Skip to content
Recovrly

Legal & trust

Privacy notice

How Recovrly collects, uses, shares and protects your personal data, and the rights you have over it.

Framework drafted, not yet final. This page sets out the structure this document will follow. Sections marked Pending are awaiting confirmed governance content and haven't been through formal review or sign-off.

Who we are

Recovrly Health Ltd ("Recovrly", "we", "us") is the data controller for personal data processed through the Recovrly website and app. We're registered in England and Wales (company number 17134638), registered office 128 City Road, London, EC1V 2NX.

You can contact us about privacy at support@recovrly.com.

Pending

ICO registration reference, and dedicated privacy/DPO contact details if one is appointed separately from general support.

What data we collect

Using Recovrly involves us processing personal data and, in most cases, special category health data (for example heart rate, step count, questionnaire responses, sleep, and pathway or content engagement) to provide your recovery pathway.

Pending

The full categories of personal and special-category data collected, mapped from the Data Protection Impact Assessment (DPIA).

Lawful basis for processing

UK GDPR requires a lawful basis for processing personal data, and an additional Article 9 condition for special category health data.

Pending

The specific lawful basis and Article 9 condition confirmed per data category in the DPIA.

How we use your data

Pending

The confirmed list of processing purposes (pathway delivery, safety monitoring, service improvement, etc.) from the DPIA.

Who we share your data with

Your data may be shared with clinicians and staff at your treating organisation, scoped to your assigned pathway, and with service providers who process data on our behalf under contract (for example, cloud hosting and infrastructure providers). We do not sell personal data.

Pending

A named list of sub-processors (hosting, email, analytics, CRM) and their roles, once confirmed.

How long we keep your data

Pending

Confirmed retention periods per data category.

Your rights

Under UK GDPR, you have the right to:

  • access the personal data we hold about you;
  • have inaccurate data corrected;
  • have your data erased in certain circumstances;
  • restrict or object to certain processing;
  • receive your data in a portable format; and
  • not be subject to decisions based solely on automated processing, including profiling, that have a legal or similarly significant effect on you.

To exercise any of these rights, contact support@recovrly.com.

International transfers

Where we transfer personal data outside the UK, we put appropriate legal safeguards in place.

Pending

The specific transfer mechanisms (e.g. UK International Data Transfer Agreement, adequacy decisions) per provider.

Keeping your data secure

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse.

Pending

A summary of specific security measures and any relevant certifications, once confirmed with governance.

Changes to this notice

We may update this notice from time to time. We'll post any changes here and update the drafted date below.

How to complain

If you're unhappy with how we've handled your data, contact us first at support@recovrly.com. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

Framework drafted: 9 September 2026. This document will carry a proper "last reviewed" date once governance sign-off is complete.

Questions about this page? Get in touch