NOA PRIVACY POLICY

Last updated: 13 June 2026

1. NOA and Privacy

Hi, welcome to NOA’s Privacy Policy.

At NOA our mission is to empower women everywhere to make confident, informed wellness decisions through personalised science-backed guidance. We help women take the guesswork out of supplements and nutrition. To deliver on this mission and to give you the most personalised service we can, we ask you to share personal and sensitive data with us and we fully accept the responsibility that comes with safeguarding your health data.

We are passionate about privacy. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) as retained in UK law by the European Union (Withdrawal) Act 2018, the UK Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended from time to time. References in this policy to “GDPR” mean the UK GDPR unless the context otherwise requires.

What’s the purpose of this policy?

This policy explains how we may use your personal data. We want to help you understand how we work with your data, so that you can make informed choices and be in control of your information. Please make sure you check this policy and if you don’t agree with it, then you shouldn’t use our site or service. We may update this policy from time to time and, if we make any material changes, we will notify you when we do so. We will provide you with the opportunity to review such changes. By continuing to use our products and services after the changes have been made and we have notified you of them, the way we use your personal data will be subject to the terms of the updated policy.

This policy also explains how we use your personal data for our healthcare services and products, including the NOA Now Plan. It also governs the use of your data through our website.

Who we are and what this notice applies to

Now Often Always Limited (“NOA”, “we”, “us”) is a company registered in England and Wales (number 15656006). The registered office for our company is First Floor, 28 Arcadia Avenue, London, England, N3 2FG, and we are the Controller of the Personal Data processed under this policy.

This notice is made for and applies to anyone who is an end-user of NOA’s Services, including the NOA Now Plan, or anyone who is visiting our Website (our “Customers”).

This privacy notice does not cover how our partners process Personal Data as part of their wider services. We encourage you to read their privacy notices so that you understand how your Personal Data will be used by them.

Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.

Contact us

If you have any questions about this privacy notice or our privacy practices in general, please get in touch.

You can contact our privacy team with any data protection queries at: info@nowoftenalways.com. We have not formally designated a Data Protection Officer as we are not required to do so under the UK GDPR, but we take our data protection responsibilities very seriously.

2. What personal data we hold and how we get it

Personal details

When you register with us, you complete forms and provide us with basic information about yourself, such as your name, date of birth, phone number, and email address. If you provide us with your email address, we may use it to send information, unless you have told us not to do so.

We may process your personal data to fulfil our contractual obligation to you such as account management and other administrative purposes. We may be obligated to process some of your personal data to comply with applicable laws and regulations.

Health and medical information

When you register with us on our website, and when you take our Online Health Assessment questionnaire and use our services, you are sharing information about your health, lifestyle, symptoms, treatments, medications, and procedures. We get this information directly from you.

When you sign up to the NOA Now Plan, we collect information about your health, including:

General health and lifestyle
Symptoms, treatments and medications
Diet, supplement and exercise habits
Previous pregnancies
Health data, including previously diagnosed conditions
Information supplied in respect of your menstrual cycle, lifestyle factors and symptoms

Financial Information

If you make any payments on the NOA website, your credit/debit card details are processed directly by a third party processor that will store all payment information and transaction details. We will only retain details of transactions on secure servers and we will not retain your credit or debit card information.

What we use your personal data for

The purposes for which we use your personal data and the legal grounds on which we do so are as follows:

Providing you with a service

We need your personal information to enter into a contract with you and deliver services.

We use your financial details to charge you if you use our paid service. Where necessary, we may need to share personal and financial details for the purposes of fraud prevention and detection.

We use your health and medical information to provide you with our service. This includes giving you general wellness advice, nutrition and supplement recommendations.

This information is based on:

Providing you general wellness advice services in our ‘legitimate interest’ (outlined below).
Your consent (for example, when you use our service and agree to share information with our NOA Nutritionists).

The health information we use includes, but is not limited to:

Information supplied in our Online Health Assessment.
Information obtained from your blood test results from the laboratory.
Consultations with our NOA Nutritionists.

By signing up to the NOA Now Plan and sending your blood sample to our partner laboratory, you are giving NOA and its partner laboratory your explicit informed consent under Article 9(2)(a) UK GDPR to perform the tests you have requested and to share the necessary information for them to conduct confirmatory analysis of your sample and/or your results. By providing your contact details when signing up, you expressly consent to being contacted by those means in relation to your blood test request and the delivery of our Services. You may withdraw this consent at any time by contacting us at info@nowoftenalways.com, though this will not affect any processing already carried out.

When you purchase or use our products and services, we will collect and process data concerning health, including blood samples, test information or any further information we might receive from our partner accredited laboratories. When you activate a service or product, we will collect and process information relating to your personal health record as well as a suitability questionnaire to confirm that the service or product is appropriate to your needs. By obtaining a blood test and results we will ask you to give NOA and its partner clinics your informed consent to review the results you have requested so that we can provide you with the personalised guidance and insights you have signed up for. You can withdraw your consent to this processing at any time by emailing us at info@nowoftenalways.com.

We do not carry out or request any tests beyond those you have specifically requested and consented to. Please note that blood test results may incidentally reveal information about your genetic predispositions or wider health status; we do not use any such incidental findings for purposes other than delivering the Services to you. Our partner laboratories are UKAS-accredited and dispose of your physical blood samples within 7 days of testing in accordance with their laboratory policies.

We get your location from your postal address.

We may share your personal data with companies we have hired to provide services on our behalf, including those who act as data processors on our behalf, acting strictly under contract in accordance with Article 28 UK GDPR. Those data processors are bound by strict confidentiality and data security provisions, and they can only use your data in the ways specified by us.

3. Using your data when it’s in our ‘legitimate interest’

We sometimes analyse your anonymised data and how you use our products to help us manage our business better.

Based on our legitimate interest in managing and improving our business (Article 6(1)(f) UK GDPR), we may analyse data about your use of our products and services to, for example, troubleshoot technical issues, forecast demand and understand trends in service use, including which features are most valued. We have assessed that our legitimate interest in doing so is not overridden by your interests or fundamental rights, as this processing does not involve making any individualised decisions about you and uses only aggregated or anonymised data. This is only about improving our website so that we can deliver better services to you. Strict confidentiality and data security provisions will apply at all times.

Keeping you informed

We may send you marketing communications (including updates, surveys and promotional information) by email or text message only where you have given us your prior consent in accordance with PECR, or where we are entitled to do so under the “soft opt-in” exception in regulation 22 PECR (i.e. where you are an existing customer and we are marketing our own similar services). You can withdraw your consent or opt out of marketing communications at any time by clicking the unsubscribe link in any email we send, or by contacting us at info@nowoftenalways.com. We will act on opt-out requests without undue delay.

As part of providing you with a healthcare service, we may send you health information by text message, email or in other ways.

How we use your data to help you

We need to keep a record of the care you receive to ensure that:

NOA Nutritionists have accurate and up-to-date information
We have all the information necessary for assessing your needs and providing excellent care
Your concerns can be properly investigated if you raise a complaint

4. Principles of processing

Data minimisation and purpose limitation: We will not process personal data in a way that is incompatible with the purposes for which it has been collected or authorised by you or collect any personal data that is not needed for the mentioned purposes.

In order to deliver our Services, we collect and process special category data (health data) in accordance with Article 9(2)(a) UK GDPR and Schedule 1, paragraph 1 of the DPA 2018 (explicit consent). This data will be processed only when necessary and in compliance with the law under the following legal basis:

Explicit Consent (Article 9(2)(a) UK GDPR and Schedule 1, DPA 2018): We will process your special category health data only with your explicit, freely given, specific, informed and unambiguous consent. You have the right to withdraw this consent at any time by contacting us at info@nowoftenalways.com. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to withdrawal. We maintain an Appropriate Policy Document as required by Schedule 1, Part 4 of the DPA 2018 in connection with our processing of special category data.

We are committed to ensuring that your special category data is handled with the highest level of security and in strict accordance with UK GDPR and DPA 2018 requirements.

No sale of personal data

We will not sell or rent your personal data for monetary gain. We will not disclose your personal data except as otherwise described in this Privacy Policy. We will share your personal data with our service providers who support our services as described in this Privacy Policy.

Collection and Usage of Information

Where you purchase our NOA Now Plan, we will need to collect the following information from you:

your personal details, including your name and date of birth
contact information, including your telephone number, email address and delivery address
any answers to the Online Health Assessment
any queries that you raise with us, for instance, you may submit a question by email to us about the test
all other information that you choose to provide us

Our third party payment provider will need to collect your payment details in order to process your order for us. In order to carry out the testing, we will also need to collect your blood sample (“Sample”). We will receive and store your test results, all related correspondence, materials and information from our third-party testing laboratory.

We will only use the data that we collect about you for the following purposes and in accordance with your preferences:

so our partner can deliver the blood test kit to you, when you select an in-clinic blood test
to perform the test, our third-party laboratory will perform the test on the sample which you have provided to us
to analyse your test result, we will review the results received from our third-party laboratory so that we can provide you with a report
to contact you about your test, we will contact you if there is a problem with your test, or if we have further information about your order or test results
to arrange consultations with our NOA Nutritionists
to provide follow up personalised health coaching
to respond to your queries that you submit
to contact you about new test services or similar services
to help us to improve our website, including its content, layout and navigation
to verify your user credentials when you attempt to login to the website

We will not use your blood sample related information for any other purpose without your explicit consent.

Sharing your personal data with others

Our key third-party processors are:

Inuvi (mobile phlebotomy provider) — who will process your personal data and health data in order to arrange and carry out your at-home blood test appointment. Their privacy policy is available here.

Our partner clinics (in-clinic phlebotomy providers) — who will process your personal data and health data in order to arrange and carry out your in-clinic blood test appointment. When you engage directly with a partner clinic to arrange your blood test as part of the NOA Now Plan, they will also process your personal data and health data in accordance with their own privacy policies.

Face the Future Online Limited (“FTF”) — where you purchase the NOA Now Plan via the Face the Future website (www.facethefuture.co.uk), FTF will share your name, email address and order reference with NOA solely to enable us to onboard you and deliver the Services. FTF does not have access to your health data or blood test results. FTF’s privacy policy is available here.

We may also recommend supplements available through our authorised supplement retail partners, which may include Face the Future Online Limited and Healf.com. If you choose to purchase supplements through any such partner, your transaction will be subject to that retailer’s own terms and privacy policy. NOA may receive a referral fee in connection with such purchases; this does not affect the recommendations we provide to you. We share only the minimum information necessary to facilitate any referral.

We may preserve or disclose information about you to comply with a law, regulation, legal process, or governmental request; to assert legal rights or defend against legal claims; or to prevent, detect, or investigate illegal activity, fraud, abuse, violations of our terms, or threats to the security of our services or the physical safety of any person.

Except as described above, we will never share your personal information with any other party without your consent.

Handling, storage and destruction of your information

We impose appropriate obligations to protect the security and privacy of your information where we use third-party providers. The tests carried out on your blood sample are only those that you have agreed to being run. Your blood sample will be sent to our third-party testing laboratory so that they can perform the test. Once the test has been performed, the blood sample will be destroyed.

Retention period

We retain your health and medical data for a minimum period of 13 months from the date of your last interaction with us. This reflects guidance from healthcare regulators and professional bodies, and the applicable limitation periods for claims relating to health services. Where shorter retention periods apply to other categories of data (for example, marketing data), we will retain such data only for as long as is necessary for the purpose for which it was collected or until you withdraw your consent, whichever is earlier. We review our retention periods regularly and document our reasoning in our internal retention schedule.

In some circumstances, we might keep data longer if the law says we have to. If you want to see any of this information while we have it (in its ‘retention period’), you can ask for it by emailing us at: info@nowoftenalways.com.

How we store and move your data

Your data, including your personal health and medical information, is stored on secure servers on encrypted databases hosted within the UK and EU. Transfers of personal data to the EU are covered by the UK’s adequacy regulations. Some of our third-party service providers (for example, analytics or communications tools) may be based outside the UK and EEA, including in the United States. Where personal data is transferred to countries not covered by a UK adequacy decision, we ensure appropriate safeguards are in place in accordance with Article 46 UK GDPR, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can request further details of the safeguards in place by contacting us at info@nowoftenalways.com. This includes information like:

Your contact details
Your information supplied in our Online Health Assessment
Your information obtained from your blood test results from the laboratory as well as the NOA Nutritionist’s comments
Consultations, like notes, recordings, and transcripts from teleconsultations with our NOA Nutritionist
Your willing disclosure or input of detail in any correspondence with our team

Your rights

Whenever we rely on your consent to process your personal data, you have the right to withdraw your consent at any time by contacting us at info@nowoftenalways.com. We will act on any withdrawal without undue delay. You also have the following rights under the UK GDPR and DPA 2018:

Wherever we process data based on your consent, withdraw that consent at any time
Understand and request a copy of information we hold about you. For other information, you can make a request by email
Ask us to rectify or erase information we hold about you, subject to limitations relating to our obligation to store medical records for prescribed periods of time
Ask us to restrict our processing of your personal data or object to our processing
Ask for your data to be provided on a portable basis

You may also contact the Information Commissioner’s Office (the data protection regulator in the UK): Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone: 0303 123 1113 (local rate).

Automated processing

Our supplement and wellness recommendations are generated with the assistance of data analysis tools but are reviewed by our NOA Nutritionists before being provided to you. No decisions with a significant legal or similarly significant effect on you are made solely by automated means without human review. If this changes, we will update this policy and notify you accordingly.

Cookies

This Cookie Policy governs the use of cookies through the NOA website.

What is a cookie?

Cookies are small text files, like a tag, that are stored on your computer, phone or tablet when you visit a website. They are created when you use your browser to visit a website that uses cookies to keep track of your movements within the site, help you resume where you left off, remember your registered login, theme selection, preferences, and other customisation functions.

Cookies are widely used by website owners in order to make their websites work more efficiently, as well as to provide reporting information.

Cookies set by NOA are called “first party cookies”. Cookies set by parties other than NOA are called “third party cookies”. Third party cookies enable third party features or functionality to be provided (e.g. like advertising, interactive content and analytics). The parties that set these third party cookies can identify your computer when it visits the website in question, as well as when it visits certain other websites.

How do cookies affect my privacy?

You can visit the NOA website without revealing your personal details. We may ask you for personal information so you can use our services. Full details of how we collect information, how we use it, how we keep it and how we disclose it can be found in our Privacy Policy.

Where we use analytics or marketing cookies, we do so only with your prior consent obtained through our cookie consent banner. We rely on our legitimate interests under Article 6(1)(f) UK GDPR for the processing of any data collected through strictly necessary cookies only. For all other cookie-based processing, our lawful basis is your consent.

Why do we use cookies?

We use cookies for several reasons. Some cookies are required for the technical support of the NOA website, and we refer to these as “essential” or “strictly necessary” cookies. Other cookies also enable us to track and target the behaviours and interests of our users to enhance their experience with NOA.

The specific types of first and third party cookies served through the NOA website and the purposes they perform are described below:

Essential website cookies: These cookies are strictly necessary to provide you with services available through our website and to use some of its features.
Marketing and customisation cookies: These cookies collect information that is used either in aggregate form to determine how effective our marketing campaigns are, or to help us better target our marketing campaigns.
Analytics cookies: These cookies collect information that is used either in aggregate form to determine how effective our marketing campaigns are, or to help us understand how you use our websites enabling us to better customise it for you.

How to manage cookies

Under PECR, we are required to obtain your prior, informed consent before setting any cookies that are not strictly necessary for the operation of our website. When you first visit our website, you will be presented with a cookie consent banner which allows you to accept or decline different categories of cookies. You can change your preferences at any time by accessing our cookie settings via the link in the footer of our website. Strictly necessary cookies cannot be disabled as they are essential for the website to function. If you use a different device, browser or clear your cookies, you will be asked for your preferences again.

Most computers and some mobile web browsers automatically accept cookies but, if you prefer, you can change your browser to prevent that or to notify you each time a cookie is set. You can also learn more about cookies by visiting www.aboutcookies.org which includes additional useful information on cookies and how to block cookies using different types of browser. Please note however, that by blocking or deleting cookies you may not be able to take full advantage of the NOA website.