Talo Privacy Policy
Last updated: 20th February 2026
We are committed to making healthcare more accessible. Through our website https://jointalo.com (our "Site"), we provide people with easy access to clinical consultations and treatment options to help them make informed and proactive decisions about their health.
We understand that lengthy legal documents are no fun. However, we ask that you read this Privacy Policy ("Policy") carefully as it contains important information, including who we are, how and why we collect, store, use, and share personal information, your rights in relation to your personal information, and how to contact us or the supervisory authority in the event you have a complaint.
1. What does this privacy policy cover?
This Policy covers any personal information we might collect from you or which we have obtained about you from a third party:
- When you use our Site
- When you register an account with us
- When you use our consultation service or order products through our Site
- When you interact with our social media channels
- When you provide feedback, take part in market research or provide customer testimonials
- Where you have requested to receive information about our products and services
Our Site, products, and services are not intended for individuals under the age of 18, and we do not knowingly collect data relating to children.
If you do not agree with the contents of this Policy, you should not sign up for an account, use our consultation service, or otherwise submit information to us.
2. Who collects information about you?
This Privacy Policy applies to Talo Health Ltd acting as a Controller of your personal data.
When we refer to "we," "our," "us," or "the Company" in this Policy, we mean Talo Health Ltd (company number SC848462), with our registered office at 17 Fieldhead Square, Glasgow, Scotland, G43 1HL.
For details of how to get in touch, please see the "Contact Us" section of this Policy.
3. Useful terms
In this Privacy Policy:
- "Customer" means individuals who register an account on the Site who may or may not use our consultation service or order products.
- "Website Visitors" means individuals who visit our Site. Website Visitors may include Customers.
- "Personal information" or "personal data" means any information about an individual from which that person can be directly or indirectly identified. It does not include data where the identity has been removed (i.e., anonymous data).
4. What personal information do we collect?
We may collect, use, store, and transfer different kinds of personal information about you which we have grouped together as follows:
| Data Type | Description |
|---|---|
| Identity Data | First name, last name, username, password, date of birth, user or device identifiers. |
| Contact Data | Email address, home address, telephone number. |
| Financial Data | Credit card and/or billing information, bank details for payment. |
| Transaction Data | Information about payments and orders, may include Health Data. |
| Technical Data | Internet protocol (IP) address, browser type and version, time zone setting and location, referral sources, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Site. |
| Usage Data | Information about how you use our Site and social media channels. |
| Assessment Data | Information provided in response to consultations. May include Health Data. |
| Feedback Data | Feedback from user testing or market research, may include Health Data. |
| Marketing and Communications Data | Preferences in receiving marketing or other communications. |
| Health Data | Information about current health or medical history. |
5. How will we use your personal information?
Below is how we use your personal information and the legal basis we rely on to do so:
5.1 Customers
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Manage and administer your account | Identity Data, Contact Data, Technical Data, Usage Data, Transaction Data, Assessment Data, Marketing and Communications Data | Contract performance |
| Assess suitability for supply under PGD | Identity Data, Contact Data, Assessment Data, Health Data | Necessary for healthcare purposes under health professional responsibility |
| Process and fulfil orders | Identity Data, Contact Data, Transaction Data, Financial Data, Health Data | Contract performance / Necessary for healthcare purposes under health professional responsibility |
| Conduct consultations | Identity Data, Contact Data, Assessment Data | Contract performance |
| Share consultation data with Eastwood Pharmacy for clinical review and supply | Identity Data, Contact Data, Assessment Data, Health Data | Necessary for healthcare purposes under health professional responsibility |
| Support and enhancement of healthcare services using AI | Health Data, Assessment Data | Necessary for healthcare purposes under health professional responsibility |
| Service Messages | Contact Data | Legitimate Interests |
| Customer service and support | Identity Data, Contact Data, Transaction Data, Financial Data, Assessment Data | Legitimate interests |
| Technical support | Identity Data, Contact Data, Transaction Data, Assessment Data, Usage Data, Technical Data | Legitimate interests |
| Business operations | Identity Data, Contact Data, Transaction Data, Assessment Data, Feedback Data | Legitimate interests |
| Legal or regulatory compliance | Various | Legal obligation |
| Market research/user testing | Identity Data, Contact Data, Transaction Data, Feedback Data | Consent |
| Marketing communications | Contact Data, Marketing and Communications Data | Consent |
5.2 Website Visitors
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Deliver relevant content | Technical Data, Usage Data | Legitimate interests |
| Measure content effectiveness | Technical Data, Usage Data | Legitimate interests |
| Improve Site and user experience | Technical Data, Usage Data | Legitimate interests |
| Administer and protect the Site | Technical Data, Usage Data | Legitimate interests |
| Assess treatment suitability | Identity Data, Assessment Data | Contractual Performance |
| Respond to contact messages | Identity Data, Contact Data | Legitimate interests |
5.3 Social Media Users
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Analyse engagement | Usage Data, Technical Data | Legitimate interests |
| Communicate with users | Contact Data, Message content | Legitimate interests |
| Marketing communications | Identity Data, Contact Data, Marketing and Communications Data | Consent |
6. How do we collect personal information about you?
We may collect information from the following sources:
1. Directly from you
This is the information you (or an individual with authority to act on your behalf) has provided to us for the purposes set out in this Policy. It includes any information you provide to us when completing a clinical consultation, and when you interact with us by phone, email, web form or otherwise.
2. Automatically (Technical and Usage Data)
When you visit our Site, we collect certain Technical and Usage Data automatically from your device.
7. Who do we share your personal information with?
We may share your personal information with the following categories of third parties:
| Category | Description |
|---|---|
| Eastwood Pharmacy (GPhC registration: 9010213) (supplying pharmacy) | Your consultation data, including Health Data and Assessment Data, is shared with Eastwood Pharmacy so that their authorised healthcare professional can review your clinical suitability and make a decision on whether to supply medication under the Patient Group Direction (PGD). Eastwood Pharmacy also arranges delivery. Eastwood Pharmacy is a GPhC-registered pharmacy and is bound by professional and regulatory obligations of confidentiality. |
| Service providers | Our service providers are required to keep your personal information strictly confidential and are not allowed to use it for any other purpose than to carry out the services they are performing for us. These include: payment processors, technology platform providers, and delivery partners. |
| Professional advisors | We may disclose personal information to our professional advisers, such as lawyers, auditors, accountants, and insurers, if necessary, as part of the professional services they are performing. |
| Business transfers | When we acquire businesses or merge with them there is a possibility that we may share personal information with these companies as part of that process. In any event you will be informed if this happens and if it applies to you. |
| Legal compliance | We may very occasionally be required to disclose some personal information as required to comply with the law. |
8. Security and international data transfers
8.1 Security
We work to safeguard the security and integrity of our Site and the systems we use to process your personal data. We have implemented appropriate technical and organisational measures to prevent personal information being accidentally lost or used or accessed in an unauthorised or unlawful way. However, it is generally understood that no method of electronic storage or transmission online is 100% secure. As a result, whilst we have implemented appropriate technical and organisational measures, we cannot guarantee the absolute security of your personal data, or accept responsibility for any unauthorised access or loss of personal data that is beyond our control.
We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.
We also have procedures in place to deal with any suspected data security breach. We will notify you promptly in the event of any breach of your personal data which might expose you to serious risk.
8.2 International data transfers
Where personal information is shared and disclosed as set out above, these parties may be established outside the United Kingdom. For example, some of the service providers we use to support our services may be based outside the UK, and this may involve a transfer of your personal information internationally.
Whenever we transfer your personal information outside the United Kingdom, we ensure that a similar degree of protection is afforded to it by ensuring appropriate safeguards are implemented. This may include, where appropriate, relying on an adequacy decision or Standard Contractual Clauses.
To find out more information regarding the specific mechanism used by us when transferring your personal information outside the United Kingdom, please contact us at support@jointalo.com.
9. Our use of cookies and similar technologies
We may use cookies and other information gathering technologies to learn more about how you interact with our Website. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our Site may become inaccessible or not function properly.
Cookies we use:
- Essential cookies: Required for the Site to function properly
- Analytics cookies: Help us understand how visitors interact with our Site
- Marketing cookies: Used to deliver relevant advertisements
You can manage your cookie preferences at any time through your browser settings or by contacting us at support@jointalo.com.
10. Our use of artificial intelligence
We may use artificial intelligence (AI) and large language models (LLMs) to support and enhance our healthcare services. This technology helps us provide better care, improve efficiency, and personalise your experience.
10.1 How we use AI
We may use AI for the following purposes:
- Clinical support: To assist healthcare professionals in reviewing medical information and identifying relevant treatment options. All clinical decisions on whether to supply medication remain the responsibility of the authorised healthcare professional at Eastwood Pharmacy.
- Customer support: To provide initial responses to common queries and direct you to appropriate resources or human support.
- Service improvement: To analyse anonymised data to improve our services, identify trends, and enhance patient care.
- Administrative efficiency: To streamline administrative processes such as order management.
10.2 Human oversight
All AI-assisted clinical processes are subject to review and approval by the authorised healthcare professional at Eastwood Pharmacy. AI is used as a support tool only and does not replace professional clinical judgement. The authorised healthcare professional remains individually accountable for all supply decisions.
10.3 Data used for AI
When we use AI to support healthcare services, we may process Health Data and Assessment Data. This processing is necessary for healthcare purposes under health professional responsibility. We ensure that:
- AI systems are designed with appropriate safeguards to protect your privacy
- Your data is processed securely and in accordance with this Policy
- AI outputs are validated by qualified healthcare professionals
- You can opt-out of AI-assisted services by contacting us at support@jointalo.com
10.4 Training AI models
We may use anonymised and aggregated data to train and improve our AI models. This helps us enhance the quality and accuracy of our services. When data is anonymised, it no longer identifies you personally and is not subject to data protection law. We do not use identifiable personal data to train AI models without your explicit consent.
11. Third-party links and services
This Website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy notices.
When you leave our website, we encourage you to read the privacy notice of every website you visit.
12. How long will we keep your personal information?
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information, and whether we can achieve those purposes through other means, and the applicable legal requirements.
In general:
- Medical records: Retained for 10 years in accordance with regulatory requirements
- Financial records: Retained for 7 years for tax and accounting purposes
- Marketing data: Retained until you withdraw consent
- Account data: Retained while your account is active, then for 30 days after closure
13. Marketing
If you receive marketing communications from us, you can ask us to stop sending you marketing messages at any time by following the unsubscribe links in any marketing message or by contacting us at support@jointalo.com.
Please note that opting out of marketing communications does not opt you out of receiving important service-related communications.
14. Your rights
Subject to any exemptions provided by law, you may have the right to:
- Request access to your personal information (commonly known as a "data subject access request") and to certain other supplementary information that this Policy is already designed to address.
- Request correction of the personal information we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information in certain circumstances. However, given the nature of our products and services, it will not always be possible for us to delete your data upon request as there may be valid legal reasons for us to continue processing it (for example, the need to retain medical records to comply with legal requirements). You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
- Request data portability: Receive the personal information concerning you which you have provided to us in a structured, commonly used, and machine-readable format and have the right to transmit those data to a third party in certain situations.
- Object to processing of your personal information at any time for direct marketing purposes.
- Object to decisions being taken by automated means which produce legal effects concerning you or significantly affect you.
- Object in certain other situations to our continued processing of your personal information.
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Withdraw your consent to our processing of your personal information, where we have collected and processed it with your consent.
For more information, please refer to the appropriate data protection legislation or consult the Information Commissioner's Office for guidance. If you would like to exercise any of these rights, please contact us at support@jointalo.com and let us have enough information to identify you.
We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
15. Contact us
Please address requests and questions about this Policy to:
Email: support@jointalo.com
Post: Talo Health Ltd, 17 Fieldhead Square, Glasgow, Scotland, G43 1HL
16. How to complain
We hope that we can resolve any query or concern that you raise about our use of your personal information.
You also have the right to make a complaint to your supervisory authority. In the UK, this is the Information Commissioner's Office (www.ico.org.uk).
17. Changes to this policy
To ensure that you are always aware of how we use your personal information we will update this Policy from time to time to reflect any changes to our use of your personal information and as required to comply with changes in applicable law or regulatory requirements. However, we encourage you to review this Policy periodically to be informed of how we use your personal information.
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us by contacting support@jointalo.com.