ProgrammesMeet LaraAbout EkaaroFAQsMember login

Privacy

Privacy Policy

Last updated: 22 August 2026

1. About this Privacy Policy

Ekaaro Health respects your privacy and is committed to handling your personal information responsibly, transparently and securely.

This Privacy Policy explains how we collect, use, store and share personal information when you:

This policy applies across our website, iOS and Android apps, programmes, memberships and related services.

Individual services or features may also provide additional privacy information at the point information is collected where appropriate.

2. Who we are

Ekaaro Health is the trading name of Ekaaro Ltd.

For the purposes of UK data protection law, Ekaaro Ltd is the controller of personal information where it determines why and how that information is processed.

Ekaaro Ltd
Company number: 17364549
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

For privacy and data-protection enquiries, contact privacy@ekaaro.health.

3. Information we may collect

The information we collect depends on how you use Ekaaro.

Identity and account information

This may include:

Find Your Fit and onboarding information

This may include information about:

Some of this information may constitute health information or other special category personal data under UK data protection law.

Programme and progress information

Depending on the service you use, this may include:

Food and nutrition images

You may choose to upload food and nutrition-related images.

These may include photographs of:

Ekaaro does not currently provide a feature intended for uploading body or progress photographs.

Lara interactions

When you interact with Lara, we may process:

Where voice input is available, your device microphone may be used to convert speech into text.

Ekaaro does not retain voice recordings as part of your Lara conversation history. The resulting text may be retained as described in this policy.

Connected health and activity information

If you choose to connect a compatible health service, we may access information for which you grant permission.

Depending on the features available and permissions you provide, this may include information such as:

We do not access heart rate or resting heart rate, and we do not access location or route information from any connected service.

Connected health information is optional.

You do not have to connect Apple Health, Health Connect or another compatible service to use Ekaaro, although some personalised insights may be less detailed without it.

Appointment and professional-support information

Where you use professional support provided through an Ekaaro programme, we may process:

Payment and transaction information

We may process information relating to:

Payments are handled through third-party payment providers. Ekaaro does not ordinarily receive or store your complete payment-card details.

Delivery information

Where an Ekaaro service includes a physical product, we may process information such as your:

Communications

We may retain information contained in:

Technical, security and usage information

Our website, app and technical providers may process information needed to operate, secure and improve our services.

Depending on our technical configuration, this may include:

Where required, additional information and choices will be provided through appropriate cookie, app or privacy controls.

Consent and preference records

We may keep records of:

4. Health information and special category data

Some information processed by Ekaaro may reveal information about your health and may therefore constitute special category personal data under UK data protection law.

This may include information provided through:

We take additional care when processing this information.

We aim to collect and use health information only where reasonably necessary for clearly identified purposes, such as:

Processing health information requires both an appropriate lawful basis for processing personal information and an appropriate condition for processing special category data under applicable data-protection law.

Where we rely on explicit consent as the relevant special-category condition, we will request that consent clearly and appropriately. General acceptance of this Privacy Policy does not itself constitute explicit consent to every use of your health information.

You may withdraw consent where processing relies on consent. Withdrawal does not affect processing that was lawful before consent was withdrawn.

If particular information is genuinely necessary to provide a feature or service safely or appropriately, withdrawing the relevant permission or consent may mean that feature or service can no longer be provided.

Disconnecting optional connected-health information does not automatically end your Ekaaro programme or membership.

5. How we use personal information

Depending on the service you use, we may process personal information to:

  1. create and manage your Ekaaro account;
  2. provide Find Your Fit and assess programme suitability;
  3. provide and personalise our programmes, memberships and services;
  4. enable Lara to understand relevant context and provide more personalised support;
  5. record and display food, hydration, movement and progress information;
  6. provide connected-health insights where you choose to enable them;
  7. provide Strength and Mobility support and personalised plans;
  8. provide Health and Progress Reviews and related professional support;
  9. arrange and manage appointments;
  10. process payments, subscriptions and refunds;
  11. arrange product fulfilment and delivery;
  12. provide customer support and handle complaints;
  13. send necessary account, security, programme, appointment and service communications;
  14. operate, secure, troubleshoot, analyse and improve our website, apps and services;
  15. meet legal, regulatory, tax, accounting, safety and compliance obligations; and
  16. send marketing where permitted and in accordance with your marketing preferences.

We do not sell your personal information or health information.

We do not use health information, connected-health information or Lara conversations for third-party advertising or provide those categories of information to data brokers.

6. Our lawful bases

UK data protection law requires us to identify an appropriate lawful basis when processing personal information. Depending on the purpose, we may rely on:

Contract

Where processing is necessary to enter into or perform our contract with you, for example to:

Legal obligation

Where processing is necessary to comply with legal obligations, including relevant tax, accounting, regulatory, consumer-protection and data-protection obligations.

Legitimate interests

We may process information where necessary for our legitimate interests or those of another person and where those interests are not overridden by your rights and interests. This may include appropriate processing to:

Where appropriate, we consider the interests and potential impact on individuals before relying on this basis.

Consent

We may rely on consent for particular optional activities, such as certain:

Where consent is our lawful basis, you can withdraw it.

Health and other special category information

Processing health information requires an additional condition under UK data-protection law. Depending on the particular processing, we may rely on explicit consent or another condition permitted by applicable law.

The lawful basis applying to ordinary personal-data processing and the condition applying to special-category data are considered separately.

7. Lara and artificial intelligence

Lara is Ekaaro’s AI-powered lifestyle and wellbeing companion.

When you interact with Lara, your message and relevant permitted context may be processed to generate a response. Relevant context may include information such as:

We aim to provide only information reasonably necessary for the relevant AI function.

Ekaaro uses third-party AI and technology providers to provide aspects of Lara’s functionality. These providers may process information on Ekaaro’s behalf subject to appropriate contractual and data-protection arrangements.

Our technology providers may change as our technology develops.

Ekaaro selects and configures its AI services so that customer Lara conversations and health information processed on our behalf are not used by the AI provider to train its general-purpose AI models for the provider’s own purposes.

We do not sell Lara conversations or use them for third-party advertising.

We may use appropriately anonymised or aggregated information to understand and improve Ekaaro where individuals are no longer identifiable.

If our AI processing materially changes, we will update our privacy information where appropriate.

8. Lara voice interactions

Where voice input is available, you may choose to use your device microphone to speak rather than type.

Your speech is converted into text so that Lara can process your request.

Lara’s response may then be provided as text and, where you choose, converted into speech.

Ekaaro does not retain your original voice recording as part of your Lara conversation history.

The resulting text, Lara’s response and relevant conversation context may be retained in accordance with this policy.

Speech-to-text and voice functionality may involve third-party technology providers acting on Ekaaro’s behalf.

Microphone access is used for Lara voice functionality and is not intended for continuous background listening.

9. Connected health services

You may choose to connect Ekaaro to compatible health and activity services, including Apple Health on compatible Apple devices and Health Connect on compatible Android devices. Connecting these services is optional.

Ekaaro requests access only to data types reasonably necessary to provide the relevant user-facing features.

You control whether requested permissions are granted and may change or revoke them through your device or relevant health-platform settings.

Where permission is granted, Ekaaro may use relevant information to:

Information accessed through connected-health services will not be used for unrelated purposes inconsistent with the permissions and purposes explained to you.

Revoking platform permission stops future access in accordance with the relevant platform’s operation but does not necessarily delete information previously lawfully received by Ekaaro.

You may separately request deletion of information held by Ekaaro, subject to applicable legal and retention requirements.

Ekaaro does not sell connected-health information, provide it to data brokers or use it for advertising.

Information generated by phones, wearables, smart scales and other devices may contain inaccuracies. Ekaaro does not control the accuracy of information generated by those third-party devices or services.

10. Food images, camera and photos

Where the feature is available, you may use your camera or photo library to provide food and nutrition-related images to Ekaaro or Lara.

Camera or photo access may be used for functionality you choose to use, such as analysing or recording:

Ekaaro does not currently request camera or photo access for body or progress photography.

You control whether to grant relevant device permissions and can change those permissions through your device settings.

11. Professional support

Some Ekaaro programmes may include support from professionals such as Strength and Mobility providers or appropriately qualified healthcare professionals.

We follow a data-minimisation approach when providing information to these professionals.

Strength and Mobility

A Strength and Mobility provider may receive information reasonably necessary for the consultation and personalised plan, such as:

They are not intended to receive unrestricted access to your entire Ekaaro account, Lara history or unrelated health information.

Health and Progress Reviews

An appropriately qualified healthcare professional may receive information reasonably necessary for your review. Depending on your circumstances, this may include:

The professional is not intended to receive unrestricted access to every Lara conversation, food photograph or other unrelated account information by default.

Where this functionality is available, the professional may provide relevant notes or a summary following your review. Those notes may form part of your Ekaaro record and may be used to personalise subsequent programme support, including Lara support where appropriate.

12. Who we share information with

We may disclose relevant personal information to trusted organisations that help us provide Ekaaro. These may include providers supporting:

We aim to provide each provider only with information reasonably necessary for its role.

We may also disclose information where reasonably necessary to professional advisers, regulators, public authorities or law-enforcement bodies, or where necessary to protect legal rights or support a legitimate corporate transaction subject to appropriate protections.

Where another organisation acts as our processor, we require appropriate data-protection arrangements. Where another organisation acts as an independent controller, its own privacy information may also apply.

We do not sell customer lists to third parties for their own marketing.

Where a programme includes strength and mobility coaching, your coach may deliver your training plan using Everfit, a third-party coaching platform. Information you provide for that purpose is processed by Everfit under its own arrangements. Ekaaro does not exchange information automatically with Everfit, and your Lara conversations are not shared with it.

13. O.R.S and product fulfilment

Where a programme includes a physical product, relevant information may be shared with our fulfilment provider.

For the O.R.S hydration bundle currently included with Build, fulfilment is expected to be handled by Clinova.

Information shared for fulfilment may include:

We do not provide fulfilment partners with unrelated health information or Lara conversations merely because they fulfil your order.

Our fulfilment arrangements may change over time.

14. Payments

Payments are processed using specialist third-party payment providers.

Our current payment arrangements include Stripe, with Klarna potentially available as an optional payment method for eligible purchases.

Payment providers process information necessary to handle payments, fraud prevention and their own legal or regulatory responsibilities.

Ekaaro does not ordinarily receive or store your full payment-card details.

Where you choose a third-party payment or instalment option, that provider’s own privacy information and terms may also apply.

15. Marketing and service communications

Service communications

We may send communications reasonably necessary to provide your Ekaaro service. These may include:

These are separate from optional promotional marketing.

Marketing

Where required, marketing choices will be presented separately from acceptance of our Terms or use of the service.

You are not required to agree to promotional marketing to use an Ekaaro programme, membership or service.

Where you opt in to marketing, we may send information such as:

You can change your marketing preferences or unsubscribe at any time using the method provided in the communication or by contacting us.

16. Cookies, analytics and technical services

Our website and apps may use cookies, analytics, diagnostics and similar technologies to:

Where consent is legally required for non-essential cookies or similar technologies, we will request it through appropriate controls. See our Cookie Policy for the current list.

Advertising or remarketing technologies will not be permitted to receive Lara conversations, connected-health information, food records or other health-related information from authenticated areas of Ekaaro.

The exact analytics and diagnostic providers used in production are subject to technical implementation and may change.

Where required, we will provide additional information through our cookie notice, consent tools or other appropriate privacy disclosures.

17. International transfers

Ekaaro is based in the United Kingdom, but some organisations that help us provide our services may process personal information in other countries.

Where personal information is transferred outside the UK, we will take steps required by applicable UK data-protection law. Depending on the destination and provider, these may include:

Where appropriate, we will consider additional safeguards, particularly where health-related or other sensitive information is involved.

You can contact privacy@ekaaro.health for further information about safeguards relevant to international transfers of your information.

18. How long we keep information

We do not keep personal information indefinitely simply because we have collected it.

We consider factors including:

Account and programme information

Information needed to provide an active account, programme or membership will generally be retained while that service remains active.

Selected information may be retained after a programme ends where reasonably necessary for progress history, legal obligations, safety or another legitimate purpose.

Where available, Ekaaro may allow you to retain read-only access to selected historical progress information after a programme ends.

Financial and contractual records

Certain transaction, accounting, tax and contractual records may be retained for up to six years, or another period where applicable law requires or permits this.

Customer-service information

Routine customer-service information will generally be retained only for an appropriate period after an issue is resolved.

Information concerning a formal complaint, dispute, safety issue or legal matter may need to be retained for longer.

Health and professional information

Health, programme and professional-review information is retained only for as long as reasonably necessary, taking account of the purpose for which it was collected and any applicable legal, regulatory, professional or safety requirements.

Marketing preferences

Marketing information may be retained while relevant.

If you opt out, we may retain limited information on a suppression list so that we can remember and respect your preference not to receive marketing.

19. Account and data deletion

Where you have an Ekaaro account, you can initiate account deletion through the deletion functionality provided within the app.

An external deletion route will also be available through the Ekaaro website. You may also contact privacy@ekaaro.health.

When an account-deletion request is completed, we will delete or anonymise personal information associated with the account that we no longer need.

Some limited information may need to be retained where necessary or permitted for reasons such as:

Where information must be retained, we will limit its further use as appropriate.

Deleting information from Ekaaro does not necessarily delete information held independently on another service or device, such as Apple Health or Health Connect.

20. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, misuse, alteration, disclosure or destruction.

Measures may include controlled access, authentication, secure infrastructure and appropriate arrangements with service providers.

Access to personal information is intended to be limited to people and providers who reasonably need it for legitimate purposes.

No online service can guarantee absolute security. We therefore continue to consider security as our technology and services develop.

21. Automated processing and decision-making

Ekaaro uses technology and AI to personalise aspects of the service. For example:

We do not intend to rely on solely automated decision-making that produces legal or similarly significant effects on you unless this is lawful, appropriate safeguards are in place and any required information is provided.

AI-generated support is not a substitute for professional clinical judgement.

Where significant health or suitability judgement is required, appropriate human review may be used where necessary.

22. Safety and monitoring

Ekaaro and Lara may respond to information suggesting that you should seek professional or emergency support.

However, Ekaaro is not an emergency monitoring service.

You should not assume that:

If you require urgent or emergency medical assistance, you should contact the appropriate emergency or healthcare service directly.

23. Children

Ekaaro services are intended for people aged 18 and over.

We do not knowingly seek to provide our programmes, memberships or services to children.

If we become aware that someone under 18 has created an account or provided personal information in circumstances where they are not eligible to use the service, we may take appropriate steps to close the account and delete relevant information, subject to applicable legal obligations.

24. Your privacy rights

Depending on the circumstances, UK data-protection law may give you rights to:

These rights are not absolute and exceptions may apply.

To exercise a privacy right, contact privacy@ekaaro.health.

We may need to verify your identity before providing information or acting on a request, particularly where sensitive or health-related information is involved.

We will normally respond within the period required by applicable data-protection law, generally one month, subject to any permitted extension.

We do not normally charge a fee for exercising privacy rights, although the law permits limited exceptions.

25. Complaints to the ICO

If you have concerns about how we use your personal information, we would appreciate the opportunity to address them first. Contact privacy@ekaaro.health.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data-protection regulator.

Information about your rights and how to raise a complaint is available through the ICO.

26. Mobile health data

Where you choose to connect Apple Health or Health Connect:

Revoking platform permission stops future access in accordance with the platform’s operation but does not necessarily erase information previously received by Ekaaro.

You can request deletion of copies held by Ekaaro through our privacy and account-deletion controls, subject to applicable retention requirements.

27. Mobile app permissions

Depending on the features you choose to use, the Ekaaro app may request access to:

Ekaaro does not currently intend to request access to your:

We aim to request sensitive device permissions when they are relevant to a feature rather than requesting unnecessary access simply because the app has been installed.

You can manage device permissions through your device settings.

28. Changes to this Privacy Policy

Ekaaro will continue to develop, and our programmes, memberships, technology and providers may change.

We may update this Privacy Policy to reflect:

We will update the date at the top when this policy changes.

Where a change materially affects how we use your information, we will take appropriate steps to bring the change to your attention before the new processing begins where required.

29. Contact us

For questions, requests or concerns relating to privacy or personal information:

Ekaaro Ltd, trading as Ekaaro Health
Company number: 17364549
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Privacy email: privacy@ekaaro.health