The 360Me App Privacy Policy

DocMe Technologies Ltd (trading as 360Me) is committed to protecting your personal data and being transparent about how we use it. This Privacy Policy explains what data we collect, why we collect it, how we use and share it, and what rights you have under applicable data protection law.

Please read this policy carefully. By using the 360Me website (the360.me), the 360Me iOS app, or any associated services, you acknowledge that you have read and understood this policy.

1. Who We Are

360Me is operated by DocMe Technologies Ltd, a company registered in England and Wales.

• Company Number: 13475088
• Registered Office: Salisbury House, Station Road, Cambridge, CB1 2LA, United Kingdom
• UK VAT Registration: GB399070263
• Data Protection Registration: ZB197766
• General enquiries: hello@the360.me
• Data Protection Officer / privacy requests: DPO@the360.me

DocMe Technologies Ltd is the Data Controller for personal data processed through the 360Me website and app.

2. Scope of This Policy

This Privacy Policy applies to all personal data we process when you:

• Visit or use the 360Me website (the360.me)
• Download, install, or use the 360Me iOS application
• Enrol in a 360Me programme (e.g., Reset, Evolve)
• Interact with our coaching or nutritionist services
• Contact us by any means

It does not apply to third-party websites, services, or apps that may be linked from our platforms. Those services are governed by their own privacy policies.

3. Data We Collect

3.1. Account and Identity Information

When you register or purchase a programme, we collect:

• Full name and email address
• Password (stored in hashed form; never in plain text)
• Demographic information (e.g., age, biological sex) used to personalise your programme
• Payment and billing details (processed by our third-party payment provider; we do not store full card numbers)

3.2. Health, Wellness, and Programme Data

To deliver your programme and personalised recommendations, we collect:

• Health goals, dietary preferences, food intolerances, and restrictions
• Self-reported data including energy levels, sleep quality, digestion, mood, and stress
• Meal logs, food photographs, and nutritional data submitted via the Snap&Go meal analysis feature
• Fitness activity data including workout logs, movement assessments, and Zone 2 training records
• Body composition metrics (e.g., weight, BMI, body fat %) synced from your Withings smart scale
• Programme progress data including your 360Me programme score and BioAge estimate
• Pre- and post-programme questionnaire responses
• Notes from nutritionist and coaching sessions

3.3. Biomarker and Laboratory Data

If you complete a blood biomarker test as part of your programme:

• We collect the sample dispatch and return logistics information
• Biomarker test results (e.g., blood panel values) are returned to us by our accredited lab partner (Thriva Limited) to display within your app dashboard
• We act as independent data controller alongside Thriva for this data; see Section 7 for full details
• We collect and retain a record of the consent you provided to enable this processing

3.4. Device and Integration Data

If you connect third-party devices or services, we may receive:

• Apple Health / HealthKit: step counts, heart rate, active energy, sleep data, and other metrics you authorise. We do not use HealthKit-sourced data for advertising or marketing, and we do not sell it.
• Withings smart scale: body weight, BMI, body fat percentage, and body composition metrics
• Oura Ring: sleep scores, readiness scores, activity data, and heart rate variability
• Other connected services you authorise: data types and scope depend on your permissions and the service’s own policies

You can revoke any integration at any time via your device or app settings. Some features will cease to function without these connections.

3.5. Usage and Technical Data

We automatically collect:

• IP address, device type, operating system version, and app version
• Session data including features used, screens visited, and interaction timestamps
• Crash and error reports to help us identify and fix technical issues

3.6. Communications

If you contact us via email, in-app messaging, or any other channel, we retain the content of those communications and any associated contact information.

4. How We Use Your Data

4.1. Delivering and Personalising Your Programme

• Enrol you in and manage your chosen programme (Reset, Evolve, or future programmes)
• Calculate your BioAge estimate and 360Me programme score based on biomarker results, body composition, lifestyle data, and programme adherence
• Generate personalised meal plans, nutrition guidance, and fitness recommendations
• Facilitate nutritionist and coaching sessions
• Display your biomarker results and track changes over the programme duration

4.2. Snap&Go Meal Analysis

• Process food photographs you submit to identify meals, estimate macronutrient content, and suggest food swaps. Image analysis is probabilistic; we recommend verifying allergen and ingredient information independently.

4.3. Programme Management and Communications

• Manage your account, purchase records, and programme access
• Send transactional communications (e.g., confirmation emails, kit dispatch notifications, session reminders)
• Send programme-related notifications and updates
• Respond to support enquiries

4.4. Safety, Compliance, and Legal Obligations

• Monitor for and prevent fraudulent, harmful, or unlawful activity
• Enforce our EULA and Terms and Conditions
• Comply with legal obligations, court orders, or regulatory requirements
• Respond to lawful requests from authorities

4.5. Service Improvement and Research

• Conduct internal research, analytics, and testing to improve our programmes, algorithms, and platform
• Create aggregated or de-identified datasets for product development. We will only use identifiable data for model training or improvement where required by law or where you have opted in within the app.

5. Legal Basis for Processing

We process your personal data under the following legal bases under UK GDPR:

For any processing based on consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Special Category Health Data

Biomarker results, body composition data, health questionnaire responses, and similar information constitute special category data under UK GDPR (Article 9). We process this data only:

• On the basis of your explicit consent, obtained in-app before processing begins
• Where necessary for the performance of our services under our contract with you
• In accordance with our obligations under the Data Protection Act 2018

You may withdraw consent at any time by contacting DPO@the360.me. Withdrawal may prevent us from completing or continuing certain programme services.

7. Data Sharing

We do not sell your personal data. We do not share it for advertising purposes.

7.1. Service Providers (Processors)

We share data with trusted third-party providers who process data on our behalf under contractual data processing agreements, including providers of:

• Cloud hosting and storage
• Payment processing
• Analytics and crash reporting
• Communications and notifications (e.g., email, push)
• Delivery and logistics (for kit and scale dispatch)

7.2. Thriva Limited — Independent Data Controller

For blood biomarker testing, we collaborate with Thriva Limited (White Collar Factory, 1 Old Street Yard, London EC1Y 8AF). 360Me and Thriva act as independent data controllers, sharing personal data on a controller-to-controller basis solely to perform the testing service and deliver results to you.

• Thriva processes your special-category health data under UK GDPR Article 9(2)(h) and the common law duty of confidence, overseen by a designated health professional
• Any laboratories engaged by Thriva may also act as independent controllers for official test records
• We provide a link to Thriva’s current privacy notice in-app and at checkout
• We retain a timestamped record of the consent you provided to enable this arrangement

7.3. Nutritionists and Coaches

BANT-registered nutritionists and qualified fitness coaches who deliver your programme sessions will have access to relevant programme data (e.g., your goals, questionnaire responses, and progress metrics) to provide personalised guidance. These professionals are bound by confidentiality obligations.

7.4. Legal Disclosure

We may disclose personal data to government or law enforcement agencies where required by law, court order, or to protect our rights or the safety of others.

7.5. Business Transfers

In the event of a merger, acquisition, or asset sale, personal data may be transferred to the successor entity. We will ensure appropriate data protection safeguards remain in place and will notify you of any material change in controller.

8. Third-Party Integrations

8.1. Apple Health / HealthKit

If you grant permission, we access HealthKit data to enrich your programme tracking (e.g., step counts, heart rate, sleep). In accordance with Apple’s guidelines and our own policy:

• We do not use HealthKit-sourced data for advertising, marketing, or sale to third parties
• We do not share HealthKit data with any third party without your explicit authorisation
• You can revoke access at any time via iOS Settings → Privacy & Security → Health

8.2. Withings

Your Withings smart scale transmits body composition data (weight, BMI, body fat %) to our platform. This data is used solely for programme tracking and scoring.

8.3. Oura Ring

If connected, your Oura Ring provides sleep, readiness, and activity data used to support your programme insights and coaching recommendations.

8.4. Food Delivery Partners

Where the programme includes curated food delivery (e.g., Field Doctor), we share the minimum information necessary (name, delivery address, dietary preferences) with the delivery partner to fulfil your order. Their data practices are governed by their own privacy policies.

8.5. Revoking Integrations

You can disconnect any third-party integration at any time via app Settings or your device settings. Disconnecting may limit certain programme features.

9. International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom and European Economic Area. Where we transfer data outside the UK to countries that do not provide equivalent levels of data protection, we use appropriate safeguards such as:

• UK International Data Transfer Agreements (IDTAs)
• Standard Contractual Clauses (SCCs) approved by the ICO
• Transfers to countries with UK adequacy decisions

For details of specific transfer safeguards, contact DPO@the360.me.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law.

When data is no longer required, we securely delete or irreversibly anonymise it.

11. Security

We implement commercially reasonable and appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These include encryption in transit and at rest, access controls, and regular security reviews.

No system is entirely secure. You are responsible for maintaining the confidentiality of your login credentials and the security of your devices. If you suspect unauthorised access to your account, contact us at DPO@the360.me immediately.

12. Cookies and Tracking

Our website (the360.me) uses cookies and similar technologies to:

• Remember your preferences and session state
• Gather anonymised usage analytics to improve the site
• Support security and fraud prevention

You can manage cookie preferences through your browser settings or our cookie consent tool on the site. Note that disabling certain cookies may affect site functionality.

We do not use advertising cookies or serve targeted ads on our platform.

13. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

To exercise any of these rights, contact us at DPO@the360.me. We will respond within 30 days in accordance with UK GDPR. We may ask you to verify your identity before processing your request.

Account and data deletion:

You can request deletion of your account and associated personal data at any time via the in-app deletion flow or by emailing DPO@the360.me. We will retain data we are legally obligated to keep (e.g., consent records, financial records) for the periods listed in Section 10.

14. Age Restriction

The 360Me platform and all associated services are intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us at DPO@the360.me and we will delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, services, or applicable law. Where changes are material, we will notify you via the app, by email, or by prominent notice on the site. The date at the top of this page always reflects when the policy was last revised.

Your continued use of the Services after notification of a material change constitutes acceptance of the updated policy.

16. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or your personal data:

DocMe Technologies Ltd

Salisbury House, Station Road, Cambridge, CB1 2LA, United Kingdom

General: hello@the360.me

Data Protection Officer: DPO@the360.me

VAT Reg: GB399070263 | Data Protection Reg: ZB197766

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

By using the 360Me website or app, you acknowledge that you have read and understood this Privacy Policy and agree to the collection, use, and disclosure of your data as described.