). This is the right to obtain from us a copy of the personal information which we hold about you.
b) Right to correction: this is the right to request that any incorrect personal data is corrected and that any incomplete personal data is completed.
c) Right to erasure: (this is often called the “right to be forgotten”). This right only applies in certain circumstances. Where it does apply, you have the right to request us to erase all of your personal information
d) Right to restrict processing: this right only applies in certain circumstances. Where it does apply, you have the right to request us to restrict the processing of your personal information.
e) Right to data portability: this right allows you to request us to transfer your personal information to someone else.
f) Right to object: you have the right to object to us processing your personal information for direct marketing purposes. You also have the right to object to us processing personal information where our legal reason for doing so is Our Legitimate Business Interests (see section 5 above) and there is something about your particular situation which means that you want to object to us processing your personal information. In certain circumstances you have the right to object to processing where such processing consists of profiling (including profiling for direct marketing).

10.2

In addition to the rights set out in section 11.1, where we rely on consent as the legal reason for using your personal information, you have the right to withdraw your consent. Further details about this are set out in section 5.4.

10.3

If you want to exercise any of the above rights in relation to your personal information, please contact us using the details set out at the beginning of this notice. If you do make a request then please note:

a) we may need certain information from you so that we can verify your identity;
b) we do not charge a fee for exercising your rights unless your request is unfounded or excessive; and
c) if your request is unfounded or excessive then we may refuse to deal with your request.

11. Marketing

11.1

You may receive marketing from us about similar goods and services, where either you have consented to this, or we have another legal reason by which we can contact you for marketing purposes.

11.2

However, we will give you the opportunity to manage how or if we market to you. At the time of collecting your details, we will provide you with an opportunity to opt-out and in any marketing email which we send to you, we provide a link to either unsubscribe or opt-out, or to change your marketing preferences. To change your marketing preferences, and/or to request that we stop processing your personal information for marketing purposes, you can always contact us on the details set out at the beginning of this notice. Please note that where you unsubscribe from our marketing communications, we will keep a record of your email address to ensure we do not send you marketing emails in future and you will still receive service related emails such as updates to our services.

11.3

If you do request that we stop marketing to you, this will not prevent us from sending communications to you which are not to do with marketing (for example in relation to services which you have purchased from us).

11.4

We do not pass your personal information on to any third parties for marketing purposes.

11.5

Supportal Health will not use your survey responses or sensitive personal information to contact you for external marketing purposes.

12. Complaints

If you are unhappy about the way that we have handled or used your personal information, you have the right to complain to us.

In the UK, if you are not satisfied with our response, you may escalate the matter via our complaints procedure by contacting us. During this process we will acknowledge your complaint within 30 days, make enquiries into the complaint without undue delay and make an appropriate level of enquiries.

If after the complaints process, you remain dissatisfied, you have the right to lodge a complaint with the UK supervisory authority for data protection, which is the Information Commissioner's Office (ICO).

If you are in the EU, you do not need to escalate the matter via our complaints process and you can complain to the data protection regulator in the country you live or work in. For the EU, a list of supervisory authorities and their contact details can be found here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
Please do contact us in the first instance if you wish to raise any queries or make a complaint in respect of our handling or use of your personal information, so that we have the opportunity to discuss this with you and to take steps to resolve the position. You can contact us using the details set out at the beginning of this privacy notice.

13. Third Party Websites

Our website may contain links to third party websites. If you click and follow those links then these will take you to the third party website. Those third party websites may collect personal information from you and you will need to check their privacy notices to understand how your personal information is collected and used by them.