Privacy Notice

Who we are

Leya Health ("we", "us") provides science-based educational content about PCOS/PMOS. For the personal data described in this notice, Leya Health is the data controller — we decide why and how your data is used.

What we collect and why

• Email address — to send you the newsletter and free guides you ask for, to deliver the modules you buy, and to confirm what you own when you look up your access. Legal basis: performance of our contract with you, and consent for marketing emails.
• Interest selection (for example "my period" or "insulin resistance") — to make the emails we send more relevant. Legal basis: consent.
• Purchase records — the product bought, amount, currency, order status and order reference, so we can give you access and handle refunds. Legal basis: performance of our contract, and our legal obligation to keep sales records.
• Technical data — IP address, device and browser information, and basic usage data collected by our hosting provider for security, fraud prevention and to keep the site working. Legal basis: our legitimate interest in a secure, functioning service.
• Support messages — anything you send us by email, so we can help you. Legal basis: legitimate interest.

We do not ask for, and you should not send us, clinical records or other health data about yourself. Payment card details are collected and processed by Paddle, not by us — we never see or store them.

Who we share it with

• Paddle, our Merchant of Record, for the sale of our products, payment processing, invoicing, tax compliance and refund handling.
• Service providers and subprocessors — hosting, database, email delivery and analytics providers acting on our instructions.
• Professional advisers such as accountants and lawyers, where necessary.
• Authorities, where we are required to disclose by law.

We do not sell your personal data.

International transfers

Some of our providers process data outside the UK and EEA. Where that happens, we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision.

How long we keep it

Newsletter and free-guide signups are kept until you unsubscribe or ask us to delete them. Purchase records are kept for as long as needed to provide access and to meet accounting and tax obligations (normally six years). After that, data is deleted or anonymised.

Your rights

Under UK and EU data protection law you have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, to data portability, and to withdraw consent at any time (including by unsubscribing from any email).

To exercise any of these, email hello@leya.health. We will respond within one month. You also have the right to complain to your data protection supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk).

Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls on our database, and restricting purchase records so they can only be read by trusted server-side code.

Cookies

We use only essential cookies and local browser storage needed to run the site — for example, remembering that you have dismissed the signup popup and enabling secure checkout through Paddle. We do not use advertising cookies. You can clear or block cookies in your browser settings, though parts of the site may then not work.

Contact

Questions about this notice? Contact Leya Health at hello@leya.health.