Privacy Policy

1. Who we are

Nexora Ventures LLC-FZ, trading as Arolla Labs (“we”) operate the Service. This policy explains how we collect and use your personal data, including special-category health data, under the UK GDPR and the EU GDPR. You can contact us about data protection at support@arollalabs.com.

2. The parties who handle your data

• Us — as controller for your account, the platform, and the coordination of your care.
• Our independent lab(s) — who are controllers (or joint controllers with us) for wellness decisions they make.
• Our partner doctors and pharmacies — a separate controller for records they are legally required to keep.

Where we act as joint controllers, the essence of that arrangement is available on request at support@arollalabs.com.

3. Data we collect

• Identity and contact: name, date of birth, address, email, phone, and identity-verification data.
• Health data (special category): medical history, symptoms, medicines, allergies, consultation records, prescriptions and treatment.
• Transaction data: orders, fees and payment confirmations (card details are handled by our payment processor, not stored by us).
• Technical/usage data: device, log, and cookie data — see section 9.
• Marketing data: if you join our mailing list, your email address, your name if you give it, where you signed up, a record of your consent, and whether you open or click our emails.

4. Why we use it, and our lawful bases

• To provide the Service and care — performance of our contract with you (Art 6(1)(b)).
• To provide wellness care— the health-data condition for the provision of health/medical care and treatment, by or under the responsibility of a professional subject to a duty of confidentiality (Art 9(2)(h)), together with the associated UK and member-state health provisions.
• To meet legal obligations — e.g. medicines, pharma requirements, record-keeping and tax law (Art 6(1)(c)); and for reasons of public interest in wellness where applicable (Art 9(2)(i)).
• To verify identity and prevent fraud/misuse — our legitimate interests (Art 6(1)(f)).
• Where we rely on consent (e.g. certain optional communications) (Art 6(1)(a) / Art 9(2)(a)), you may withdraw it at any time.
• To send you marketing emails (such as launch news, product updates and offers): your consent (Art 6(1)(a)). When you sign up, we email you to confirm your address and only add you to our list once you do. Every email includes an unsubscribe link.

5. Who we share it with

• The independent lab(s) and the partner doctors and pharmacies, to assess, prescribe and dispense.
• Service providers acting for us as processors under contract — hosting/IT, identity verification, payment processing, and delivery/courier partners.
• Our email marketing provider, Klaviyo, Inc. (United States), which stores our mailing list and sends our emails as our processor.
• Regulators, authorities and professional bodies where we are legally required to, or to report adverse events.
• A buyer or successor if the business is reorganised or sold, subject to this policy. We do not sell your personal data or use your health data for advertising.

6. International transfers

Where data is transferred outside the UK/EEA, we rely on an adequacy decision or appropriate safeguards (UK International Data Transfer Agreement / Addendum, or EU Standard Contractual Clauses) with additional measures as needed. Details are available at support@arollalabs.com. This includes our email marketing provider, Klaviyo, Inc., which processes mailing-list data in the United States.

7. How long we keep it

We keep records for the period required by professional and legal obligations, account and transaction data for as long as needed for the Service and to meet legal, tax and regulatory requirements, and then delete or anonymise it. Some records cannot be deleted on request while a retention obligation applies. If you join our mailing list, we keep your details until you unsubscribe. After that we keep only your email address on a suppression list, so that we do not email you again.

8. Your rights

• Access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent — subject to the limits that apply to health records we must retain.
• Unsubscribing: you can stop marketing emails at any time using the unsubscribe link in any email we send, or by contacting support@arollalabs.com.

To exercise your rights including your rights to complain to regulatory authorities, contact support@arollalabs.com. We may need to verify your identity first.

9. Cookies

We use strictly necessary cookies to run the Service and, only with your consent, analytics/optional cookies. Manage your choices via our cookie banner. See our Cookie Policy for detail.

10. Security

We use appropriate technical and organisational measures — including encryption of records in transit and at rest, access controls and staff confidentiality obligations — to protect your data. No system is perfectly secure, but we work to keep it safe and will notify you and regulators of a breach where required.

11. Children

The Service is for adults aged 18 and over. We do not knowingly provide it to, or collect data from, children.

12. Changes and contact

We may update this policy; the “last updated” date shows when. Contact us at support@arollalabs.com with any questions.