Privacy Policy

Last updated: January 2026. This policy applies to the Clherity website (clherity.com) and our WhatsApp community.

1. Who We Are

Clherity is a PCOS lifestyle support community based in the United Kingdom. We are registered with the UK Information Commissioner's Office (ICO) as a data controller under the UK GDPR and Data Protection Act 2018.

You can contact us about privacy matters at hello@clherity.com

2. What Data We Collect

We collect the following categories of personal data:

• Contact information: your name and email address when you contact us or join our community.
• Payment information: processed securely by Stripe. We never see or store your card details.
• Onboarding information: PCOS symptoms, health background, and goals you share voluntarily during onboarding. This is used solely to provide better support.
• Usage data: anonymised information about how you use our website (pages visited, time on site) via privacy-respecting analytics if enabled.
• Communications: any messages you send us via our contact form or email.

3. How We Use Your Data

Purpose	Legal basis
Delivering the community service you subscribed to	Contract performance
Processing your payment via Stripe	Contract performance
Sending you your WhatsApp join link and onboarding email	Contract performance
Responding to your contact form messages	Legitimate interests
Improving our service and understanding member needs	Legitimate interests
Complying with legal obligations	Legal obligation

We do not sell your personal data. We do not use your data for automated decision-making or profiling.

4. WhatsApp - Third Party Platform

Our community is hosted on WhatsApp (Meta Platforms, Inc.). By joining the WhatsApp group, you acknowledge the following:

• WhatsApp is a third-party platform governed by WhatsApp's Terms of Service and Privacy Policy, which are separate from Clherity's policies.
• Your phone number may be visible to other members of the group. WhatsApp displays the phone numbers of group participants to each other. We recommend reviewing your WhatsApp privacy settings before joining.
• Clherity does not control WhatsApp's platform or how Meta processes your data. Concerns about WhatsApp data practices should be directed to Meta directly.

5. Who We Share Data With

• Stripe: payment processing. Subject to Stripe's Privacy Policy.
• Supabase: secure database hosting for our backend. Located in the EU.
• Microsoft 365: email delivery. Subject to Microsoft's data processing terms.
• WhatsApp / Meta: community hosting. See section 4 above.

We do not share your data with any other third parties without your explicit consent.

6. Data Retention

• Payment records: 7 years (UK tax law requirement)
• Contact form messages: 2 years, then deleted
• Onboarding data: held for the duration of your membership plus 1 year
• Activity logs: 12 months rolling (used for fraud prevention and service improvement)

7. Cookies

We use only strictly necessary cookies to make the website function. These include session cookies for our admin panel. We do not use advertising or tracking cookies. You will see a cookie notice on your first visit confirming this.

8. Your Rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Erase your data (right to be forgotten)
• Restrict how we process your data
• Data portability - receive your data in a machine-readable format
• Object to processing based on legitimate interests

To exercise any of these rights, email us at hello@clherity.com. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk).

9. Data Security

We protect your data using:

• HTTPS encryption on all web traffic (TLS 1.2+)
• Encrypted database storage (Supabase, EU-hosted)
• Row-level security on all database tables
• IP address hashing (we store hashes, not raw IP addresses)
• Access controls limiting who within Clherity can access your data

Despite these measures, no internet transmission is 100% secure. We will notify you promptly in the event of a data breach affecting your rights.

10. Children

Our service is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email at least 14 days before they take effect. The date at the top of this page shows when it was last updated.