Hayso — Privacy Policy
Last updated: 19 August 2026
1. Who we are
hayso is a pre-launch product operated by Samuel Seymour Lionel Cohen, a sole trader trading as "hayso", based in the United Kingdom.
For the purposes of UK data protection law, Samuel Seymour Lionel Cohen is the data controller for the personal information described in this policy.
| Controller | Samuel Seymour Lionel Cohen, trading as hayso |
| Contact email | privacy@haysohealth.com |
If you need a postal address for a formal data protection request, email us and we will provide one.
We are at waiting-list stage. hayso is not yet available, we are not yet delivering a service to any clinic, and we do not hold information about any clinic's patients.
2. What this policy covers
This policy covers the personal information we collect through our websites at haysohealth.com, hayso.co.uk and haysohealth.co.uk (the "Site"), and through any emails we send you about the launch.
It does not cover the hayso app or clinic dashboard, which are not yet available. Before we onboard any clinic we will publish a separate, more detailed privacy notice, and we will put a written data processing agreement in place with each clinic covering patient information.
3. What we collect
Information you give us on the waiting-list form
- Your full name.
- Your work email address.
- Your phone number, if you choose to give it.
- The name of your clinic or workplace.
- Your role, if you choose to give it.
- The approximate number of patients your clinic sees who are on GLP-1 treatment.
- A record of your consent: the date and time you submitted the form, the page you submitted it from, and the exact wording you agreed to.
Most of this is business information rather than information about your private life. Because it is attached to you by name, we treat all of it as personal information and handle it accordingly.
Information we collect automatically
- Referral and campaign information — where you arrived from, including any UTM parameters in the link you clicked (for example
utm_source,utm_medium,utm_campaign). - Technical information — your IP address, browser type and device type, and the date and time of your visit. This is generated by our hosting provider as part of delivering and securing the Site.
- Analytics information, if you consent to analytics cookies — which pages you viewed and how you moved through the Site, together with a randomly generated identifier that lets us recognise a return visit. We do not use it to identify you personally and it is not linked to your waiting-list record. See our Cookie Policy for detail.
What we deliberately do not collect
We do not collect any information about patients. The patient number on our form is an approximate count for your clinic as a whole — we do not want, and you should not send us, names, records, or any other information about the people your clinic treats.
We do not collect information about your own health, and you should not send us any. If you send us health information anyway, we will delete it.
We do not knowingly collect information from anyone under 18.
4. Why we use it, and our lawful basis
| What we do | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Add you to the waiting list and contact you about the hayso launch, early access and onboarding | So we can tell you when we open in your area | Consent — Article 6(1)(a). You give this by ticking the box on the form. You can withdraw it at any time. |
| Understand the size and type of clinic you work in, using your role, clinic name and patient numbers | To plan which clinics we onboard first and in what order, and to prepare properly before we contact you | Legitimate interests — Article 6(1)(f). Our interest is in running a workable onboarding process. |
| Record which campaign or link brought you to us | To understand which of our channels reach clinics, so we don't waste money on the ones that don't | Legitimate interests — Article 6(1)(f). Low-impact, and it doesn't change what you receive from us. |
| Keep the Site available, secure, and free from spam and abuse | To stop bot submissions and protect the Site | Legitimate interests — Article 6(1)(f) |
| Keep a record of your consent | To be able to show we obtained consent properly | Legal obligation — Article 6(1)(c) |
| Measure how the Site is used | To see which pages clinics read and where they drop off | Consent — Article 6(1)(a), given through the cookie banner. Nothing runs until you accept. |
Some clinics are limited companies and some are sole traders or partnerships. Rather than treat people differently depending on how their practice happens to be structured, we ask everyone for consent before we email them, which is the stricter standard under the Privacy and Electronic Communications Regulations (PECR).
We do not use your information for automated decision-making or profiling that produces legal or similarly significant effects.
5. Who we share it with
We do not sell your information. We do not share it with advertisers, data brokers, pharmaceutical companies, or any other third party for their own marketing.
We use a small number of service providers who process personal information on our instructions:
| Provider | What they do | Where they process data |
|---|---|---|
| Supabase, Inc. | Hosts the database that stores waiting-list submissions | Ireland (EU) |
| PostHog, Inc. | Site analytics, on PostHog's EU Cloud | Frankfurt, Germany (EU) |
| Vercel, Inc. | Hosts the Site and generates server logs | Global edge network, including the USA |
| [EMAIL PROVIDER] | Sends launch emails and handles unsubscribes | [REGION] |
Each is bound by a written contract requiring them to keep your information secure and use it only for the purposes we specify.
We may also disclose information where we are legally required to, or to establish, exercise or defend legal claims.
6. Sending information outside the UK
Your waiting-list record and any analytics information are stored within the European Economic Area — in Ireland and Germany respectively. The UK government has determined that EEA countries provide an adequate level of data protection, so information can move from the UK to them without additional safeguards.
Two things do involve information leaving the UK and the EEA:
- Site hosting. Our hosting provider operates a global network and may serve pages, and hold short-term server logs, outside the UK and EEA — including in the United States.
- Provider support access. Supabase and PostHog are US-incorporated companies. Although they store our data in the EEA, their staff may access it from the United States for support and maintenance.
Where that happens we rely on the safeguards permitted by UK data protection law — the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, plus the provider's certification under the UK Extension to the EU–US Data Privacy Framework where applicable.
You can ask us for a copy of the relevant safeguards by emailing privacy@haysohealth.com.
7. How long we keep it
- Waiting-list submissions: until hayso launches and for up to 12 months after, or until you ask us to delete your record — whichever comes first. If you become a customer, a separate retention period will apply and we will tell you what it is.
- If you unsubscribe: we keep a minimal suppression record so we don't accidentally contact you again. This is kept until you ask us to remove it entirely.
- Consent records: for as long as we hold your record, plus 12 months.
- Server logs: 30 days.
If hayso does not launch, we will delete the waiting list within 3 months of deciding not to proceed.
8. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your information — that's what this policy is for.
- Access a copy of the information we hold about you.
- Rectification — have inaccurate information corrected.
- Erasure — ask us to delete your information.
- Restriction — ask us to pause using your information while a dispute is resolved.
- Object to processing based on legitimate interests.
- Data portability — receive your information in a machine-readable format.
- Withdraw consent at any time. This won't affect anything we did before you withdrew it.
To exercise any of these rights, email privacy@haysohealth.com. We will respond within one month.
To stop hearing from us, use the unsubscribe link in any email we send, or email us. This takes effect immediately.
There is no charge for exercising your rights.
9. Complaints
If you're unhappy with how we've handled your information, please tell us first at privacy@haysohealth.com — we will investigate and respond.
If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
10. Security
Waiting-list submissions are held in a database with row-level security enabled, configured so that the Site can add a submission but cannot read the table back. All connections are encrypted and the Site is served over HTTPS. Access to the stored data is limited to Samuel Seymour Lionel Cohen and [ANY DEVELOPER WITH ACCESS].
No system is completely secure, but if a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and tell you where we are required to.
11. Cookies
See our separate Cookie Policy.
12. Changes to this policy
We will update this policy as hayso develops — in particular before we onboard any clinic. The "last updated" date at the top shows when it last changed. If we make a change that materially affects how we use your information, we will email you before it takes effect.