Privacy Policy

Last reviewed: August 2026

This Privacy Policy explains how Active Heart Health Ltd ("we", "our" or "us") collects, uses, stores, and protects your personal data when you use our website at activehearthealth.com, contact us directly, or interact with our content or social media pages.

We are committed to handling personal data transparently, lawfully and securely in accordance with applicable data protection law, including the UK GDPR and the EU GDPR, as applicable.

1. Who we are (Data Controller)

Active Heart Health Ltd is the data controller responsible for your personal data.

  • Company number: 12374292

  • Registered office: 2 Exeter Street, Cottingham, East Riding of Yorkshire, England, HU16 4LU

  • Email: contact@activehearthealth.com

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details above.

2. What personal data do we collect

We only collect personal data that is relevant to the way our website and services operate.

a) Information you provide directly

If you contact us by email or through a website form, we may collect:

  • your name;

  • your email address and any other contact details you choose to provide; and

  • the contents of your message or enquiry.

If you make privacy or cookie choices through our consent tools, we may also keep a record of those preferences.

b) Free digital downloads and email subscriptions

If you request a free digital download or sign up to receive emails from Active Heart Health, we may collect:

  • your name, where requested;

  • your email address;

  • details of the form or page through which you signed up;

  • the date and time of your sign-up;

  • whether and when you confirmed your email subscription;

  • your current subscription status;

  • records of your consent and any later withdrawal, unsubscribe request or objection; and

  • information about how you interact with our emails, such as whether an email was delivered or opened and whether you clicked links in it.

We use a double opt-in process for email subscriptions. After submitting the sign-up form, you will receive an email asking you to confirm your subscription. You are added to our active email marketing list only after you confirm.

Squarespace Email Campaigns provides us with information about the performance of our emails, including delivery, opens, link clicks and unsubscribes. We may use this information to understand how subscribers engage with our emails and to improve future communications.

Where a free digital download is offered alongside the email sign-up, access to that download is provided separately and is not dependent on you completing the email subscription confirmation.

c) Information collected automatically

When you visit the website, we and our service providers may automatically collect certain technical and usage information, including:

  • IP address;

  • approximate location derived from IP address;

  • browser type and version;

  • device type and operating system;

  • referring website or source;

  • pages viewed, time spent on pages and interactions with website content and links; and

  • information about consent choices made through our cookie banner.

This information may be collected through server logs, cookies, consent tools, tags and analytics technologies. Where consent is required for non-essential analytics technologies, these technologies are used in accordance with your choices made through our cookie consent tool.

d) Interactions with our social media pages

If you interact with us through our social media pages, such as by commenting on a post, sending a message, reacting to content or mentioning us, we may receive personal data associated with your account, such as your name, profile name, profile image and the content of your interaction.

We may use this information to respond to enquiries, moderate comments, understand engagement with our content and manage our social media presence.

e) Affiliate link activity

Some pages contain affiliate links, including links to Amazon and other third-party retailers. If you click one of these links, the relevant third party may collect information about your visit or purchase in accordance with its own privacy and cookie policies. We do not receive your full personal data from those retailers simply because you clicked an affiliate link.

3. Special category personal data

We do not routinely ask for or intentionally collect special category personal data, such as information about your health or medical conditions.

Our website forms and email subscription forms do not ask you to provide health or medical information. If you choose to include sensitive information in an enquiry or other communication with us, we will use it only where necessary to deal with your communication and where permitted by applicable data protection law.

We do not use the fact that you view particular health-related content, request a digital download or subscribe to our emails to infer that you have a particular medical condition or to create a health profile about you.

4. How we use your personal data

We may use personal data to:

  • respond to your enquiries, messages or social media interactions;

  • process requests for free digital downloads and provide access to those resources;

  • administer email sign-ups, including sending subscription confirmation and welcome emails;

  • send newsletters, heart-health information, new guides and occasional updates about Active Heart Health resources and products to people who have chosen to receive them;

  • maintain records of email subscription consent, confirmations, withdrawals, objections and unsubscribe requests;

  • operate, maintain and secure the website;

  • understand how visitors use the website and improve our content, usability and performance;

  • understand how visitors arrive at our website, including from advertising or other referral sources, and how they use the website after arrival, where the necessary analytics consent has been provided;

  • manage and moderate our social media presence;

  • store and manage cookie consent preferences;

  • maintain appropriate internal business and compliance records; and

  • comply with legal or regulatory obligations.

We do not use personal data collected through our email sign-up process to provide personalised medical advice or make individual health assessments.

5. Lawful bases for processing

Under the UK GDPR and the EU GDPR, as applicable, we must have a lawful basis for using your personal data.

The main lawful bases we rely on are:

  • Consent — where you choose to receive email newsletters or other marketing communications from Active Heart Health, and for non-essential cookies and similar technologies where consent is required. You may withdraw your consent at any time.

  • Legitimate interests — where necessary to operate, maintain and secure our website and business, respond to enquiries, provide and administer requested website resources, maintain appropriate business and compliance records, and protect our legal rights, provided those interests are not overridden by your rights and interests.

  • Legal obligation — where we need to process personal data to comply with applicable laws, regulations or lawful requests.

  • Vital interests — in the unlikely event that processing is necessary to protect someone's life.

We currently rely on consent for our email newsletter and marketing communications. Although direct marketing may in some circumstances be capable of relying on legitimate interests for data protection purposes, separate electronic communications rules may require consent. We therefore use a consent-based approach for individuals who subscribe to Active Heart Health emails.

6. Cookies and tracking technologies

We use cookies and similar technologies to operate the website and, where you have given the necessary consent, to understand how the website is used.

These technologies may be used to:

  • provide essential website functionality and security;

  • remember your privacy and cookie choices;

  • understand website traffic, page views and how visitors interact with our content and links;

  • understand how visitors arrive at and move through the website; and

  • improve our website content, usability and performance.

Our website currently uses services including Squarespace for website hosting and core functionality, Cookiebot by Usercentrics to manage cookie consent choices, Google Tag Manager to manage website tags and scripts, and Google Analytics 4 for website analytics.

Some cookies and similar technologies that are necessary for security, consent management or core website functionality may operate without your consent where permitted by law.

We currently configure Google Analytics 4 so that it is not activated unless you have provided the relevant consent through our cookie consent tool.

You can accept or reject different categories of non-essential technologies and can change or withdraw your choices at any time through our cookie settings. Where you withdraw consent, we will stop using the relevant non-essential technologies in accordance with applicable law.

Email campaign analytics

Squarespace Email Campaigns provides us with information about the performance of emails we send, including delivery, opens, link clicks and unsubscribes. It uses technologies including an invisible image to measure email opens and tracked links to measure clicks.

We use this information to understand how subscribers engage with our emails, assess the performance of our email communications and improve future emails. We do not use email engagement information to make health assessments or infer medical conditions about subscribers.

Email campaign analytics operate separately from the cookie controls used on our website. We explain our use of these analytics when you sign up to receive Active Heart Health emails.

For more information about the cookies and similar technologies used on our website, their purposes and how to manage your choices, please see ourCookie Policy and cookie settings.

7. Email subscriptions and marketing communications

You can choose to sign up to receive emails from Active Heart Health. These may include practical heart-health information, new articles and guides, and occasional news and updates about Active Heart Health resources and products.

We use a double opt-in process for email subscriptions. When you submit our email sign-up form, we send a confirmation email to the email address you provided. Your subscription is activated only after you click the confirmation link.

Where we offer a free digital download alongside the sign-up, you can access the download immediately after submitting the form. Access to the download is not dependent on confirming your email subscription. If you do not complete the confirmation step, you will not be added to our active email marketing list.

You can withdraw your consent and unsubscribe from marketing emails at any time by using the unsubscribe link included in our emails or by contacting us at contact@activehearthealth.com.

If you unsubscribe, we may retain the minimum information necessary to record your preference and help ensure that we do not send you further marketing communications.

Withdrawing consent does not affect the lawfulness of any processing carried out before consent was withdrawn.

We do not sell your personal data or share your contact details with third parties for their own marketing purposes.

8. Sharing your personal data

We do not sell your personal data.

We may share personal data where necessary with trusted third parties that help us operate our website and business, including:

  • Squarespace, which provides our website hosting, website forms and email campaign services;

  • Google, including Google Analytics and Google Tag Manager, which help us understand website use and manage website tags and analytics;

  • Cookiebot by Usercentrics, which helps us manage cookie consent choices and maintain consent records;

  • professional advisers such as accountants, lawyers, insurers and other advisers where necessary; and

  • regulators, law enforcement bodies, courts or other authorities where disclosure is required by law or necessary to protect our legal rights.

Where a third party processes personal data on our behalf, we expect it to process that data only for the relevant services and subject to appropriate data protection arrangements. Some third-party providers may also process personal data for their own purposes under their own privacy terms where applicable.

We do not sell or share your name or email address with third parties for their own marketing purposes.

If you interact directly with a third-party service or platform, such as Facebook, Instagram or another linked website, that provider may process your personal data independently under its own privacy policy.

9. Affiliate links and third‑party websites

Our website contains affiliate links and may link to third-party websites, including Amazon and other retailers.

Where you have consented to the relevant website analytics, we may record that an affiliate link has been clicked so that we can understand how visitors use our website.

If you follow an affiliate or other third-party link, you will leave our website. The third party may collect personal data, use cookies or similar technologies, or process information about your visit or purchase in accordance with its own privacy and cookie policies. Affiliate links may contain identifiers that enable a retailer to attribute a qualifying purchase to Active Heart Health.

We may receive an affiliate commission when a qualifying purchase is made. We do not receive your payment-card details or full customer account information simply because you use an affiliate link.

We do not control the privacy practices of third-party websites and encourage you to review their privacy information when you visit them.

10. International data transfers

Some of the service providers we use operate internationally and may process personal data in countries outside the United Kingdom or the European Economic Area (EEA), including the United States.

Where personal data is transferred internationally, we take steps to ensure that the transfer is permitted under applicable data protection law and that appropriate protections are in place.

For personal data protected by the UK GDPR, this may include transfers to countries covered by UK adequacy regulations, transfers to eligible US organisations under the UK Extension to the EU-US Data Privacy Framework, or the use of approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to the European Commission's Standard Contractual Clauses, where applicable.

For personal data protected by the EU GDPR, this may include transfers to countries recognised by the European Commission as providing an adequate level of protection, transfers to eligible US organisations under the EU-US Data Privacy Framework, or the use of European Commission Standard Contractual Clauses and other safeguards permitted by EU data protection law, where applicable.

The United Kingdom is recognised by the European Commission as providing an adequate level of protection for personal data transferred from the EEA.

Our service providers may use different lawful transfer mechanisms depending on the service, destination and circumstances of the transfer. Further information about the safeguards used for your personal data is available from us on request.

11. Data security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, misuse, alteration, disclosure or unauthorised access.

We take reasonable steps to limit access to personal data to those who need it for legitimate business purposes and to use service providers that maintain appropriate security measures.

We have procedures for responding to suspected personal data breaches. Where required by applicable data protection law, we will notify the relevant supervisory authority and affected individuals.

However, no internet-based service or method of electronic storage can be guaranteed to be completely secure.

12. Data retention

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide our website and services, maintain appropriate business and compliance records, resolve complaints or disputes, and meet legal, regulatory or accounting requirements.

The period for which we retain personal data depends on the type of information, why it was collected, its sensitivity, the potential risk from unauthorised use or disclosure, and any applicable legal or operational requirements.

In particular:

  • Enquiries and communications are retained for as long as reasonably necessary to respond to the enquiry and maintain appropriate records. We may keep relevant information for longer where necessary in connection with a complaint, dispute, legal claim or regulatory requirement.

  • Email subscriber information is generally retained while you remain subscribed to Active Heart Health emails. We periodically review whether we still need this information and whether the consent on which our email marketing relies remains appropriate.

  • Unconfirmed email sign-ups are not used to send marketing communications. Information relating to an unconfirmed subscription is retained only for as long as reasonably necessary to operate and administer the subscription-confirmation process and maintain appropriate records.

  • Consent records may be retained for as long as reasonably necessary to demonstrate when and how consent was obtained, what the individual was told at the time, and whether consent was subsequently withdrawn.

  • Unsubscribe and objection records may be retained after other subscriber information is removed. We may keep the minimum information necessary on a suppression or “do not contact” record so that we can respect your preference and avoid sending you marketing communications in the future.

  • Cookie consent and website analytics information is retained in accordance with the purposes for which it was collected, the settings of the relevant services and our Cookie Policy.

When personal data is no longer required, we will delete or anonymise it where appropriate. Information that has been properly anonymised so that it can no longer identify an individual may be retained and used without further notice.

13. Your data protection rights

Depending on the circumstances and the data protection law that applies, you may have the right to:

  • access the personal data we hold about you and receive a copy of it;

  • request correction of personal data that is inaccurate or incomplete;

  • request erasure of your personal data where the law allows;

  • request restriction of the way we use your personal data in certain circumstances;

  • object to processing of your personal data where we rely on legitimate interests;

  • object at any time to the use of your personal data for direct marketing;

  • request data portability for certain personal data you have provided to us, where this right applies; and

  • withdraw your consent at any time where we rely on consent to process your personal data. Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

These rights are not absolute and may not apply in every circumstance.

To exercise any of your data protection rights, please contact us at contact@activehearthealth.com. We may ask you for information reasonably necessary to confirm your identity or understand your request. We will not ask for more information than is necessary for this purpose.

We will respond to requests without undue delay and normally within one month, subject to any extensions permitted by applicable data protection law.

For subject access requests governed by the UK GDPR, if your request is unclear, we may ask you to clarify the personal data or processing activity you are asking about where clarification is reasonably required. Where the law allows, the response period may be paused while we wait for that clarification. We will carry out searches that are reasonable and proportionate in the circumstances.

You will not normally have to pay a fee to exercise your data protection rights. Where permitted by law, we may charge a reasonable fee or refuse to act on a request if it is manifestly unfounded or excessive.

14. Data protection complaints

If you have a complaint or concern about how we collect, use or protect your personal data, please contact us so that we have an opportunity to investigate and respond.

You can make a data protection complaint by:

  • emailing us at contact@activehearthealth.com; or

  • writing to us at the postal address given in Section 1 of this Privacy Policy.

We will:

  • acknowledge your complaint within 30 days of receiving it;

  • take appropriate steps to investigate your complaint without undue delay;

  • make appropriate enquiries based on the circumstances;

  • keep you informed of the progress of our investigation where necessary; and

  • communicate the outcome of your complaint clearly and without undue delay.

We may ask for further information where reasonably necessary to understand or investigate your complaint, or to confirm your identity.

If the UK data protection regime applies, you have the right to complain to the Information Commissioner's Office (ICO) if you are concerned about how we have used your personal data.

If the EU GDPR applies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EEA country where you normally live, where you work, or where you believe an infringement of data protection law has occurred.

You do not have to wait for us to complete our complaints process before exercising your right to complain to a supervisory authority.

15. Automated decision-making and profiling

We do not use personal data to make decisions about individuals based solely on automated processing that produces legal or similarly significant effects.

We may use automated technologies for routine purposes such as website analytics, email delivery and campaign analytics. These activities do not determine your access to services or make decisions about you that have legal or similarly significant effects.

We do not use website browsing, digital-download or email-engagement information to make automated health assessments or personalised medical decisions about individuals.

16. Children’s data

Our website, digital downloads and email communications are intended for adults and are not directed at children.

We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child in circumstances where we should not have done so, we will take appropriate steps to delete or otherwise handle that information in accordance with applicable data protection law.

If our services change so that they are likely to be accessed by children, we will review our data-processing practices and take appropriate age-related privacy and data-protection measures.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, how we process personal data, or applicable law and regulatory guidance.

The latest version will be published on this page with an updated review date. Where a change materially affects how we use your personal data or the choices available to you, we may take additional reasonable steps to bring the change to your attention and, where required, obtain fresh consent.

If you have any questions about this Privacy Policy, please contact us at contact@activehearthealth.com.