Privacy Policy

Dr Sara Health Privacy Policy

This Privacy Policy explains what personal data Dr Sara Health collects, why, and what your rights are. It applies to drsarakayat.com and to any sign-up, giveaway, or communication described below. Please read it alongside our Gift Box Draw Terms where relevant.

1. Who we are

Dr Sara Kayat Online Limited (company number 17374999), a company registered in England and Wales, of The Lexicon, 10–12 Mount Street, Manchester, England, M2 5NT, trading as Dr Sara Health ("we," "us," "our"), is the data controller responsible for your personal data as described in this policy. You can contact us at rupert@drsarakayat.com.

2. The personal data we collect

Waitlist & newsletter sign-up: your email address, and your name if you give it.

Gift-box giveaway entry: your email address (via the sign-up above) and your Instagram handle, so we can check you've followed and shared as required by the draw's terms; a postal address if you win, so we can send your prize.

Contacting us directly: whatever you include in your message (e.g. an email to the address above).

Browsing the site: standard technical data collected by our website platform (e.g. IP address, browser type, pages visited) and any cookies described in Section 6.

We do not currently collect any health, medical, or clinical information through this site. That will change once our online clinic service launches; see Section 10.

3. How we use your personal data

Sending the waitlist and fortnightly newsletter you signed up for — lawful basis: consent.

Running the gift-box giveaway (checking entries, contacting and verifying winners, sending prizes) — lawful basis: performance of the contract formed by entering the draw, and consent.

Responding to messages you send us — lawful basis: legitimate interest, in dealing with your enquiry.

Keeping the site secure and working properly — lawful basis: legitimate interest.

Meeting our legal and regulatory obligations — lawful basis: legal obligation.

4. Sharing your personal data

We do not sell your personal data. We share it only in the following limited circumstances:

- Service providers who help us run the site, send emails, and manage the giveaway (for example, our website host and email/newsletter platform), acting on our instructions and only for that purpose.

- The brands featured in the gift-box giveaway do not receive your details. Entrant data is used by us alone to run the draw.

- Legal or regulatory reasons, for example if required by law, court order, or to protect our rights or the safety of others.

- A future sale, merger, or restructuring of our business, in which case your data would be handled under the same protections described here.

5. Cookies and similar technologies

Our website may use cookies and similar technologies that are necessary for it to function, and, where you've consented, to understand how visitors use the site. You can control cookies through your browser settings [and via our cookie banner, if one is in use].

6. How long we keep your data

We keep waitlist and newsletter data for as long as you remain subscribed, and delete it within a reasonable period after you unsubscribe. We keep gift-box giveaway entry data for as long as needed to run the draw, verify and despatch prizes, and deal with any related queries, and then delete it. We keep records of direct correspondence for as long as reasonably needed to resolve the matter it relates to.

7. Keeping your data secure

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, and we limit access to it to those who need it to do their job.

8. International transfers

Some of the service providers we use to run this site may store or process data outside the UK. Where that happens, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Agreement or an approved adequacy decision.

9. Your rights

Under UK data protection law, you have the right to:

- Ask us for a copy of the personal data we hold about you;

- Ask us to correct any inaccurate or incomplete data;

- Ask us to delete your data, or restrict how we use it, in certain circumstances;

- Object to us using your data for direct marketing, at any time and free of charge;

- Ask us to transfer your data to another organisation, in certain circumstances;

- Withdraw your consent, where we're relying on consent, at any time.

To exercise any of these rights, contact us at rupert@drsarakayat.com. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113.

10. When our clinical service launches

Once Dr Sara Health's online clinic service is live, this policy will need a substantial update to cover the health and medical information collected during consultations, prescribing, and dispensing, including how that data is shared with our pharmacy partner, Phlo, who will act as an independent data controller for the parts of your care they handle. You will be told what's collected and why, and asked for your consent where required, before you provide any health information.

11. Changes to this policy

We may update this policy from time to time, for example as our services change. We'll post any updated version here with a new "last updated" date.

Privacy Policy last updated: 23 September 2026.