How Healthcount protects personal data
Healthcount is designed around data minimisation and privacy by design. We collect only what is needed, report only in aggregate, and never share individual health data with employers or insurers.
- Designed around data minimisation
- Individual health data is never shared with employers or insurers
- Employers only see aggregated, de-identified cohort reporting
- Employees control participation and can stop at any time
- Data is processed in line with UK GDPR and privacy-by-design principles
Data minimisation
Healthcount collects the minimum data needed to support maintenance. We don't require detailed food diaries, extensive health questionnaires, or continuous monitoring. The inputs are:
- An occasional weight datapoint (not daily)
- Optional activity and sleep trends (connected where available)
- An optional medication schedule with lightweight check-ins
- Short check-ins when prompted by drift signals
Purpose limitation
Data collected by Healthcount is used for one purpose: supporting GLP-1 maintenance. It is not used for marketing, profiling, or resold to third parties. Member data drives two outputs — personal maintenance signals for the member and anonymised, aggregated reporting for funders.
Roles in different programme models
Healthcount's data governance role depends on how the service is accessed.
- When used directly by individuals, Healthcount acts as data controller.
- In employer or insurer programmes, Healthcount may act as processor for some functions and controller for the member experience.
- Employers never receive identifiable employee health data, regardless of the programme model.
Data processing agreements are available for employer and insurer programmes.
Legal basis for processing health-related data
Health data is special category data under UK GDPR. Healthcount processes it carefully and transparently.
- We process health-related data using appropriate UK GDPR conditions, including explicit consent where required.
- Participation is always voluntary. No one is required to use Healthcount.
- Processing is limited to supporting maintenance behaviour — nothing more.
- Members can withdraw at any time without affecting their employment or clinical care.
Protections in employer programmes
Employers do not see individual employee health data. This is a non-negotiable design principle. Specific protections include:
- Minimum cohort size thresholds before any reporting is shared
- Aggregated reporting only — no individual-level data
- No identifiable employee reports
- No individual monitoring by employers
- No behavioural scoring of individuals
- No automated employment decisions based on Healthcount data
If a cohort is too small for safe reporting, data is withheld until the group size threshold is met.
Aggregation and anonymisation
Reporting for insurers and employers is grouped and de-identified. We use minimum group sizes to reduce re-identification risk. Funders see cohort-level patterns, not individual journeys.
What funders see
- Activation rates (e.g. first check-in within 14 days)
- Retention rates (e.g. active at 8 weeks)
- Stop-start proxies (28+ day gaps and restart rates)
- Drift signal distributions across the cohort
- Safety signposting frequency
Operational details
Data retention
Personal data is retained for as long as a member actively uses Healthcount, plus a reasonable period to allow for pauses in treatment. Aggregated reporting data is retained separately and does not contain personal identifiers. Members can request deletion at any time.
Your rights
Under UK GDPR, you have the right to access your data, request correction of inaccurate data, request deletion, restrict processing, and data portability. To make a data subject access request (DSAR) or exercise any of these rights, contact us at anna@healthcount.app.
Data deletion
Members can request full deletion of their personal data at any time. Deletion requests are processed promptly. Once deleted, personal data cannot be recovered. Aggregated, anonymised data that has already been included in cohort reporting is retained as it contains no personal identifiers.
Subprocessors
Healthcount uses a limited number of subprocessors to deliver the service. All subprocessors are reviewed for data protection compliance and are bound by appropriate contractual terms. A current list is available on request.
International transfers
Data is hosted on infrastructure within the UK and EU. Where any processing involves transfers outside the UK, appropriate safeguards are in place in line with UK GDPR requirements.
Healthcount is designed so employers can support employee health without accessing personal health data.
For full legal details, see our Privacy Policy and GDPR Compliance pages.
Privacy-safe reporting for funders
Aggregated insights without individual data exposure. See how a pilot works.