Bloume Privacy Notice

Last Updated: 28 August 2026 

Introduction

Changes To This Privacy Notice

Data Protection Officer And Our Contact Information

Personal Data We Collect and Our Lawful Basis

Where We Get Personal Information From

Data Protection Principles

How Long We Keep Your Data

Sharing Your Data

International Transfers

Use Of Artificial Intelligence

Cookies and Tracking Technologies

How We Protect Your Data

Data Protection Rights and Complaints

How to complain

Introduction

Bloume*(“Bloume”,”Wellnourish”, “we, “our”) is committed to protecting the privacy and security of the personal data we collect about end customers and users of our services (“you/your”). The purpose of this privacy notice is to explain what personal data we collect about you when interacting with our services whether on the app, online or on social media. When we do this, we are the data controller. For more information on controllers and their responsibilities please visit the ICO guidance

Please read this privacy notice carefully as it provides important information about how we handle your personal information and your rights. If you have any questions about any aspect of this privacy notice you can contact us using the contact information provided.

Changes To This Privacy Notice

We may update this notice (and any supplemental privacy notice), from time to time. We will notify you of the changes where required by applicable law to do so.

Last modified August 2026. You can find previous versions of this notice by contacting [email protected]

Data Protection Officer Contact Information

Bloume is a registered company with the Information Commissions Office (ICO)
Registration Reference: ZC134636

If you have any questions, or wish to exercise any of your rights, then you can contact our data privacy team below:

• Wellnourish, 16-18 Barnes Wallis Road, FAREHAM, Hampshire, PO15 5TT, GB
• Alternatively, you can email us at  [email protected]

EU/EEA GDPR Representative (Article 27)

If you are located in the EU, and have questions or concerns regarding your personal data, you may contact our GDPR representative:

EU Representative: Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland
Email: [email protected]

To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal.

This link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.

Personal Data We Collect and Our Lawful Basis

Under Data protection law we must have a lawful basis for collecting and using your personal data which is appropriate for our processing purposes, the lawful basis under which we process your personal data has been included alongside our processing purposes in the table below. Where we are processing special category data (that is data which requires higher levels of protection due to its sensitive nature) we only do so with your Explicit Consent (Article 9(a)). For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where personal data is processed because it is necessary for the performance of a contract to which you are a party, we will be unable to provide our services without the required information.

Where We Get Personal Information From

• Directly from you
  • We obtain data directly from you where you engage with our services and enter your information, including but not limited to; provision of your contact information for marketing emails, input of your cycle data, nutrition or wellness logs within the Bloume app, or when engaging with our teams directly via email, social media or any other contact method.
• Indirectly from you
  • We may obtain information about you via cookies and associated tracking technologies when you engage with our services via our website or application including; your use of our services, features and functionality, your interests such as which content you engage with and how you navigate around our services.
• Publicly available sources
  • We may obtain information about you from publicly available sources, such as social media. We may use this information to better understand how you interact with our services and better understand the needs of our customers.

Data Protection Principles

Bloume operates on a privacy first basis and has implemented technical and organisational safeguards to provide assurance of the confidentiality, security and integrity of the data you provide to us, including:

• Data minimisation, we only collect the data we need for the purposes we have described.

• Purpose limitation, data is only ever used for the purposes described in our privacy notice. We do not sell your health data.

• Storage limitation, we do not keep your data longer than is necessary for the purposes it was collected. Where possible, we operate a zero-retention model, meaning that your data is removed from our systems immediately following processing. Please see retention below.

• Integrity and confidentiality are core to our business, we do share your data only when necessary and only with appropriate safeguards and contractual clauses in place. When using our app, your data is stored on your device, we do not hold your sensitive personal data and cannot view the data you enter into the app or in conversations with Aiya.

• Lawful, fair and transparent is assured through overarching privacy notices and granular consent processes so you always know how your data is being used.

When Using Our App
When using the Bloume app, your sensitive health data is stored only on your device. Where you use the Aiya chat functionality, a snapshot of your data is sent to our LLM provider along with any data you provide in your chat input, this is removed at close of session and processed under strict zero data retention and zero knowledge rules, meaning that the LLM does not store or learn from your data, ever.

As a privacy-first service, it is not possible for anyone in the Bloume team to access your health data, this includes to view, edit, remove, restore or otherwise process your health information. This ensures that your sensitive health data never leaves your control and is never stored anywhere we could access it.

We recommend that you maintain backups of your data to restore to a new device should this be necessary. The security of the data you enter into the Bloume app or store in personal cloud backups is dependent on the security provision you have enabled, we recommend ensuring appropriate access and security controls are implemented.

How Long We Keep Your Data

We will retain your personal data for as long as is necessary to provide you with our services and for a reasonable period thereafter to enable us to meet our contractual and legal obligations and to deal with complaints and claims.

At the end of the retention period, your personal data will be securely deleted or anonymized, for example by aggregation with other data, so that it can be used in a non-identifiable way for statistical analysis and business planning.

In some cases, we operate a zero retention policy, meaning we do not hold your data for longer than the duration of your use of that feature. This includes all Aiya chat content, input and output and any associated content provided by the app to support your request.

For more information on how long we store your personal data, or the criteria we use to determine this, please contact us using the details provided above.

Sharing Your Data

In limited circumstances we may share your personal data with our approved sub-processors. In all cases, sharing will be carried out in accordance with a data processing agreement that enforces the same privacy first position utilised by Bloume.

In limited circumstances we may share data with third parties, where we do so we will implement contractual controls that mandate similar levels of protection for your data and we will never share health data or other sensitive information without your consent. We may share your information with relevant regulatory authorities and professional consultants as required by our legal obligation or completion of business activity in line with the processing activities detailed above.

Some of our core processors include:

International Transfers

Where necessary, we may share your data internationally, we will ensure that this is limited to countries benefiting from a UK or European Commission adequacy decision or with appropriate transfer mechanisms in place to provide an adequate level of protection

When doing so, we comply with the UK and EU GDPR, making sure appropriate safeguards are in place.

Use Of Artificial Intelligence

Bloume utilises AI to enhance user experience and provision relevant content on our app. In all cases, we are committed to providing transparent, safe and controlled AI interactions and ensure:

• We always tell you are interacting with AI.

• Sensitive data is only used to enhance your experience and provide relevant recommendations, AI does not make health care recommendations or assumptions.

• We have a zero data retention approach to AI, your conversations are removed from the server at session close and stored only on your device. This cannot be accessed by Bloume or our third parties ensuring that your sensitive health data is never used to train or improve AI models.

• We undertake periodic quality assurance and safety checks of our AI to ensure outcomes align with our core principles and safeguards.

• We provide you with a way to raise concerns and or highlight inaccuracies in the AI outputs without disclosing your personal information.

Cookies and Tracking Technologies

Bloume utilises cookies and similar tracking technologies in the provision of our services, including our website, mobile application, social media and any other services or products which may be provisioned. Cookies are a way for us and third parties to recognise you, they are small text files stored directly on your device web browser that can collect, hold and receive information. The term cookies refers to multiple technologies that can be used to track your activities, including pixels, SDKs and beacons. When we use the term cookie, we are referring to all tracking technologies which may be performing the same function.

How long a cookie remains on your device depends on whether it is a session, or persistent cookie. Session cookies are used to identify particular visits to our services and expire after a short time, such as when you close your browser, at the end of the defined session the cookies are deleted. Persistent cookies remain on your device for a set duration, this could be to support remember me requests, they are deleted only when they meet their retention period.

Bloume uses three types of cookies.

1. Essential Cookies

• Fundamental for us to be able to deliver the service you have requested and ensure the integrity and security of our systems and data.
• Do not track you, your browsing history or activity for marketing or advertising purposes.
• Due to the nature of these cookies, we do not need your consent to use them.

2. Necessary and Non-Necessary Analytical Cookies

• Provide us with data to support maintenance and development of our services, such as error tracking, bounce rates and page views.
• Track your activity when engaging with our services, such as which links you click, or how you navigate our services to provide aggregated data.
  Necessary Analytics do not share identifiable data with third parties and are not used for marketing or advertising, we do not need consent for these cookies.
• You have the right to opt out of the use of all other Analytics cookies without detriment to you or loss of access to our services.

3. Marketing Cookies

• Track your activity across multiple websites and platforms to build a personalised profile that supports the surfacing of relevant content aligned to your interests.
• Used to support marketing activity such as to prevent repetitive advertisements, track your digital footprint and to surface adverts more relevant to your personal profile.
• We only use these cookies with your consent, should you choose, you can disable them at any time without detriment to you or loss of access to our services.

At Bloume we are committed to ensuring a privacy-first approach and protecting your sensitive health data, our cookies do not track your health data and provide anonymised reporting where possible.

Below is a table that sets out the cookies Bloume and our third parties may use when you engage with our products and services.

If you object to the use of cookies, you can update your preferences at any time using the cookie settings on our website or within your app. You may withdraw consent for the use of non-essential cookies, including those you have previously consented to, without detriment or limitation of service. Whilst we will not limit your access to services or seek to prevent or hinder your use of our website as a result of opting out or withdrawing consent for the use of cookies, some of our features and/or content may not be available where they rely on the use of such cookies, e.g. remember me features that store your preferences. For more information on how to opt out of third party cookies or update your browser settings, please see our full Cookie Policy.

See more in our full Cookie Policy https://legal.bloume.com/documents/cookie_policy

How We Protect Your Data

We implement appropriate technical and organisational measures to protect data that we process from unauthorized disclosure, use, alteration or destruction. Security measures include (but are not limited to):

• Multi-factor authentication

• Role based access for all systems, platforms and processes containing personal data

• Security logging, monitoring and auditing to track access and actions within our development environment

• Organisational policies and processes to establish frameworks and safeguards for the handling of personal data  

• Training for all staff handling personal data or influencing the development, security of functionality of personal data processing systems and solutions

• Encryption on all databases holding personal data

• Local first storage for your health data and optional cloud back-ups, giving you control of your information

• Data minimisation and purpose limitation through segregated data storage and handling practices

Data Protection Rights and Complaints

---

In the UK and EU
Where you are located and the lawful basis we rely on may impact your data protection rights. You can find out more about your rights, exemptions and how to exercise your rights below.

Right of Access

• You have the right to ask us for copies of your personal data.
• You may be able to obtain information about where we obtain your personal data and who we share it with.
• There are some exemptions to the right of access which means you may not receive all of the requested information. Where we have relied upon such exemptions we will provide you with our reasoning.
• For more information on the right of access in your jurisdiction, please see the links to the relevant supervisory authority at the end of this privacy notice.

Right to Rectification 

• You have the right to ask us to correct or delete personal data you think is inaccurate or incomplete.
• For more information on the right of access in your jurisdiction, please see the links to the relevant supervisory authority at the end of this privacy notice.

Right to Erasure

• You have the right to ask us to delete your personal data.
• There are some exemptions to the right of erasure which maty mean that we are unable to remove your personal data. Where we have relied upon such exemptions we will provide you with our reasoning.
• For more information on the right of access in your jurisdiction, please see the links to the relevant supervisory authority at the end of this privacy notice.

**Right to Restriction Processing **

• You have the right to ask us to limit how we can use your personal data.
• Your right to restrict processing applies in specific circumstances, we will always consider your request and our obligations when determining if your right to restrict processing applies and how we can best meet our obligations in line with your rights.
• For more information on the right of access in your jurisdiction, please see the links to the relevant supervisory authority at the end of this privacy notice.

Right to Object to Processing

• You have the right to object to the processing of your personal data.
• There are some exemptions to the right to object which means we may not be required to cease such processing. Where we have relied upon such exemptions we will provide you with our reasoning.
• You always have the right to object to direct marketing.
• For more information on the right of access in your jurisdiction, please see the links to the relevant supervisory authority at the end of this privacy notice.

Right to Data Portability

• You have the right to ask that we transfer the personal data you gave us to another organisation, or to you.
• There are some exemptions to the right to data portability which means we may not be required or able to transfer your data. Where we have relied upon such exemptions we will provide you with our reasoning.
• For all data provided within our app, including health and wellness logs and nutritional data, you are able to obtain a machine readable copy directly from our app. As we do not hold this data, we are unable to provide this data to you directly.
• For more information on the right of access in your jurisdiction, please see the links to the relevant supervisory authority at the end of this privacy notice.

**Right to Withdraw Consent **

• When we use consent as our lawful basis you have the right to withdraw your consent at any time without reason or detriment.
• You will not be subject to discriminatory, derogatory other such negative treatments or conditions as a result of withdrawing your consent and, where possible, we shall not withdraw services as a result of withdrawing your consent, e.g. access to our website.
• Please note that, given the nature of our application services, we are unable to provide such services where you do not consent to the processing of your health data. This does not impact your right to access data stored in such application nor to access any such services that do not depend on the processing of the data to which you do not consent.
• For more information on the right of access in your jurisdiction, please see the links to the relevant supervisory authority at the end of this privacy notice.

Right not be Subject to Automated Decision Making and Profiling

• You have the right not to be subjected to automated decision making and profiling where such processing may have legal or similarly significant impacts on you.
• You may opt out of automated processing and profiling, or choose not to opt in, at any time and have the right to change your mind, you can request oversight oif any decisions made through automated decision making or profiling where the impact is likely to have a legal similarly significant impact.
• Please note that, given the nature of our application services, we may be unable to provide services to you where you do not consent to the processing of particular data or processing types. This does not constitute discriminatory practices and we will always provide you with such services where we can.
• For more information on the right not to be subject to automated decision making or profiling, please see the links to the relevant supervisory authority at the end of this privacy notice.

Right Not to Be Discriminated Against

• You have the right not to be subjected to discrimination for exercising your privacy rights or enforcing our obligations.
• We will never subject any individual to discriminatory, derogatory other such negative treatments or conditions for exercising their privacy rights.
• Please note that, given the nature of our application services, we may be unable to provide services to you where you do not consent to the processing of particular data or processing types. This does not constitute discriminatory practices and we will always provide you with such services where we can.
• For more information on the right to be free from discrimination, please see the links to the relevant supervisory authority at the end of this privacy notice.

If you make a privacy rights request, we must respond to you without undue delay and in any event within one month. You can make a data protection rights request via our website or by contacting us on the details set out above.

How to complain

You have a right to complain if you feel we have misused your personal data or are unhappy with our handling of your data, privacy rights request or any other handling of your data under this privacy policy or our business activity.

We have established a dedicated data protection complaints procedure to ensure such matters are handled exclusively by our data privacy team and in line with applicable data protection law. If you have any concerns about our use of your personal data, you can make a data protection complaint via the contact details set out here, or our dedicated data protection complaints page (link below)

Data Protection Complaints Procedure and Complaint Form: https://legal.bloume.com/documents/data-protection-complaint-form

Contact our DPO by:

• Email: [email protected]
• Post: DPO, Wellnourish, 16-18 Barnes Wallis Road, Fareham PO15 5TT

Data Protection Authority in the UK

Following completion of our data protection complaints procedure, if you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

You can contact the ICO on the details below:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint

Data Protection Authorities in the EU and EU Representation
For European Citizens or those located in the EU or EEA, you have the right to make a complaint to your local Data Protection Authority (DPA) who will contact our EU Representative. You can find contact details for your national DPA via the European Data Protection Board website here: https://www.edpb.europa.eu/about-edpb/our-members_en

Bloume’s EU Representative: Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland
Email: [email protected]

Data Protection Authorities and Regulators in the United States

Data Protection Authority in Canada
For Canadian Citizens or those located in Canada, you have the right to make a complaint to the Office of the Privacy Commissioner of Canada. You can submit a complaint online at: https://www.priv.gc.ca/en/report-a-concern/