This notice covers the Stedda app. The website and waitlist have their own, shorter privacy notice.
Who we are
Stedda is made and run by Cadence Health Ltd, a company registered in England and Wales (Company No. 17043196), registered office 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, registered with the Information Commissioner's Office under number ZC095403. We are the data controller for everything you put into Stedda. Our Data Protection Lead can be reached at hello@stedda.app.
What Stedda is, and is not
Stedda is a tracker for people in the UK who pay privately for their weight-loss treatment. It keeps the records you choose to enter and shows you published prices from UK online providers. It is not a medical device, it does not give medical advice, it does not prescribe or supply medicines, and nothing in it is shared with a prescriber or pharmacy. Your prescriber and pharmacist remain the people responsible for your treatment.
What we collect
Only what you give us, plus the minimum needed to run an account:
- Your email address, used to sign you in with a one-time link. There is no password.
- Your treatment diary: the medicine and dose you say you are on, the days you record a dose, your reminder settings, and what you have left.
- Other things you choose to log: weight, food, exercise, side effects from a list, and if you use them, mood notes and progress photos, with the dates you log them. You can leave any of these empty.
- Provider comparison history: which providers you opened from the comparison and when, so the app can show you your own history. The answers you give to narrow the list stay on your device.
- Your age confirmation (you must be 18 or over) and the consent choices you make at sign-up.
- Technical information needed to run the service: a session token, the type of device and browser, and if you turn on reminders, a push-notification token from Apple or Google.
We do not collect your name, address, date of birth, NHS number, payment details or location. We do not read Apple Health or Google Health Connect. We do not use advertising or analytics trackers.
Why we use it, and our legal basis
Information about your medicines, weight and symptoms is health data, which UK law treats as special category data. We use it only because you have given your explicit consent at sign-up (UK GDPR Article 6(1)(a) and Article 9(2)(a)) and only to:
- run your diary, reminders and supply countdown;
- show you your own history and progress;
- keep your account secure and the service working.
Separately and optionally, you can consent to your records being used, with identifying details removed, for research into how people get on with these treatments. That is a second, separate consent. Saying no changes nothing about the app. You can withdraw either consent at any time in the app, and withdrawing means we stop using your data for that purpose from then on.
Who we share it with
Nobody sells or markets with your data, and we never pass it to pharmacies, prescribers, insurers or employers. The companies that help us run Stedda process it only on our instructions:
- Supabase hosts the database, in London (UK).
- Vercel serves the app and keeps short-lived server logs for security.
- Resend sends sign-in links and the occasional service email.
- Upstash provides the rate limiting that protects sign-in, in the EU.
- Sentry receives error reports so we can fix faults; we configure it to strip personal data.
- Food database services answer food searches; they receive the search term or barcode, not who you are.
- Apple and Google deliver push reminders to your phone if you turn them on; they see a device token, not your diary.
Your data is stored in the United Kingdom. Where a provider's support staff could access it from outside the UK, that access is covered by UK-approved contract terms.
When you follow a "Visit provider" link, you leave Stedda and that provider's own privacy notice applies. We add nothing to the link and we are not told what you do there.
How long we keep it
For as long as you keep your account. You can delete your account in the app at any time (Profile, then Privacy settings); that withdraws your consent and your diary is permanently deleted within 14 days, because we have no other basis to keep it. We keep a minimal record that you consented and when you withdrew, so we can show we acted lawfully. If you consented to research use, the link between you and any research copy is cut at the next pipeline run, within 24 hours; what remains in the research dataset cannot be traced back to you, and nothing new is added after you withdraw.
Your rights
You can see what we hold, get a copy, correct it, delete it, ask us to restrict or stop using it, and object. Most of this you can do yourself in the app; for anything else, email hello@stedda.app and we will answer within a month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Stedda is for adults. You must be 18 or over to use it, and we do not knowingly hold information about anyone younger.
Changes
If we change this notice in a way that matters, we will tell you in the app before it takes effect and ask again for your consent where the law requires it.
Version 1.0, 3 October 2026.