Company number: 17011323
Essex — Based at 116 High Road, Epping, CM16 4AF we offer in-clinic and mobile treatments across Essex...We bring our wellness services to clients
Privacy policy
Last updated: 8 October 2026
This policy explains how Boost & Glow collects, uses and protects your personal information, including the health information we handle for blood tests, treatments, consultations and our Boost & Glow Pulse service. We are committed to handling your information in line with UK data protection law (the UK GDPR and the Data Protection Act 2018).
1. Who we are
Boost & Glow is operated by Boost and Glow Ltd (company number 17011323). We are the "data controller" for the information described in this policy.
- Address: 116 High Road, Epping, CM16 4AF
- Email: sam@boostandglow.co.uk
- ICO registration number: C2051032
2. The information we collect
- Contact and account details: name, email address, phone number, delivery and billing address, date of birth.
- Order and payment details: products and services you buy. Card payments are processed by our payment providers, and we do not store your full card number.
- Health information: medical history and symptoms you share with us, consultation notes, blood and other test results, and treatment records.
- Boost & Glow Pulse data: if you join Pulse, wearable data from your WHOOP device: recovery score, heart rate variability (HRV), resting heart rate and sleep information. You share it by connecting your WHOOP account, or, if you prefer, by sending screenshots. When you connect, we also hold the secure connection details (access tokens) WHOOP gives us, and the email address you enter on the connect page, and the date you gave consent. We also hold the summaries and trend checks we produce from your data.
- Communications: messages you send us by email, WhatsApp, phone or social media, and your marketing preferences.
- Website data: device and browser information, pages visited and cookie data (see section 9).
3. How we get your information
Most information comes directly from you: when you book, buy, fill in a form, speak to a clinician or message us. We also receive test results from the laboratories that process your samples. For Pulse, you choose what to share and how: by approving a connection to your WHOOP account, or by sending screenshots. When you connect, we receive your data directly from WHOOP, only the types you approve on WHOOP's own consent page. When you buy Pulse, your order confirmation email includes a link to the connect page.
4. Why we use your information and our legal basis
| What we do | Legal basis |
|---|---|
| Provide tests, treatments and consultations, and keep clinical records | Contract; and, for health information, provision of health care by or under a health professional's responsibility |
| Take and fulfil orders, process payments, send order updates (including the Pulse connect link in your order confirmation) | Contract |
| Provide the Pulse service, including collecting your WHOOP data, reviewing it against your results and contacting you about changes | Your explicit consent |
| Send marketing emails or messages | Your consent, or our legitimate interest in keeping existing customers informed, with a clear way to opt out |
| Keep records, prevent fraud and meet legal, tax and professional obligations | Legal obligation; legitimate interests |
| Improve our website and services | Legitimate interests; consent for non-essential cookies |
5. Boost & Glow Pulse and wearable data
Pulse is an optional monitoring and early-warning service. It does not diagnose conditions or replace your GP, and wearable readings are estimates.
- Explicit consent. Health and wearable data is special category data. We only use it for Pulse with your explicit consent, which you give by ticking the consent box on our connect page before anything is collected.
- How the connection works. When you connect, you are sent to WHOOP's own page to approve access. We then receive secure access tokens, which we store encrypted. Each day our system uses them to collect your latest recovery, HRV, resting heart rate and sleep data from WHOOP.
- What we ask for. Only the data needed for Pulse: recovery, HRV, resting heart rate and sleep (the WHOOP permissions read:recovery, read:sleep and read:cycles). We do not ask for your workouts, profile, body measurements or any other data.
- What we use it for. To compare your recent trends against your own baseline and bloodwork, to contact you about changes worth checking, and to suggest relevant tests or treatments. We do not use it for any other purpose. Our system runs automated checks on your trends and sends a summary to our team each week. A member of our team reviews it before anyone contacts you, and no decision about you is made solely by automated means.
- What we do not do. We do not sell your wearable data, use it for advertising, or use it to train artificial intelligence models.
- Your control. You can stop at any time. You can disconnect us in your WHOOP account settings, or email us to withdraw consent. If you withdraw, we stop collecting your data, revoke our access and delete your data as set out in section 8.
6. Who we share your information with
We only share what is needed, and only with organisations that help us provide our services:
- Laboratories that analyse your samples
- Our clinicians and, where you ask us to, your GP or another health professional
- Our website, payment, email and messaging providers, such as Shopify and our email marketing platform
- For Pulse, our technical providers: Cloudflare, which hosts the connection and stores the encrypted data (we choose EU storage), and our email delivery provider, which sends our internal review messages (the provider is Resend)
- Our professional advisers, insurers and regulators, where required
- WHOOP, only as the source of the data you choose to share with us
These providers act on our instructions or under their own data protection duties. We do not sell your personal information.
7. Transfers outside the UK
Some of our providers store or process data outside the UK. Where they do, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an approved adequacy arrangement.
8. How long we keep your information
- Clinical and treatment records: 8 years after your last treatment, in line with professional record-keeping guidance, unless the law requires longer.
- Pulse wearable data and screenshots: we keep a rolling window of your most recent readings (about 60 days) while you use Pulse. Your connection details and data are deleted within 90 days after you leave or withdraw consent, and sooner if you ask.
- Order and accounting records: 6 years for tax and accounting purposes.
- Marketing preferences: until you unsubscribe.
9. Cookies
Our website uses essential cookies to work, and with your consent, analytics and marketing cookies. You can change your choices through the cookie banner or your browser settings.
10. Keeping your information secure
We use access controls, secure storage and encryption where appropriate, and we limit who can see your health and wearable data to those who need it. Your WHOOP access tokens are encrypted when stored. No system is completely secure, and we will tell you and the Information Commissioner's Office if a breach is likely to put you at risk.
11. Your rights
You have the right to:
- be told how we use your information and ask for a copy of it
- ask us to correct information that is wrong
- ask us to delete your information, in some circumstances
- ask us to restrict or stop our use of it, in some circumstances
- ask for your information in a portable format, where it applies
- withdraw your consent at any time, without affecting what we did before
- object to marketing at any time
To use any of these rights, email sam@boostandglow.co.uk. We aim to reply within one month. Some clinical records must be kept for legal reasons, and we will explain if that applies.
12. Complaints
If you are unhappy with how we have handled your information, please contact us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
13. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change to how we use your health information, we will tell you directly.