The MyHealthCounts Privacy Policy

1. Introduction

This policy (together with any additional terms of use notified to you) applies to your use of the MyHealthCounts app and website (together called the Platform)

This policy sets out the basis on which any personal information we collect from you, or that you provide to us, will be processed by us. The Platform is not intended for children, and we do not knowingly collect data relating to children. Please read the following carefully to understand our practices regarding your personal information and how we will treat it.

Important information and who we are

Road to Health Group is the data controller and is responsible for your personal information (collectively referred to as "Company", "we", "us" or "our" in this policy).

We have appointed a Data Protection Officer, if you have any questions about this privacy policy, please contact them using the details set out below.

Contact details

Our full details are:

• Full name of legal entity: Road to Health Group Ltd

• Name of Data Protection Officer: Adam Bates

• Email address: [email protected]

• Postal address: 30-34 North Street, Hailsham, East Sussex, BN27 1DW

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

2. Our relationship with Aviva

The Platform and Platform content is provided by Road to Health Group. We are the data controller of the personal information we collect about you when using the Platform, and we are legally responsible for how we collect and use your personal information (including our decision to share such data with Aviva).

We provide the Platform for the benefit of Aviva Health UK Limited (a company registered in England with company number 02464270, and whose registered office address is 8 Surrey Street, Norwich, NR1 3NG)) and Aviva Insurance Limited (a company registered in Scotland with company number SC002116, and whose registered office address is Pitheavlis, Perth, PH2 0NH) (together “Aviva”)

Information we receive from Aviva

We receive the following personal information about you from Aviva:

• Full Name
• Insurance policy number
• Insurance policy renewal date
• Policy status
• Date of birth
• Postcode
• Member status

• Member number

We use this information to create your account on the Platform and to validate you as an Aviva policyholder. More details about the legal basis on which we use this information is set out in section 11 (How we use your personal information), below.

Information we share with Aviva

We share the following personal information with Aviva:

• your policy number, member number, and MyHealthCounts account status, so that Aviva can ensure they apply the correct discount to the correct person, and for support and administration purposes;
• Your renewal discount percentage (this is automatically calculated based on your Q Score(s). Information on how we calculate your discount percentage can be found here: MHC Calculation of discount

• the date your renewal discount percentage was calculated, so that Aviva can carry out audits on any discounts if needed;

• a log of your completed actions on the Platform (such as when you completed a health risk assessment, and when you received notifications);

• management information reports containing aggregated data (see section 8 (Aggregated Data) below, for more information); and

• information you provide to us on an appeal, but where the appeal will be passed to Aviva and you consent to us sharing this information with Aviva for the purpose of your appeal.

We will only share your renewal discount percentage and completed actions with Aviva if you provide us with your consent.

If you provide consent, Aviva will only be told what actions you have completed. They will not receive your Q score(s) or any information you provide as part of completing a health risk assessment or connecting to a health or fitness app.

Once your personal information is received by Aviva both Aviva Health UK Limited and Aviva Insurance Limited are responsible for it and are data controllers.

If Aviva receives your discount percentage and completed actions, it will process this information to administer your contract of insurance as part of your Healthier Solutions policy. Aviva will no longer rely on consent but instead will rely on the lawful basis of insurance purposes. For further information on this and how your personal information will be processed by Aviva, please see their Privacy Policy

We are not responsible for how Aviva uses the personal information we pass to it. If you wish to exercise any of your legal rights in respect of personal information controlled by Aviva, please refer to Aviva’s privacy policy, or the Aviva website, in the first instance.

More details about the legal basis on which we share this information with Aviva, is set out in section 11 (How we use your personal information) below.

3. Changes to the privacy policy and your duty to inform us of changes

We keep our privacy policy under regular review.

This version was last updated on 14th July 2025. It may change and if it does, these changes will be posted on this page and, where appropriate, notified to you when you next use the Platform. The new policy may be displayed on-screen, and you may be required to read the changes to continue your use of the Platform.

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during our relationship with you.

4. Third party links

Our Platform may, from time to time, contain links to and from the websites of our partner networks, advertisers, and affiliates.

When you connect a health or fitness app to our Platform, you will be automatically re- directed to the relevant third-party application e.g. Fitbit, Strava, Under Armour, Apple Health (iOS), Health Connect (Android) or Garmin. The third-party application will request you to confirm which personal information you wish to share with the Platform and will extract the data, in line with your preferences, from your health or fitness app and transfer the relevant personal information to us.

Please note that these websites and any services that may be accessible through them have their own privacy policies and that we do not accept any responsibility or liability for these

policies or for any personal information that may be collected through these websites or services. Please check these policies before you submit any personal information to these websites or use these services.

For details of the personal information we collect from third party applications, see section 9 (How is your personal information collected?), below.

5. The personal information we collect about you

We may collect, use, store and transfer different kinds of personal information about you as follows:

• Identity Data: name, username, date of birth, biological sex.

• Contact Data: email address.

• Address Data: your postcode.

• Insurance Policy Data: Policy number, renewal date, qualifying window, policy status.

• Ethnicity

• Biological Data: including your age, height, weight, blood pressure, blood glucose and cholesterol.

• Health and Lifestyle Data: including information regarding your physical activity, diet, stress levels, mental wellbeing, alcohol use, smoking and risk factors for specified diseases. This also includes data collected from a health and fitness app if you link such an app to your account on the Platform.

• Device Data: includes the type of mobile device you use, a unique device identifier (for example, your device's IMEI number, the MAC address of the device's wireless network interface, or the mobile phone number used by the device), mobile network information, your device operating system, the type of browser you use, time zone setting.

• Profile Data: includes your username and password, your interests, preferences, feedback and survey responses.

• Activity Data: a log of your activity on our Platform.

• Usage Data: includes details of your use of any of our Platform including, but not limited to, traffic data and other communication data, and the resources that you access.

• Communications Data: information on your notification preferences.

6. Sensitive Personal Information

Some of the data we collect is particularly sensitive. We collect the following sensitive personal information (also called “special category data” in law):

• Ethnicity

• Biological Data including your age, height, biological sex, weight, blood pressure, blood glucose and cholesterol.

• Health and Lifestyle Data including information regarding your physical activity, diet, stress levels, alcohol use, smoking and related risk factors.

This personal information is integral to the purpose of the Platform. We use this sensitive personal information to generate your Q Score(s) and provide you with health and wellbeing content. Your Q Score(s) determines your renewal discount percentage.

You must consent to us using this sensitive personal information if you want to use the Platform. If you do not consent, then you cannot use the Platform.

7. Profiling and Automated Decision Making

One of the main purposes of the Platform is to collect information on your lifestyle, health, and wellbeing, to create a profile of your health and risk factors for specific diseases. That profile will reflect your health and risk factors. We use your profile to:

• Provide suggestions and content to you via the Platform, relating to your health and wellbeing; and

• To create a score reflecting your health and risk factors (called a “Q Score”).

If you consent, we use your Q Score(s) and other information you provide, to automatically calculate and make a decision on your MyHealthCounts renewal discount percentage (if any). We send the discount percentage to Aviva.

Where a decision is made automatically, it is made without human intervention.

Details of how your Q Score(s) are calculated and used to generate a discount percentage can be found here: MHC Calculation of discount

If you do not consent to us processing your information for profiling purposes, you must not use the Platform.

You have a right to appeal your renewal discount percentage. On an appeal, you have the right to request that a human reviews the discount percentage generated, express your view and challenge the decision

You may appeal your renewal discount percentage by emailing [email protected] or by calling 0808 168 7570.

If your appeal relates to a failure to complete or submit an assessment within the required time period, we may refer your appeal to Aviva.

8. Aggregated Data

We may aggregate data from all users of the Platform. This data may be derived from your personal information but is not considered personal information in law as this data will not directly or indirectly relate to you or reveal your identity. For example, we may aggregate your age, ethnicity, health, and lifestyle data, but without your name, address or contact details.

We may use this aggregated data:

• To provide information reports to Aviva about how users use the Platform (for example, how many users completed which health risk assessments).

• To provide statistics about users of the Platform (for example, the average score on a health risk assessment, or how many users achieved a certain score on a health risk assessment).

• To monitor Platform usage.

• For population analysis and for the identification of behavioural trends.

• To develop our Platform and other services we provide.

  We may publish our findings or share them with third parties.

  We will continue to use your personal information when generating aggregated data, for up to 13 months after your policy has expired or been cancelled.

9. How is your personal information collected?

We will collect and process the following data about you:

• Information you give us. This is information (including Identity, Health and Lifestyle, Biological, and Communications Data) you give us by filling in forms on the Platform, or by corresponding with us (for example, by email or chat). It includes information you provide when you register to use the Platform, input your details to the Platform, and when you report a problem with the Platform. If you contact us, we will keep a record of that correspondence.

• Information we collect from your health and fitness app: If you link a health and fitness app to your account, that app will provide certain information to us about your step count, activity, and sleep patterns. In most cases, this data will be provided to us by a third-party data aggregator (such as Validic), which links to your apps, extracts data, and transfers this to us.

• Information we collect about you and your device. Each time you use the Platform, we will automatically collect personal information including Device and Usage Data.

  We collect this data using cookies and other similar technologies. Please see our Cookie Policy

• Information we receive from other sources: we will receive personal information about you from:

  • analytics providers, such as Google analytics (who may be based outside the EU). See section 10 (Cookies) below.

  • Aviva – see section 2 (Our relationship with Aviva) above .

10. Cookies

Our Platform uses cookies. They are placed by software that operates on our servers, and by software operated by third parties whose services we use. You can choose to block cookies at any time. If you choose not to use cookies or prevent their use through your browser settings, you may not be able to use all the functionality of our website.

For more detailed information on how we use cookies, see our Cookie Policy

11. How we use your personal information

We have set out below, in a table format, a description of all the ways we plan to use your personal information, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Where we specify more than one legal basis for using your data, we may rely on any of the listed bases.

Engagement & Essential Notifications

We may send you essential notifications relating to the Platform (for example confirmation of your renewal discount).

We will send notifications to remind you of the opportunity to submit a Q Score or complete an action and earn a renewal premium discount. We will also send you notifications relating to your goals, and features of the Platform and its content. These are non-essential engagement notifications.

You can disable:

• Push notifications (whether or not essential);

• All non-essential engagement notifications (whether by push-notification or email)

in the “notification preferences” section in your account settings. You cannot disable essential notifications from being sent by email.

You can also opt out of certain email notifications by following the opt out link at the end of the email.

12. Disclosure of your personal information

We will share your personal information with the third parties set out below.

• Other members of our group of companies

• Service providers acting as processors based in the United Kingdom who provide IT and system administration services.

• When we receive information from your health and fitness app we will send an identifier back to the app provider or third-party data aggregator, to link your data to your profile in the Platform.

• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal information in the same way as set out in this privacy policy.

Aviva will receive:

• Your policy number, customer number, and MyHealthCounts account status, so that they can make sure they apply the right discount to the correct person, and for support and administration purposes.

• Your MyHealthCounts renewal discount percentage (see section 2 (Our Relationship with Aviva) above)

• The date your MyHealthCounts discount was calculated so that they can carry out audits on any discounts if needed.

• A log of your actions on the Platform (such as when you completed a health risk assessment, and when you received notifications), but only where you have consented to us sharing your discount percentage with Aviva.

13. How to withdraw your consent

You may withdraw your consent at any time by deleting your account via the "Account Settings" section on website version of the Platform, and the ‘More’ section on the app. You can also contact us at [email protected].

Where you delete your account, your profile and data will no longer be available to you. But this will not affect the lawfulness of any processing carried out before you withdraw your consent, or any processing we carry out which does not require your consent.

You may also withdraw your consent to us sharing certain information with Aviva by accessing the ‘Account Settings’ on the website version of the Platform, and the ‘More’ section on the app. You may only withdraw consent to sharing information with Aviva prior to your qualifying window closing. Withdrawing your consent to sharing of data with Aviva will not affect the lawfulness of any previous data sharing, or data sharing which does not require your consent.

Also, aggregated data (which is no longer personal information) which we have created using your personal information prior to you withdrawing your consent, may still be used by us.

14. International Transfers

We may transfer your personal information to third parties providing services to us who are based outside of the United Kingdom (UK). This includes parties providing IT administration services and hosting services.

Whenever we transfer your personal information outside of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• Transferring data to countries that have been deemed to provide an adequate level of protection for personal information. This includes (but is not limited to) countries within the Economic European Area; or

• using specific contracts approved for use within the UK which give personal information the same, or equivalent protection it has in the UK.

15. Data Security

All personal information you provide to us is stored on our secure servers. Where we have given you (or where you have chosen) a password that enables you to access the Platform, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Once we have received your personal information, we will use strict procedures and security features to try to prevent your personal information from being accidentally lost, used, or accessed in an unauthorised way.

We will collect and store personal information on your device using application data caches and your device's internal storage.

We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator when we are legally required to do so.

16. Data Retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Upon the expiry or cancellation of your Aviva health insurance policy, or where you delete your account or otherwise withdraw consent to the Platform using your sensitive personal information, some of your personal information is retained for a period of 13-months.

The personal information we retain is:

• Policy number, policy renewal date and policy status;

• Responses provided to health risk assessments and other questions on our Platform, and score generated;

• Discount percentage(s)

• Discount window

A log of your actions on the Platform (such as when you completed a health risk assessment, and when you received notifications).After the 13-month period, your remaining personal information and account details are destroyed.

We hold this information for 13 months, so that we can demonstrate the process for how your renewal discount percentage was calculated. This may be necessary if we or Aviva think there has been an error, or where you raise queries or a complaint about your renewal discount percentage. The retention of your personal information is deemed necessary for our legitimate interests and/or for the establishment, exercise, or defence of legal claims.

Unless you have withdrawn consent, we will also use this personal information during the 13 month period when generating new aggregated data (see section 8 (Aggregated Data) above). For more details, please contact our Data Protection Officer.

Deleting your account

Your account will be deleted automatically upon expiry or cancellation of your Aviva health insurance policy, or should you choose to delete your MyHealthCounts account. The option to delete your account is available within the 'Account Settings' section on website version of the Platform, and the ‘More’ section on the app.

17. Your legal rights

Under certain circumstances you have the following rights under data protection laws in relation to your personal information.

These rights are as follows:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

• Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios:

  • if you want us to establish the data's accuracy.

  • where our use of the data is unlawful, but you do not want us to erase it.

  • where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or

  • you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

• Request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

• Withdraw consent at any time where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.

• Automated decision making: You have the right not to be subject to a decision using your personal information which is based solely on automated processing (without human involvement) where that decision produces a legal effect or otherwise significantly affects you. This right does not apply if the decision is:

  • necessary for the purposes of a contract between us and you;

  • authorised by law (e.g. to prevent fraud); or

  • based on your explicit consent.

You do however have a right to request human intervention, express your view and challenge the decision. See section 7 (Profiling and Automated Decision Making) above for more details.

You also have the right to ask us not to continue to process your personal information for marketing purposes.

You can exercise any of these rights at any time by contacting us at [email protected]