Healthcount is designed around data minimisation and privacy by design. We collect only what is needed, report only in aggregate, and never share individual health data with employers or insurers.
Healthcount collects the minimum data needed to support maintenance. We don't require detailed food diaries, extensive health questionnaires, or continuous monitoring. The inputs are:
Data collected by Healthcount is used for one purpose: supporting GLP-1 maintenance. It is not used for marketing, profiling, or resold to third parties. Member data drives two outputs — personal maintenance signals for the member and anonymised, aggregated reporting for funders.
Healthcount's data governance role depends on how the service is accessed.
Data processing agreements are available for employer and insurer programmes.
Health data is special category data under UK GDPR. Healthcount processes it carefully and transparently.
Employers do not see individual employee health data. This is a non-negotiable design principle. Specific protections include:
If a group has fewer than 10 people, every figure except the member count is left blank until it reaches 10.
Reporting for insurers and employers is grouped and de-identified. Every figure apart from the member count is left blank until the group it is worked out from has at least 10 people, to reduce the risk of anyone being picked out. Funders see cohort-level patterns, not individual journeys.
The 10-person minimum counts enrolled members for engagement, weight and side effects, members who enrolled that long ago for retention, and members with an active dose plan for adherence.
We keep a member's personal data until they delete their account, which they can do from Settings, or ask us to delete it, which they can do at any time. Nothing deletes an account because it has stopped being used, so an account nobody uses is kept too. What an employer programme keeps after an account is deleted is set out under Data deletion below.
Under UK GDPR, you have the right to access your data, request correction of inaccurate data, request deletion, restrict processing, and data portability. To make a data subject access request (DSAR) or exercise any of these rights, contact us at anna@healthcount.app.
You can delete your account yourself, from Settings, at any time. It removes your login and everything logged against it: diary entries, weights, measurements, meal and progress photos, doses, symptoms, notes, goals and your profile. It happens straight away and it cannot be undone. You can download a copy first. It is a full copy of what you have logged, from your diary and photos to your dose schedule, goals, check-ins, messages with your guide and saved meals. The one thing it leaves out is anything you sent us through a form on our public website, such as a price alert signup, because we hold those against your email address rather than your account; email us if you want a copy of them too. You confirm by typing your own email address and re-entering your password. Both are checked on our servers, not only in the form, so being signed in on an unlocked phone is not on its own enough to delete the account. It is no defence against somebody who knows the password, and we do not require anything beyond it.
There is one case we refuse rather than run. If you are the only owner of an organisation account, deleting your login would leave that organisation with no administrator and no way to appoint one, and everyone else on the programme enrolled with nobody able to manage it. Ownership cannot be handed over in the app yet, so we will ask you to email us: we will move it to another admin and then delete your account.
Deleting also takes your email address off our mailing lists, including price alert signups and anything you submitted through a form on the site. That happens before anything else is removed, so if it fails the deletion stops rather than telling you your data is gone while your address is still on a list. It removes those submissions from our database only. A copy of each may also have been emailed to our team, when you sent it or in a later daily summary, and those emails stay in our team mailbox until they are deleted there. To have yours deleted too, email anna@healthcount.app.
If you have been on an employer programme, data that has already been included in that employer's cohort reporting is retained. Nothing is retained if you have not. What is kept is three counts of people, held against an organisation and a calendar month. No weight and no measurement of any kind, no name, no email address, and no date finer than the month. We do not describe it as anonymous, because in a month when you are the only person who left that organisation the counts are about you and say so. That is why only our servers can read it. It is not exposed to your employer or to anyone signed in, and nothing in the app reads it today. It keeps two employer figures reproducible after you leave, the member count and the engagement rate. It does not keep the other four. Retention rate, medication adherence and reported side effects would each need something sharper about you personally, so we do not retain them, and we do not retain the average weight change either. Those four figures can move when somebody deletes their account. Alongside the counts we keep one one-way hash of the account id we have just deleted, and nothing else about you. Its only job is to stop a retried deletion being counted twice.
Healthcount uses a limited number of subprocessors to deliver the service. All subprocessors are reviewed for data protection compliance and are bound by appropriate contractual terms. A current list is available on request.
Data is hosted on infrastructure within the UK and EU. Where any processing involves transfers outside the UK, appropriate safeguards are in place in line with UK GDPR requirements.
The website asks before it uses analytics cookies (Google Analytics and PostHog), and nothing is loaded from Google until you accept. The full list of what is stored on your device, including what Grow by Mediavine does on our public pages, is in the cookies section of our privacy policy, where you can also change your choice.
Healthcount is designed so employers can support employee health without accessing personal health data.
For full legal details, see our Privacy Policy and GDPR Compliance pages.
Aggregated insights without individual data exposure. See how a pilot works.