Privacy policy

For your information

We are ABR Health Ventures Ltd trading as Calibre.

Questions about our privacy policy? Email privacy@getcalibre.com.

• We run getcalibre.com, app.getcalibre.com, and the Calibre mobile app

• We only serve adults resident in the UK aged 18 to 65

• We are a CQC-registered provider. We arrange diagnostic blood tests through Randox Health London Limited, our appointed UKAS-accredited laboratory, and provide a personalised health assessment and plan signed off by our GMC-registered clinicians

• We ask for your explicit consent to process your health data. You can withdraw consent at any time, subject to our clinical record retention obligations

• We use essential, analytics, and marketing/advertising cookies and respect Do Not Track / GPC signals

• We primarily store data in the UK and aim to keep it within the UK/EEA. Where data is processed outside these regions (e.g. by service providers), appropriate safeguards are in place in line with applicable data protection laws

• Your rights include access, correction, and erasure (subject to clinical record retention obligations)

• This policy was last updated on 07/09/26

Who we are

• Data Controller: ABR Health Ventures Ltd (trading as “Calibre”)

• ICO registration: ZB972083

• Registered address: Fora, 33 Broadwick Street, London, England, W1F 0DQ

• Company number: 16333644 registered in England and Wales

• Contact: privacy@getcalibre.com

What this policy covers

This policy applies to getcalibre.com, app.getcalibre.com, and the Calibre mobile app (together, the “Service”).

About Calibre

Calibre is a CQC-registered proactive health service. All clinical interpretation, result review, and sign-off is performed by Calibre's GMC-registered clinicians. Calibre provides preventive health services only and is not an emergency service and is not a substitute for your GP. If you have or suspect a medical condition, contact your GP. In an emergency, call 999.

Who can use the Service

We only serve adults aged 18 to 65 who reside in the UK. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has provided data, contact us and we'll delete it. For full eligibility criteria, please refer to our Terms of Service.

The data we collect, why we collect it, and our legal bases

We only collect the data needed to run the Service.

Account data: Name, email, password or SSO. Why: Provide and manage your account. Legal basis: Contract.

Contact details: Phone number, address. Why: Provide the Service; support communications. Legal basis: Contract.

Payments: Payment data processed by our third party payment provider (we don't see card numbers). Why: Take payments; prevent fraud. Legal basis: Contract.

Support & feedback: Messages via app/site, forms, surveys. Why: Provide support; improve the Service. Legal basis: Contract and/or Consent.

Health data (special category) Health history, symptoms, wellbeing info you enter in the web/app. Why: Provide health assessment and personalised health plan. Legal basis: Explicit Consent and UK GDPR Article 9/2(h) (processing necessary for the provision of health care).

GP details: Name and contact details of your registered GP. Why: We may contact your GP where a result requires clinical follow-up or where we are unable to reach you with an urgent finding. Providing these details is strongly encouraged but not mandatory. You can opt out at onboarding, but please be aware this may limit our ability to escalate urgent results through your existing care pathway. Legal basis: Contract and Legitimate Interests.

Booking data shared with Randox Health London Limited: Booking details and test panel. Why: To arrange and process your blood draw and laboratory analysis. Randox is a data processor; Calibre is the controller. RCLS is an approved sub-processor. Legal basis: Contract.

Booking data shared with Heim Health Ltd / Thornbury Nursing Services: Booking details and test panel. Why: To arrange home phlebotomy where you select this option. Heim is a data processor; Thornbury Nursing Services is a permitted sub-processor. Legal basis: Contract.

Booking data shared with DocTap Ltd: Booking details and test panel only. No health context is shared. Why: Fallback clinic collection where Randox has no available slot or location. DocTap is an independent data controller for clinic records. Legal basis: Contract.

Consultation recordings and AI scribe transcripts: Recording and/or AI-generated transcript of your video consultation. Why: Clinical note-taking, record-keeping, and quality assurance. Legal basis: Explicit Consent (separate opt-in sought before each consultation). You may decline without affecting your clinical care.

Navigator conversation data: Conversations you have with Calibre's AI-powered Navigator assistant within the app. Why: To provide the Navigator service and, with your consent, to improve the product and train our AI models. Before any conversation data is used for improvement purposes, it is pseudonymised. Legal basis: Contract (for delivering the Navigator service) and Consent (for product improvement and model training). You can withdraw consent for the improvement use at any time by contacting privacy@getcalibre.com without affecting your access to the Navigator.

Research data: Survey responses, interview notes, feedback collected during optional research activities, and where applicable recorded calls/transcripts. Why: To improve Calibre's service and user experience. Legal basis: Consent (separate opt-in).

Device & technical: IP address, browser/user agent, OS, screen size. Why: Analytics and product improvement. Legal basis: Consent.

Usage/analytics: Pages viewed, clicks, session replay (via PostHog). Why: Understand usage; improve the Service. Legal basis: Consent.

Location (coarse): Approximate location from IP. Why: Personalise content. Legal basis: Consent.

Marketing preferences: Newsletter/notification sign-up status. Why: Communicate when we have relevant marketing. Legal basis: Consent.

Your consent to health data

Because health data is sensitive, we will ask you to give explicit consent before you use the Service. You can withdraw consent at any time by emailing privacy@getcalibre.com. If you withdraw consent, we will not be able to continue delivering the Service.

As a CQC-registered clinical provider, Calibre is required to retain clinical records for a defined period regardless of account closure or withdrawal of consent. Your right to erasure under UK GDPR is a qualified right where processing is necessary for the provision of healthcare or compliance with a legal obligation. We will always explain what we are retaining and why.

Use of AI language models and the Navigator

Calibre uses third-party AI language models to support the drafting of Health Assessments and the processing of consultation transcripts for clinical note-taking purposes. Before any data is passed to an LLM, it is pseudonymised. All LLM outputs are reviewed and approved by a Calibre GMC-registered clinician before being included in your health record or shared with you. AI does not make clinical decisions. This use is governed by our AI Governance Policy (CAL-POL-06). Legal basis: Legitimate Interests.

Calibre also operates an AI-powered conversational assistant called the Navigator, available within the app to support your health journey between consultations. Your conversations with the Navigator may be reviewed by members of the Calibre team and used to improve the Navigator and Calibre's service more broadly. Before any conversation data is used for this purpose, it is pseudonymised. You can opt out of your Navigator conversations being used for product improvement at any time by contacting privacy@getcalibre.com, without affecting your access to the Navigator. The Navigator is a support tool only and does not provide clinical advice, make clinical decisions, or replace the judgement of a Calibre clinician. Legal basis for product improvement use: Consent.

Cookies and similar tech

We use three categories of tracking technologies across our website, and to a more limited extent within our app:

• Essential cookies and tech, which are necessary to run the Service.

• Analytics cookies and tech (Google Analytics 4, PostHog, CustomerLabs), which help us understand how the Service is used and improve it. Used only where you have given consent.

• Marketing and advertising cookies and tech (Meta Pixel, Google Ads, CustomerLabs), which help us measure the effectiveness of our advertising. Used only where you have given consent.

We also use server-side tracking via the Meta Conversions API, configured through Google Tag Manager to send event data (including hashed identifiers such as your email address) to Meta for advertising attribution. Server-side tracking processes personal data even though it doesn't involve cookies in your browser, and we only carry it out where required consent has been obtained via your cookie preferences.

In addition, certain event data (such as waitlist sign-ups) may be sent to PostHog via Google Tag Manager for product analytics purposes.

Our consent banner lets you accept or decline analytics and marketing separately. We respect Do Not Track (DNT) and Global Privacy Control (GPC) signals: if enabled, we won't set analytics or marketing cookies, and we won't send server-side advertising data.

Cookie lifetimes: analytics and marketing cookies are kept no longer than 13 months; essential cookies only as long as needed.

Research and Service Improvement

We may invite you to take part in optional research activities (surveys, interviews, feedback sessions). Participation is voluntary with your consent and has no effect on your use of the Service if you decline or withdraw.

• Interviews may be conducted via Google Meet and recorded. Recordings are stored in Google Workspace after your consent

• Direct identifiers are stored in a locked-down Google Drive folder with restricted access.

• Pseudonym mappings are tracked in a Google Sheet in the same locked-down folder.

• Pseudonymised outputs (e.g., transcripts with identifiers removed) may be shared more broadly within the Calibre team for analysis, stored in a separate Google Drive folder, and processed using tools such as Notion and AI tools.

• Survey responses are pseudonymised from collection and stored in Tally and Google Sheet

At the point of each research activity, we'll tell you what data is collected, how it's used, who has access, and how long it's retained.

Legal basis: Consent. You can withdraw research consent at any time by emailing privacy@getcalibre.com, separately from any other consents you've given.

Who processes your data for us

In order to provide our services to you, we use a number of trusted third-party providers. We may share your data with these parties where we have a lawful basis to do so. This may include where the sharing is necessary to deliver our services to you, where you have given consent, or where we are required to meet legal or regulatory obligations.

Third parties with whom we may share your data include:

• Randox Health London Limited: appointed laboratory; analyses your blood sample. Data processor; Calibre is the controller. RCLS is an approved sub-processor. UKAS accreditation 9329, ISO 15189:2022. 48-hour breach notification obligation.

• Heim Health Ltd: home phlebotomy platform where you select this option. Data processor. Thornbury Nursing Services is a permitted sub-processor.

• DocTap Ltd: fallback clinic collection only where Randox has no available slot. Independent data controller for clinic records. No health context shared. See DocTap's privacy notice at doctap.co.uk/privacy-policy.

• Payment providers (e.g. Stripe): to process payments securely.

• Communication providers (e.g. Wati): to send you messages, updates, and reminders via email or messaging platforms. Where data is transferred internationally, this is carried out under EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).

• Advertising partners (e.g. Meta, Google Ads): to measure the effectiveness of our marketing and advertising (used only with your consent where required).

• Survey and research tools (e.g. Tally): to collect feedback and conduct optional research surveys.

• Analytics providers: to understand how our website and services are used and improve performance (used only with your consent where required).

• Integration partners: to connect wearable devices and import relevant health data.

• AI and data processing providers: to support analysis and improvement of our services.

• IT service providers and technical support partners: to maintain and support our systems and infrastructure.

• Professional advisers and regulators: including lawyers, auditors, and regulatory authorities where required.

How we keep your data safe

We use industry-standard safeguards, including:

• Encryption in transit and at rest

• Access controls and least-privilege access

• Regular backups and vulnerability management

No method is 100% secure, but we work very hard to protect your data.

Where we store data and international transfers

We primarily store data in the UK and seek to limit transfers outside the UK/EEA. Where such transfers occur, they are carried out in accordance with applicable data protection laws and subject to appropriate safeguards. We only transfer personal data to entities in third countries that have been held to provide an adequate level of protection, or where contractual terms have been adopted to meet the legal requirements for such transfers.

How long we keep data

We keep your personal data only as long as needed to provide the Service and meet our legal obligations. As a CQC-registered clinical provider, clinical records are retained for a minimum period as required by applicable healthcare regulations, regardless of account closure or withdrawal of consent. For non-clinical data, if you ask us to delete your data, we'll do so unless we need to keep some of it for legal, regulatory, or security reasons.

Your rights

You can access the personal data we hold about you, correct inaccurate data, and request erasure. Your right to erasure is a qualified right where processing is necessary for the provision of healthcare or compliance with a legal obligation. We will explain what we are retaining and why if we cannot fulfil an erasure request in full.

To exercise these rights, email privacy@getcalibre.com. We'll ask you to verify your identity. If we can't meet a request, we'll explain why.

Complaints

If you're unhappy with how we handle your data, please contact us at privacy@getcalibre.com. You can also complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

Third-party links

Our Service may link to third-party sites or services. Their privacy practices are their own, please check their policies.

Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll notify you by email and update the “Last updated” date above.

Contact us

Please direct questions, requests, or complaints to privacy@getcalibre.com.