Last updated: 2026-07-01
Welcome to NOYU. This Privacy Policy explains how PROJECT 120 LTD ("NOYU", "we", "us") collects, uses, and protects your personal information when you use our Platform and Services.
NOYU is a health app that makes sense of your health data - your sleep, training, nutrition, and blood tests - and tells you what to do next. To do that we handle some of your most sensitive information, so we have written this policy in plain English to explain exactly what happens to it.
NOYU is currently available to members in the United Kingdom and the European Economic Area (EEA), and is intended for people aged 18 and over.
PROJECT 120 LTD is the controller responsible for your personal data. This means we decide how and why your data is processed.
PROJECT 120 LTD - 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE, United Kingdom.
Company number: 16584137
For any privacy question or to exercise your rights, email hello@noyu.health.
We collect information in several categories. You control most of what we hold - much of it is only collected if you choose to log it or connect a source.
Your name, email address, date of birth, biological sex, ethnicity, height, and weight. If you buy or redeem a blood test, we also collect the address and phone number needed to arrange it. We collect this directly from you.
Your responses to health and lifestyle questions (your goals, habits, and health history), and any blood test results and biomarkers where you choose to take a test. Blood test data is collected from the regulated laboratory partner who processes your sample.
Health and fitness data from devices and apps you choose to connect. Most connections are made through our integration partner Terra (for example, Garmin, Oura, Apple Health, Strava, Runna, and Coros). You can also connect your Google Calendar so NOYU can take upcoming races and events into account. We may collect:
Food you log by photo or text (and the nutrition information we estimate from it), entries you record in your journal, and the messages you exchange with NOYU. NOYU also keeps a private memory of key facts from your conversations so it can give you more relevant advice over time.
Page views, feature usage, and interactions with the Platform, collected through our analytics tools to help us understand and improve NOYU. This does not include your Health Data.
If you buy a blood test, our payment provider Stripe processes your card details - we never see or store your full card number. We keep a record of the transaction and its status.
We do not knowingly collect data from anyone under 18. You must confirm you are at least 18 to register.
If you use our iOS app and grant permission, NOYU reads health and fitness data from Apple Health (HealthKit) - such as sleep, workouts, heart rate, and steps - both directly on your device and through Terra to keep it in sync. You choose which categories to share, and you can change or revoke this permission at any time in the iOS Settings app.
We use data obtained through HealthKit only to provide the health and fitness features of NOYU to you - understanding your health, generating your insights, and doing the things you ask NOYU to do.
We do not use HealthKit data for advertising or marketing, we do not use it for data mining, and we do not sell it. We do not share HealthKit data with any third party except the sub-processors that help us operate NOYU and deliver these features to you, and never for their own purposes.
Under UK and EU GDPR, we need a lawful basis to process your personal data. Here is how we use your information and the legal grounds:
Creating your account, connecting your data, generating insights and messages, and doing the things you ask NOYU to do.
Lawful basis: Contract (Article 6(1)(b))
Analysing your health data - blood tests, wearable metrics, food, journal, and questionnaire responses - and your ethnicity to give you personalised insights and advice.
Lawful basis: Explicit consent (Article 9(2)(a))
Handling blood test purchases and maintaining billing records.
Lawful basis: Contract; Legal obligation
Understanding how NOYU is used, fixing bugs, keeping the Platform secure, and developing new features.
Lawful basis: Legitimate interests (Article 6(1)(f))
Service notifications and, if you opt in, occasional marketing communications (you can unsubscribe at any time).
Lawful basis: Legitimate interests; Consent for marketing
Responding to lawful requests and maintaining required records.
Lawful basis: Legal obligation (Article 6(1)(c))
Because we rely on your explicit consent to process your Health Data, you can withdraw that consent at any time by contacting us or deleting your account. Withdrawing consent does not affect processing we carried out before you withdrew it.
NOYU uses artificial intelligence to make sense of your data and give you advice. Here is exactly how that works and what we will and will not do.
To generate your insights, reports, and replies, we send the relevant health data to trusted AI providers - currently Anthropic, Google, and OpenAI - who process it on our behalf. Along with the health data, we send only your first name, age, biological sex, ethnicity, height, and weight so the advice is personal and accurate.
We do not send your surname, email address, phone number, home address, or date of birth to these providers. Under our contracts, they process your data only to provide the service to you and do not use it to train their own models.
To improve NOYU - fixing problems, refining our insights, and developing new features - we use only aggregated, anonymised, or de-identified data. Once data has been aggregated or anonymised so that it can no longer identify you, it is no longer personal data (for example, statistics like "40% of members had low vitamin D"). We do not use your identifiable Health Data to train our models.
We share your data only with the sub-processors that help us run NOYU, all of whom are bound by data protection contracts and may only use your data on our instructions. These include providers for hosting and storage, AI, wearable connections, email, payments, blood testing, and support.
You can see the full, current list - what each one does, what data it handles, and where it is located - at www.noyu.health/subprocessors. We will update that page before adding any new sub-processor that handles your personal data.
We may also disclose data to regulatory authorities or law enforcement where required by law or to protect the safety of you or others.
We store your core data in the United Kingdom and European Union. Some of our sub-processors - including our AI providers - are based in the United States, so some data is transferred there. When we transfer personal data outside the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, or an adequacy decision where one applies. You can contact us for more detail on the safeguards used for a particular provider.
We use a small number of cookies and similar technologies:
You can manage your choices through our cookie banner or your browser settings. See our Cookie Policy for details.
We keep your data for as long as necessary to provide the Services and fulfil the purposes in this policy, or as required by law. Specifically:
When you delete your account, we delete or anonymise your personal data within a reasonable timeframe, except where we are required to retain it by law.
Under UK and EU GDPR, you have the following rights:
To exercise any of these rights, email hello@noyu.health. We will respond within one month.
We take the security of your data seriously and implement appropriate technical and organisational measures:
No system is 100% secure, but we work hard to protect your data and will notify you promptly if a breach occurs that affects your rights.
We aim to make our Platform accessible to everyone, including those with disabilities, in accordance with WCAG 2.1 AA standards. If you have difficulty accessing any part of the Platform or this Privacy Policy, please contact us at hello@noyu.health so we can help.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email at least 30 days before they take effect. Continued use of the Platform after that date means you accept the updated policy.
If you have concerns about how we handle your data, please contact us first at hello@noyu.health. We will do our best to resolve your concerns.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk, or with your local data protection authority if you are in the EEA.
If you have any questions about this Privacy Policy, please contact us at:
Email: hello@noyu.health
PROJECT 120 LTD
3rd Floor, 86-90 Paul Street
London, EC2A 4NE
United Kingdom