How we use your information
Last updated: [date of publication]
Who we are
Codenutri Limited runs epinutri.com, the ēpi app and getepi.app. We are the controller of your personal information. Company number 17062603. Address: 14 Balmoral Road, Liverpool L6 8NE. ICO registration number: [ICO registration number]. Contact us about your data at support@epinutri.com. We have not appointed a Data Protection Officer because the law does not require one for us; our director, Chris Massamba, is responsible for data protection.
What we collect
- Your account details: name, email address, phone number if you give it.
- Health information you choose to give us: your health profile, daily check-ins, symptoms, questionnaire answers, goals, supplements and medicines, and what you write to ēpi.
- Data from a wearable device, only if you connect one and agree.
- Notes and plans written by a practitioner you work with on EPINUTRI.
- Payment and order details when you buy a consultation or product. Stripe holds your card details; we never see them.
- Technical data: IP address, device and browser type, and sign-in times, used to keep the service secure.
Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Run your account and the services you sign up for | Our contract with you |
| Use your health information to provide ēpi and share it with your chosen practitioner | Your explicit consent, given separately for each purpose. You can withdraw it at any time in the app or by emailing us |
| Act on a safety concern, such as signs you may be at risk of harm | Protecting your vital interests |
| Keep financial records | Legal obligation (tax law) |
| Keep the service secure and fix faults | Our legitimate interests |
| Send you service updates about EPINUTRI | Our legitimate interests; you can opt out in every email |
| Use your data in research or to evaluate the service | Your consent, asked for separately. Saying no does not affect your care |
About ēpi and AI
ēpi's replies are written by an AI model run by Google in London. ēpi gives general wellness information, not a diagnosis or treatment, and does not make decisions about you that have a legal or similarly significant effect. If you describe an emergency, ēpi will direct you to 999 or NHS 111. Your conversations are not used to train Google's models.
Transfers outside the UK
Your health information is stored and processed in London. Your sign-in details, service emails and technical logs are handled in the United States. These transfers are protected by the UK Extension to the EU-US Data Privacy Framework or by the UK International Data Transfer Addendum.
How long we keep it
Until you delete your account, then we erase it within 30 days. Some records are kept longer because the law or your safety requires it: financial records for 6 years, records of consent and safety events for 8 years, and security logs for 6 years. Backups are overwritten within 90 days.
Your rights
You can ask to see your data, correct it, delete it, restrict or object to how we use it, and receive a copy in a standard format to take elsewhere. You can withdraw consent at any time without affecting what we did before. Email support@epinutri.com. We reply within one month; if we need more information from you to find your data, that month starts when we receive it.
Complaints
If you are unhappy with how we handle your data, tell us first at support@epinutri.com. We will acknowledge your complaint within 30 days, investigate it, keep you updated and tell you the outcome. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Age
EPINUTRI and ēpi are for adults aged 18 and over.
Changes
We will tell you by email or in the app before any change that affects how we use your health information.