Privacy policy
PRIVACY POLICY
Last updated: 7 August 2026
WHO WE ARE
NORIAHEALTH LTD, a company registered in England and Wales under number 16743616, registered office 17 King Edwards Road, Ruislip, HA4 7AE, United Kingdom, trading as NoriaHealth Hub ("Noria", "we", "us"), is the controller of the personal data described in this policy. For any question about your data, or to exercise any of the rights listed below, write to privacy@noriahealth.com.
WHAT NORIA DOES, AND WHY IT MATTERS FOR YOUR DATA
Noria is a routing platform. We do not provide medical care and we do not assess your case ourselves. When you send an enquiry, it is reviewed by an independent physician who is not part of Noria, and who decides which private clinic is appropriate for your situation.
This is why the clinical part of your enquiry is not handled by us. The sections below say exactly who sees what.
HEALTH DATA (SPECIAL CATEGORY DATA, ARTICLE 9 GDPR)
What we collect. Through the intake form: the main reason for your request, your current pain level, how long you have had your symptoms, and anything else you choose to write to us. These fields are optional except the reason for your request.
Why it is collected. So that an independent physician can read your situation and route you to a private clinic equipped for it. Nothing else.
Legal basis. Your explicit consent, Article 9(2)(a) GDPR, together with Article 6(1)(a) GDPR. You give that consent when you submit the intake form, after reading the statement displayed with it. You can withdraw your consent at any time by writing to privacy@noriahealth.com. Withdrawal does not affect processing already carried out, and does not affect any medical record held by a clinic, which is governed by its own retention obligations.
Who reads it. The independent qualifying physician, and the private clinic to which you are routed. Noria's coordination team sees only the administrative fields, your contact details, your country and the care category retained for routing. It does not read or interpret the clinical content of your enquiry.
What is never done with it. Your health data are never used for marketing. They are never used for advertising or profiling. They are never sold, rented, or shared with advertising partners or data brokers. They are not used to build audiences on any platform. They are never sent to a business introducer.
Processors. The intake form runs on Shopify, which hosts the data on our behalf as a processor under Shopify's data processing addendum. Shopify does not use your health data for its own purposes.
How long it is kept. Twelve months from your last contact with us, if your enquiry does not lead to care. Where care is provided, the medical record is held by the treating clinic under the retention rules that apply to it, and Noria keeps only the administrative and billing record.
REFERRAL CODES
The intake form has an optional referral field. If you enter a code, we tell the person or organisation behind that code that you contacted us, so that your introduction can be credited to them. They receive your name and the fact that you got in touch. They never receive your health data, your symptoms, or anything about your medical situation. Leave the field empty if you do not want this.
INSURANCE
Noria does not handle insurance. Any reimbursement, guarantee of payment or third-party billing is arranged directly between you and the clinic. We do not send your file to an insurer.
CUSTOMER AND ORDER DATA
What we collect. Your name, email address, billing address, phone number, order details and payment confirmation. We never see or store your full card number; that is handled by the payment provider.
Why, and on what basis. To perform our contract with you, Article 6(1)(b) GDPR: take your order, arrange the service, invoice you, and handle any refund. To comply with accounting and tax obligations, Article 6(1)(c) GDPR. To prevent fraud and secure the site, Article 6(1)(f) GDPR.
Who receives it. Shopify, as hosting and store platform. Our payment provider. Our accountant, for invoicing records.
How long we keep it. Order and invoicing records for the statutory accounting retention period. Account data until you ask us to delete your account.
MARKETING
We send commercial messages only to people who have asked to receive them, and only using contact details you have given us for that purpose. We never use health data, or the fact that you made a medical enquiry, to target you. Every message carries an unsubscribe link, and you can also write to privacy@noriahealth.com.
COOKIES AND MEASUREMENT
The site uses cookies that are necessary for it to work, and, subject to your choice in the cookie banner, cookies for audience measurement. You can change or withdraw your choice at any time through the banner. Declining non-essential cookies does not prevent you from using the site or from sending an enquiry.
INTERNATIONAL TRANSFERS
Some of our processors are established outside the European Economic Area and the United Kingdom. Where that is the case, the transfer is covered by the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, or an adequacy decision.
YOUR RIGHTS
Subject to the conditions set by law, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time. Write to privacy@noriahealth.com. We answer within one month. We may need to verify your identity first.
If you are not satisfied with our answer, you can lodge a complaint with your local supervisory authority. In Belgium, that is the Autorite de protection des donnees, Rue de la Presse 35, 1000 Brussels. In the United Kingdom, that is the Information Commissioner's Office.
SECURITY
Access to enquiries is restricted to the people named above. Data in transit is encrypted. No system is perfectly secure, so please do not send us medical documents through unsecured channels; ask us for a secure link instead.
CHANGES
We update this policy when our practices change. The date at the top is the date of the version you are reading.
CONTACT
NORIAHEALTH LTD, 17 King Edwards Road, Ruislip, HA4 7AE, United Kingdom. General enquiries hub@noriahealth.com. Data protection privacy@noriahealth.com.COOKIES AND MEASUREMENT
The site uses cookies that are necessary for it to work, and, subject to your choice in the cookie banner, cookies for audience measurement. You can change or withdraw your choice at any time through the banner. Declining non-essential cookies does not prevent you from using the site or from sending an enquiry.
INTERNATIONAL TRANSFERS
Some of our processors are established outside the European Economic Area and the United Kingdom. Where that is the case, the transfer is covered by the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, or an adequacy decision.
YOUR RIGHTS
Subject to the conditions set by law, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time. Write to privacy@noriahealth.com. We answer within one month. We may need to verify your identity first.
If you are not satisfied with our answer, you can lodge a complaint with your local supervisory authority. In Belgium, that is the Autorite de protection des donnees, Rue de la Presse 35, 1000 Brussels. In the United Kingdom, that is the Information Commissioner's Office.
SECURITY
Access to enquiries is restricted to the people named above. Data in transit is encrypted. No system is perfectly secure, so please do not send us medical documents through unsecured channels; ask us for a secure link instead.
CHANGES
We update this policy when our practices change. The date at the top is the date of the version you are reading.
CONTACT
NORIAHEALTH LTD, 17 King Edwards Road, Ruislip, HA4 7AE, United Kingdom. General enquiries hub@noriahealth.com. Data protection privacy@noriahealth.com.