Last updated 26 October 2026. Replaces the notice of 13 February 2026.
Key definitions
Who we are and how to contact us
Emerald Labs Ltd, company number 15776578, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We are the controller of your personal data. ICO registration ZB701056. CQC provider ID 1-23470666662.
For anything about your data, including to exercise your rights or to complain, email support@withemerald.com. Our Data Protection Officer is Dr Yiannis Balanos; you can contact him at yiannis@withemerald.com or by post at the address above.
What data we collect
You do not have to give us any data, but we cannot provide screenings, consultations or the Weight Management Programme without the account, identity and health information marked as required in the app. If your employer gave us your details, we send you this notice with your invitation email.
Our services are for adults. You must confirm you are 18 or over when you create an account. If we learn that we hold data about someone under 18, we will delete it and close the account.
Why we use your data and our lawful basis
How we use Member Content and Health Data
Service delivery. To show your results and trends, produce your report and action plan, and let our clinicians advise you.
Clinical records. Consultations are transcribed automatically so that we have accurate notes for your safety and for clinical quality review. The transcript is part of your clinical record.
Improvement. We look at how the Platform is used, in pseudonymised form, to fix problems and improve features.
Research and statistics. We may produce anonymised statistics from which no one can be identified.
We do not sell member data.
Automated tools and decisions
Your dashboard shows an Emerald Score and an estimated biological age, calculated automatically from your screening results, measurements and, if connected, wearable data, using rules written by our clinical team. They are for information. Decisions on whether you are eligible for the Weight Management Programme, on what is prescribed, and on the clinical meaning of your results are made by a registered clinician; we do not make decisions with legal or similarly significant effects on you solely by automated means.
Our clinicians use Google Cloud Agent Platform, running inside Emerald’s own Google Cloud environment under Google’s data processing terms, to transcribe consultations and to draft results summaries. Prompts exclude your name and other direct identifiers, every clinical output is reviewed by a registered clinician before it reaches you, and Google may not use the data for its own purposes or to train its models. Data received from Garmin Connect is excluded from this processing (see Additional disclosures).
International transfers
We hold your structured health data on Google Cloud in the European Union (multi-region, Belgium and the Netherlands). Files you upload and raw data received from connected devices are stored in a Google Cloud multi-region store in the United States. Where data leaves the UK we rely on the UK Addendum to the EU Standard Contractual Clauses or an adequacy decision; for Google Cloud these form part of Google’s data processing terms, and for other providers (for example Mailchimp’s EU servers) they are in place as noted above. Email support@withemerald.com for a copy of the safeguards for any supplier.
Verification documents
For the Weight Management Programme we must verify your identity and weight before prescription medicines can be supplied; for Screenings you may be asked to show photo ID at the clinic. Provide identity documents and any photographs through the Emerald app or on your video consultation, not by email. Verification records form part of your clinical record and are kept for the same period.
How long we keep your data
The clinical record period runs from the end of your last Membership Year or Programme period. If you buy a 12-month Membership and never renew, it runs from the day that Membership Year ends.
When you delete your account
You can ask us to delete your account at any time by emailing support@withemerald.com from the address on your account. We aim to respond within 2 working days and complete the request within one month. We delete or anonymise your account, profile, uploaded files, app activity and marketing data. Because we are a regulated healthcare provider, we must keep your clinical record for the period above. That record is then held with access restricted to clinical need, legal obligation or safety, and is not used for analytics, product development or any AI tool.
Your rights
To use any of these rights, email support@withemerald.com. We respond within one month. We may need to check your identity first.
Access. Ask for a copy of the personal data we hold about you.
Correction. Ask us to correct inaccurate data. Clinical notes record what a clinician observed or concluded at the time; if you disagree with a clinical opinion we will add a note of your disagreement alongside it.
Erasure. Ask us to delete your data. We will do this unless the law requires or allows us to keep it; in particular we must keep your clinical record for the period above (Article 17(3)(b) and (c) UK GDPR). We decide each request individually and will tell you what we have kept and why.
Restriction. Ask us to pause our use of your data while a dispute about its accuracy or our use of it is resolved.
Portability. Receive the data you gave us in a machine-readable format.
Objection. You may object at any time to processing we base on legitimate interests. We will stop unless we can show compelling legitimate grounds that override your interests. You may object at any time to direct marketing, and we will always stop.
Withdrawing consent. Where we rely on your consent (non-essential cookies, wearable connections, uploads, identity verification, telling your NHS GP), you can withdraw it at any time in the app or by email. Withdrawal does not affect processing already carried out.
Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest and role-based access for staff.
Changes to this notice
We may update this notice. Material changes will be emailed to Members at least 30 days before they take effect.
Complaints
If you are unhappy with how we handle your data, contact us first at support@withemerald.com and we will investigate and tell you the outcome. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.
Additional disclosures
This section sets out terms that apply to specific services you may choose to connect to Emerald. It supplements, and does not replace, the rest of this notice.
Garmin Connect data
If you choose to connect your Garmin account, Emerald receives data from Garmin Connect through the Garmin Connect Developer Program. Connecting is optional, and nothing is collected unless you complete the Garmin consent screen.
What we receive. Only the categories covered by the permissions you grant:
Health: daily activity summaries, sleep, body composition, stress, heart-rate variability, resting heart rate and pulse ox.
Activity: workouts and activity details.
Women’s Health: menstrual cycle tracking, where you use it.
How we use it. Garmin data forms part of your health record. Your Emerald clinicians view it alongside your blood results when writing your health report and planning follow-up care, and you can see your own trends in the Emerald app. We do not use it for advertising, and we do not sell it.
Who processes it. Garmin data is handled by Emerald clinicians and staff; by Terra Enabling Developers, Inc., our wearable integration provider, acting as our processor under contract; and by our hosting provider, Google Cloud. It is not shared with any other platform or service.
Artificial intelligence. Garmin data is not shared with, or processed by, any external artificial-intelligence or third-party data-processing service. Where Emerald uses AI assistance to help prepare clinical documents, data received from Garmin is excluded from that processing.
Where it is stored, and for how long. Garmin data is stored within Emerald’s own systems on Google Cloud, with the same safeguards as the rest of your Health Data: structured data in the European Union and raw data files in the United States, as described in International transfers. It is retained under the clinical record rule in How long we keep your data.
Disconnecting. You can disconnect Garmin at any time in the Emerald app, under “Your apps and devices”. We then stop receiving new data from Garmin. Data already received stays part of your medical record and is retained as described above; you can ask us to erase it using the rights set out in Your rights. You can also revoke Emerald’s access from your Garmin Connect account.
Garmin’s own processing. Garmin processes your Garmin Connect account and device data as a separate controller under its own privacy policy, available at garmin.com/privacy.
Questions. Contact us using the details in Who we are and how to contact us.