Privacy notice

Document reference: VS-PN-001 | Version: 1.0 | Date: June 2026

1. Introduction

This is Virosense Health Ltd’s Privacy Notice for the Lubna Health application. 

Virosense Health Ltd (“we“, “us“, “our“) is the data controller for the personal data processed through the Lubna Health mobile application. Lubna Health is a personal health management platform that allows users to record health data, connect medical devices, upload health documents, and share health information with their NHS GP practice.

As part of the services we offer, we process personal data about our app users (including NHS health data), our staff, and in some instances, data about individuals received via NHS systems. We do not process personal data about the friends or relatives of our app users. “Processing” means collecting, recording, organising, storing, sharing or destroying data.

We are committed to being transparent about why we need your personal data and what we do with it. This information is set out in this privacy notice. It also explains your rights under data protection law.

If you have any concerns or questions about how we handle your data, please contact us:

    • Email: nadim@virosense.co.uk
    • Post: ViroSense Health Ltd, 36 Calthorpe Road, Edgbaston, Birmingham, B15 1TS

    • Phone: +44 121 817 2002

Data Protection Officer: We do not currently appoint a Data Protection Officer, as we do not meet the threshold for mandatory appointment under UK GDPR (we do not process special category data on a large scale). Data protection matters are overseen by our Information Security Manager, contactable at the email address above.

Important: The Lubna Health app is not a medical diagnostic tool and does not provide clinical advice. It is a personal health data management and GP-sharing platform. All clinical decisions are made by your GP or other qualified healthcare professional.

2. App Users (Patients)

What data do we collect?

To provide the Lubna Health service, we collect and process the following types of personal data when you use the app:

Account and identity data:

    • Your name, email address and phone number

    • App account preferences and settings

NHS-verified identity data (only if you connect your NHS Login account):

    • Your NHS number

    • Date of birth

    • NHS-verified name

    • Your registered GP practice details

We also collect the following data which is classified as “special category” health data under UK GDPR:

    • Health metrics from connected medical devices (e.g. blood pressure readings, blood glucose levels, heart rate, oxygen saturation (SpO2), body temperature, weight)

    • Symptom logs (free-text descriptions of symptoms, severity ratings, duration, affected body areas)

    • Daily health logs (mood scores, symptoms reported, medications taken, personal health notes)

    • Uploaded medical documents (test results, clinical letters, health reports, images)

    • Diagnostic test results (e.g COVID-19, Influenza A/B, RSV, Strep A, blood glucose, CRP, creatinine, potassium)

    • Document review history (questions and data summaries relating to uploaded health documents)

Why do we collect this data?

We need this data to provide the Lubna Health service to you. By law, we must have a lawful basis for processing your personal data.

We process your personal data because:

    • You have given us your consent to do so (UK GDPR Article 6(1)(a)). You can withdraw your consent at any time by deleting your account or contacting us.

We process your special category health data because:

    • You have given us your explicit consent to do so (UK GDPR Article 9(2)(a)). You choose what health data to record and what to share. You can withdraw this consent at any time.

    • Where you choose to share health data with your GP practice, this is for the purpose of healthcare provision (UK GDPR Article 9(2)(h), Data Protection Act 2018 Schedule 1 Part 1(2)).

We also satisfy the common law duty of confidentiality in our handling of health information because you have provided explicit consent to each data processing activity within the app, and because data is only shared with your GP practice when you explicitly initiate that sharing action.

Automated decision-making: Lubna Health does not use automated decision-making or profiling that produces legal or similarly significant effects on you. The app presents your data factually; it does not generate clinical recommendations or decisions. All clinical decisions are made by your GP or other qualified healthcare professional.

Where does your data come from and where does it go?

Your data is collected from and shared with the following:

Sources of data:

    • You directly, via the Lubna Health app (manual entry, symptom logs, daily logs, document uploads)

    • NHS Login, which provides your NHS-verified identity data when you connect your NHS account

    • Third-party medical device manufacturers (e.g. Omron, Withings, Fitbit, Garmin, Dexcom, Abbott, iHealth, Beurer, Polar, Samsung Health, Apple Health, Google Fit), when you authorise a device connection via their OAuth systems

    • ViroSense devices, via its API

We communicate with you via the Lubna Health mobile application, text and via email.

Who we share your data with:

    • Your NHS GP practice – only when you explicitly choose to send a health summary or report. This is transmitted via the NHS GP Connect Send Document API (FHIR R4). We never send data to your GP without your instruction for each individual send.

    • Third-party device manufacturers – your device OAuth tokens are held securely so that we can retrieve readings from their APIs on your behalf. We do not share your Virosense health record data with device manufacturers.

    • NHS systems – we access NHS APIs (NHS Personal Demographics Service, NHS National Record Locator) to verify identity and locate NHS records with your consent. We do not share data from these systems beyond what is needed to operate the service.

    • Law enforcement agencies – only if we are required to do so by law or court order.

We do not sell your personal data. We do not share your health data with advertisers, insurance companies, or any other commercial third parties.

International transfers: Some third-party device manufacturers may process data on servers located outside the UK or EEA as part of their own services, governed by their own privacy terms. Virosense Health Ltd does not transfer any data it holds outside the UK or EEA.

3. National Data Opt-Out

We review our data processing on an annual basis to assess whether the National Data Opt-Out applies. This is recorded in our Record of Processing Activities.

At this time, we do not share any confidential patient information for planning or research purposes for which the National Data Opt-Out would apply. All health data we hold is used solely for the purpose of providing the Lubna Health service to individual users and, where users choose, sharing summaries with their own GP.

We review all confidential patient information we process on an annual basis. If in future any processing falls within the scope of the National Data Opt-Out, we will update this notice and comply with the opt-out requirements. You can find out more at www.nhs.uk/your-nhs-data-matters.

4. Staff

What staff data do we hold?

To operate as an employer and provide a safe professional service, we keep the following records about our staff:

    • Basic details and contact information (name, address, date of birth, National Insurance number, next of kin)

    • Financial details needed to pay you (bank details, tax information, pension details)

    • Training records and competency records relevant to your role

    • Right to work documentation

We also record the following special category data about staff where necessary:

    • Health data where needed to process sick pay, maternity/paternity pay, or to make reasonable workplace adjustments

Why do we hold staff data?

We require this data to contact you, pay you, and ensure you receive the training and support needed to perform your role.

We process staff personal data because:

    • We have a legal obligation under UK employment law

    • It is necessary for the performance of your employment contract

We process special category staff data because it is necessary to process requests for sick pay or maternity/paternity pay.

Where do we process staff data?

Staff data is collected from you directly. We share it with:

    • HM Revenue and Customs (HMRC)

    • Our pension provider

    • Our payroll provider (where applicable)

    • The police or law enforcement agencies if required by law or court order

5. How do we store your personal information?

All personal data held by Virosense Health Ltd is stored digitally. We do not hold paper records containing personal health data.

App user health data is stored in:

    • The Lubna Health mobile app on your own device (local encrypted storage)

    • Our secure cloud backend infrastructure, encrypted at rest and in transit using TLS 1.2 or higher

NHS authentication tokens are stored in your device’s secure storage only and are never stored in our servers or application code.

Device OAuth tokens are stored in encrypted form in our secure cloud backend.

We retain personal data for the following periods:

Data type Retention period Disposal method
App user health data (metrics, logs, documents, test results) Retained for the lifetime of your account. Deleted within 30 days of account deletion request. Secure deletion from cloud storage
NHS authentication tokens Session only – deleted on logout Automatic deletion on logout
Device OAuth tokens Retained while device is connected. Revoked and deleted within 30 days of disconnection. OAuth token revocation and secure deletion
GP transmission logs 12 months from date of transmission Secure deletion
User account data (name, email) Duration of account. Deleted within 30 days of account deletion request. Secure deletion from cloud storage
Staff employment records In line with HMRC requirements (generally 6 years after employment ends) Secure digital deletion

These retention periods are in line with the NHS Records Management Code of Practice where applicable.

Our website

Our website at virosense.co.uk processes limited personal data including IP addresses of visitors. We use cookies on our website. Full details are set out in our Cookie Policy available at virosense.co.uk/cookies. If you contact us via our website contact form, we process your name and email address to respond to your enquiry.

6. Your Rights

The data we hold about you is your data. You have the following rights under UK data protection law:

    1. Right of access: You can request a copy of all personal data we hold about you. We will not charge for this and will respond within one month.

    1. Right to rectification: You can ask us to correct any data you believe to be inaccurate or incomplete. You can also ask us to restrict processing while we consider your request.

    1. Right to erasure: You can ask us to delete personal data which is no longer necessary for the purpose we collected it for, or where you withdraw your consent. You can delete your account at any time from within the app, which will trigger deletion of all your health data within 30 days.

    1. Right to restrict processing: You can ask us to restrict processing of your data while a deletion or correction request is considered.

    1. Right to withdraw consent: Because we process your data on the basis of consent, you can withdraw your consent at any time. You can do this by adjusting your settings in the app, disconnecting devices, or by deleting your account. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal.

    1. Right to data portability: You can request a copy of your health data in a structured, machine-readable format.

    1. Right to object: Where we process your data based on legitimate interests, you have the right to object. We will restrict processing while we consider your objection.

To exercise any of these rights, please contact us at nadim@virosense.co.uk. We may ask you to provide proof of identity before responding to ensure data is not shared with the wrong person.

We will always respond within one month of receiving your request.

If you are unhappy with how we have handled your request, you have the right to complain to the Information Commissioner’s Office (ICO):

    • Website: ico.org.uk

    • Phone: 0303 123 1113

    • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

7. Changes to this Privacy Notice

We review and update this privacy notice at least once every 12 months, or whenever there is a significant change to how we process personal data. When we make changes, we will update the version number and date on this document and notify app users via the app where the change is material.

The latest version of this privacy notice is always available at virosense.co.uk/privacy and within the Lubna Health app settings.