Privacy Policy — Hea NHS Navigator
Last updated: 9 July 2026 (draft) Applies to: the Hea NHS Navigator service at navigator.tryhea.com (the "Service"). Our marketing site at www.tryhea.com is operated separately and has its own notices.
Draft for review. This is a protective template prepared for the Hea NHS Navigator. It is not legal advice and should be reviewed by a qualified solicitor / privacy adviser (UK GDPR) before publication. Bracketed items
[ ]must be completed.
1. Who we are (data controller)
The data controller for the Service is HEA Europe Ltd, a company registered in England and Wales (Company No. 15400266), registered office: Snowdrop Court, 21 Royal Engineers Way, London NW7 1TU, United Kingdom ("Hea", "we", "us").
- Contact for privacy matters: hello@tryhea.com
This Policy is written for the Navigator. Other Hea products (for example the Hea health companion) have their own separate policies.
2. Important note about health information
The Navigator is an information-only service. You do not need an account to use it, and you should not enter information that identifies you together with sensitive details about your health. Where you do type a description of a symptom or need so we can return relevant information, we process that text only to generate your results and to operate and improve the Service — not to build a health profile about you. We also keep de-identified, aggregate statistics about the kinds of needs people search for (a matched category and a copy of the text with personal identifiers removed), held separately, with no link to you, your device, your session or your email, so we can understand common needs and improve the Service.
3. What we collect
Information you provide:
- the search text / description you type to find services;
- the postcode or area you enter to find local providers;
- your email address, if you choose to leave it to be notified about the Service (for example, when automated enrolment goes live) — this is optional; if you give it, we store only your email, the page you gave it on, the language, and any campaign (UTM) tag — never your search text or health details — we use it only to send you what you asked for, and you can ask us to remove it at any time (see §9);
- anything you send us by email.
Information that stays on your device (we do NOT receive or store it): the optional Right to Choose letter tool lets you enter details — including name, date of birth and NHS number — to build a GP letter. Those details are processed entirely in your browser to generate the letter; the letter and those details are not transmitted to or stored by us (see §5).
Information collected automatically when you use the Service:
- usage and analytics data (pages viewed, links/outbound clicks, approximate location at area level, referrer);
- device and technical data, including IP address, browser and device type;
- cookies and similar technologies (see §8).
We use Google Analytics (Google LLC) and Mixpanel for product analytics to understand usage and improve the Service. Both are set when you use the Service and load on all pages (see §8). You do not need an account, and the core navigator never asks for your name, date of birth or NHS number. The optional Right to Choose letter tool lets you enter those locally in your browser to build a letter — but, as noted above, that letter stays on your device and is not sent to or stored by us.
We also use the Meta (Facebook) Pixel to measure the effectiveness of our advertising and for retargeting. It loads when you use the Service and tells us, in aggregate, when an advert led someone to view a page, sign up with their email, or reach our results. We never send health information to Meta: the Pixel receives only standard events (such as a page view, an email sign-up, or that results were shown) with no service names, conditions, symptoms, postcodes, email addresses or free text.
4. How we use information and our legal bases (UK GDPR)
| Purpose | Legal basis |
|---|---|
| Provide the Service and return relevant results to your query/postcode | Legitimate interests (Art. 6(1)(f)) — to operate an information service you requested |
| Process query text through our matching/AI logic to find services | Legitimate interests (Art. 6(1)(f)); where text includes health details, processing is to fulfil your request and you choose what to enter |
| Product analytics and improving the Service | Legitimate interests (Art. 6(1)(f)) — for Google Analytics and Mixpanel. Cookies are governed by §8 |
| Measuring advertising effectiveness and retargeting (Meta Pixel) | Legitimate interests (Art. 6(1)(f)) — to measure and improve our advertising; advertising cookies are governed by §8. No health data is sent to Meta |
| Send you the product updates / newsletter you signed up for | Consent (Art. 6(1)(a)); you can withdraw it (unsubscribe) at any time |
| Respond to your emails | Legitimate interests (Art. 6(1)(f)) |
| Security, fraud/abuse prevention, and legal compliance | Legitimate interests (Art. 6(1)(f)); Legal obligation (Art. 6(1)(c)) |
We do not use your information to make automated decisions that produce legal or similarly significant effects, and we do not sell your information.
5. Draft GP letters
Any draft letter is generated and displayed in your browser. We do not store the contents of your letter on our servers by default. If a future feature lets you email or save a letter, we will ask for your consent and update this Policy first.
6. Sharing and processors
We share information only with:
- service providers (processors) acting on our instructions, for example hosting (Railway), product analytics (Google LLC (Google Analytics) and Mixpanel, Inc.), advertising measurement and retargeting (Meta Platforms, Inc. — the Meta/Facebook Pixel, which receives only non-health standard events), and the provider of our matching/AI logic (OpenRouter, routing to Google (Gemini)), under appropriate contracts. if you leave your email to be notified, it is stored in our own database hosted by Railway (no third-party mailing list); if we later use a dedicated email-delivery provider, we will update this list first;
- authorities where required by law, regulation or valid legal process;
- a successor in the event of a merger, acquisition or reorganisation, subject to this Policy.
We do not sell personal data and we do not share your information with healthcare providers or insurers.
7. International transfers
We are part of a group with a US parent (Hea Inc.), and some processors (for example analytics, advertising or AI providers) may process data outside the UK. In particular, Google Analytics and the Meta Pixel process data on Google and Meta infrastructure that may be located outside the UK (including the USA). Where personal data is transferred outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
8. Cookies
We use:
- essential cookies needed for the Service to function;
- Google Analytics cookies (for example
_ga,_ga_*) to measure usage and traffic. Google Analytics loads on all pages when you use the Service. You can opt out using Google's browser add-on (tools.google.com/dlpage/gaoptout) or your browser controls; - Meta (Facebook) Pixel cookies (for example
_fbp) for advertising measurement and retargeting. The Pixel loads when you use the Service and receives only non-health standard events (page view, email sign-up, results shown). You can control these through your browser, your Meta ad preferences, and the opt-outs at the Your Online Choices website; - Mixpanel analytics cookies, set when you use the Service to measure product usage.
We do not currently display a cookie consent banner — analytics (Google Analytics, Mixpanel) and advertising (Meta Pixel) cookies are set when you use the Service. To limit them, use the opt-outs above or your browser settings. You can control or delete cookies through your browser at any time.
9. Data retention
- Analytics data is retained for 14 months in line with our analytics configuration, then deleted or aggregated.
- Newsletter subscription data (your email and subscription status) is kept until you unsubscribe, after which it is removed or suppressed from the active list.
- Emails are retained only as long as needed to handle your enquiry and for our records.
- We do not retain your query text or letter contents beyond what is needed to operate the Service and, where applicable, short-lived server logs. Separately, we keep de-identified, PII-scrubbed complaint statistics (a matched category, the interface language, and a redacted phrase, with no identifiers and no link to you) to understand common needs and improve the Service.
10. Your rights
Under UK GDPR you have the right to: access your personal data; request correction or erasure; restrict or object to processing; data portability; and withdraw consent at any time (without affecting prior processing). To exercise any right, contact hello@tryhea.com.
You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk, helpline 0303 123 1113.
11. Security
We use appropriate technical and organisational measures to protect information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Children
The Service is intended for users aged 16 or over and is not directed at children under 16. We do not knowingly collect personal data from children under 16; if you believe a child has provided us data, contact us and we will delete it.
13. Third-party sites
The Service links to third-party websites (including NHS.uk and provider sites). Their privacy practices are governed by their own policies, which we do not control.
14. Changes to this Policy
We may update this Policy from time to time. We will indicate changes by updating the "Last updated" date and, for material changes, by a notice on the Service.
15. Governing law
This Policy is governed by the laws of England and Wales.
16. Contact
HEA Europe Ltd Snowdrop Court, 21 Royal Engineers Way, London NW7 1TU, United Kingdom Email: hello@tryhea.com