Privacy policy

Privacy Policy

Last updated: 18 September 2026

This policy explains what personal information CoreOptimise Ltd collects, why we use it, who we share it with, how long we keep it and the choices and rights available to you.

CoreOptimise Ltd operates this website and related online services (together, the "Services"). This Privacy Policy applies when you browse our website, create an account, purchase or return a product, subscribe to marketing, leave a review, use our chat or AI-assisted support tools, use My CoreOptimise® Health & Performance, connect supported health platforms, contact us or otherwise interact with the Services.

Please read this policy alongside our Terms & Conditions, our Privacy & Data Choices page and any cookie choices presented through our website.

1. Who we are and who controls your information

CoreOptimise Ltd is the data controller for the personal information described in this policy, except where another organisation explains that it acts as a separate controller.

Company number: 16624093

Business address: International House, 61 Mosley Street, Manchester, M2 3HZ, United Kingdom

Email: contactteam@coreoptimise.co.uk

2. Personal information we collect

The information we collect depends on how you use the Services and may include:

Identity and contact information: name, email address, telephone number, billing address, delivery address and postcode.

Order and transaction information: products viewed, added to a basket, purchased, returned or cancelled; order history; delivery status; discounts and transaction references.

Payment information: payment method, payment status and related transaction identifiers. Full payment-card details are generally processed by our payment providers and are not directly stored by us.

Account information: account identifiers, login credentials in protected form, preferences and saved settings.

Communications and support information: messages, chat transcripts, AI-assistant interactions, enquiries, complaints, return requests and information you provide when communicating with us.

Reviews and user content: ratings, written reviews, photographs, videos or other content you choose to submit.

Marketing information: subscription status, communication preferences, campaign engagement and records of consent or opt-out choices.

Device and technical information: IP address, browser, device type, operating system, network information, cookie identifiers and similar online identifiers.

Usage information: how you navigate and interact with the website, pages and products viewed, referring pages, approximate location derived from IP address and interaction timestamps.

Inferences: preferences or likely interests derived from purchases or website activity, where permitted.

Health, fitness and other special-category information: if you choose to use My CoreOptimise® Health & Performance, you may provide or connect information relating to your health, fitness and wellbeing. This can include body measurements, activity and training data, heart-rate and recovery metrics, sleep information, nutrition context, manually entered blood-result information and other Health Profile information that you choose to save.

Some of this information is special-category personal data under UK data-protection law because it concerns your health. Providing or connecting this information is optional. We process it only for the specific My CoreOptimise® health, fitness and personal-intelligence purposes explained in this policy and according to the permissions and choices you select.

If you connect Apple Health or Android Health Connect, CoreOptimise® receives only the categories of data that the relevant platform makes available after you grant permission. You can change or revoke platform permissions at any time through your device settings.

3. Where personal information comes from

We may collect personal information:

  • directly from you, including at checkout, through forms, account registration, reviews, subscriptions, chat and customer-support communications;

  • automatically, through cookies, pixels, local storage and similar technologies when you use the Services;

  • from service providers, including Shopify, payment providers, couriers, fulfilment providers, analytics services, marketing platforms, review providers, customer-support tools and AI-assistance providers;

  • from connected health platforms that you choose to authorise, including Apple Health through HealthKit and Android Health Connect;

  • from information you choose to save in My CoreOptimise®, including Health Profile, training, recovery, nutrition, journal and optional blood-result context;

  • from marketplaces and partners, where you purchase through, interact with or authorise a third-party platform to share information with us; and

  • from publicly available or lawful third-party sources, where relevant and permitted.

4. How and why we use personal information

UK data-protection law requires us to have a lawful basis for processing personal information. The bases that most commonly apply are performance of a contract, compliance with a legal obligation, our legitimate interests and consent.

Orders and delivery. We use identity, contact, payment, order and transaction information to process payments, accept and fulfil orders, arrange delivery, manage returns and provide order updates. Our lawful bases are performance of a contract and legal obligations.

Accounts and settings. We use identity, contact, account and preference information to create and manage customer accounts and remember requested settings. Our lawful bases are performance of a contract and our legitimate interests in providing a functional service.

My CoreOptimise® Health & Performance. If you choose to use these features, we use the health, fitness and wellbeing information you provide or connect to display your Health Profile, maintain trends and history, show source information and freshness, resolve conflicting readings, support data export and deletion, and connect your selected health context with the other My CoreOptimise® features you choose to use.

Where this information is health data or otherwise special-category data, our intended basis is your consent under Article 6(1)(a) UK GDPR and your explicit consent under Article 9(2)(a) UK GDPR, where applicable. Connected-health features are optional and you may withdraw consent or disconnect a source at any time. Withdrawal does not affect processing that was lawful before withdrawal.

Apple Health / HealthKit. If you pair the CoreOptimise® iPhone companion app and grant HealthKit permission, the app can read only the health and fitness data types you approve. The planned V1 read scope includes height, body mass, body-fat percentage, steps, walking/running distance, active energy, heart rate, resting heart rate, heart-rate variability (SDNN), VO₂ max, sleep information and workouts.

The V1 companion app is read-only and is not designed to write health information back to Apple Health. CoreOptimise® does not use information obtained through HealthKit for advertising, marketing, advertising profiling or sale to data brokers.

Android Health Connect. If you pair the CoreOptimise® Android companion app and grant Health Connect permissions, we process the approved health and fitness categories to provide equivalent Health & Performance functionality. Missing or unapproved information is not treated as a zero value.

Optional AI Context Intelligence. AI Context Intelligence is separate from basic Health & Performance storage and display. It is optional and is controlled by a separate permission within My CoreOptimise®.

If you enable AI Context Intelligence, selected Health & Performance information, your saved supplement Stack and relevant saved CoreOptimise® Intelligence context may be sent securely through the CoreOptimise® backend to OpenAI's API to generate an explainable summary for you.

We use this information only to provide the AI-assisted feature that you have chosen to use. We do not use HealthKit-derived information for advertising or marketing, and we do not sell it. You can disable AI Context Intelligence at any time.

Customer service and AI-assisted support. We use contact, order, communication and support information to answer enquiries, provide general product guidance, generate or suggest responses, route conversations to a human team member and manage complaints or disputes. Our lawful bases are performance of a contract and our legitimate interests in providing customer service and protecting legal rights.

Security and fraud prevention. We use account, transaction, device, technical and usage information to secure the website, authenticate users, prevent fraud and investigate misuse. Our lawful bases are our legitimate interests in security and fraud prevention and legal obligations.

Legal and compliance records. We use identity, contact, order, transaction and communication information to maintain financial, tax, product-safety and other compliance records and to respond to lawful requests. Our lawful bases are legal obligations and our legitimate interests in establishing and defending legal rights.

Service improvement and analytics. We use device, technical, usage, order and feedback information to understand performance, troubleshoot and improve our products and Services. Our lawful bases are our legitimate interests in improving our business and Services, and consent where required for cookies or similar technologies.

Marketing. We use contact, preference, order and marketing information to send requested marketing and measure campaign engagement. Our lawful bases are consent where required and our legitimate interests where direct-marketing law permits.

Personalisation and advertising. We use cookie identifiers, device, usage, order and inferred-interest information to personalise content or advertising and measure effectiveness. Our lawful basis is consent where required and legitimate interests where permitted.

Health information obtained through Apple Health / HealthKit or Android Health Connect is excluded from these advertising uses.

Reviews and submitted content. We use your name or display name, review, rating and submitted media to publish and manage content you choose to submit. Our lawful basis is consent and/or our legitimate interests in providing customer reviews, depending on the context.

Where we rely on legitimate interests, we consider whether our interests are proportionate and whether your rights and reasonable expectations outweigh them. Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.

Our AI-assisted support tools are intended to help answer general questions and route enquiries. They do not make decisions that produce legal or similarly significant effects about you. You may ask to speak with a human team member at any time.

5. Cookies, analytics and online advertising

We and our service providers use cookies and similar technologies to operate the website, remember settings, keep the store secure, understand website performance and, where permitted, personalise content or advertising.

Some cookies are necessary for the website and checkout to function. Non-essential analytics, personalisation or advertising technologies are used in accordance with applicable consent requirements.

Health data is excluded from advertising use. CoreOptimise® does not use information obtained through Apple Health / HealthKit or Android Health Connect for targeted advertising, advertising measurement, direct-marketing profiling, sale to data brokers or similar advertising purposes.

You can use the cookie banner or privacy-preferences tool available on the website to manage applicable choices. You can also adjust browser controls, although blocking essential cookies may prevent parts of the Services from working correctly.

6. Who we share personal information with

We may share personal information where necessary with:

  • commerce and hosting providers including Shopify;

  • payment and fraud-prevention providers that process and secure transactions;

  • fulfilment, warehousing, courier and delivery providers that prepare and deliver orders;

  • technology, cloud, analytics and security providers that support and protect the Services, including Cloudflare for secure backend, account-sync, connected-health and security infrastructure;

  • OpenAI, only where you separately enable AI Context Intelligence, to process the selected information needed to generate the requested AI-assisted summary;

  • email, SMS, advertising and marketing providers subject to applicable consent and marketing rules;

  • review, customer-support, chat, communication and AI-assistance providers used to manage enquiries, generate or suggest support responses and process customer content;

  • professional advisers such as accountants, insurers, legal advisers and auditors;

  • regulators, courts, law-enforcement bodies or public authorities where disclosure is required or permitted by law; and

  • a buyer, seller or adviser involved in a business reorganisation, investment, merger or sale subject to appropriate safeguards.

We may also share information where you direct us to do so or give valid consent. Service providers are permitted to use information only as allowed by their contract and applicable law. Some providers may also act as independent controllers for particular activities and will provide their own privacy information.

We do not sell personal information for money. Certain advertising-related disclosures may be treated as "sale", "sharing" or targeted advertising under some non-UK privacy laws; where applicable, relevant choices will be provided.

HealthKit-derived information is not shared with advertising platforms, data brokers or marketing services for advertising or marketing purposes.

7. Our relationship with Shopify

Our store is hosted by Shopify, which provides the ecommerce technology used to deliver the Services. Information submitted through the store is transmitted to and processed by Shopify and its service providers so that the website, checkout, payments, security and related functionality can operate.

Shopify may also process information as an independent controller for certain features and to improve or personalise its services across merchants. You can learn more in the Shopify Privacy Policy and use the Shopify Privacy Portal for relevant Shopify-level requests.

8. Marketing and communication choices

You can unsubscribe from promotional emails by using the unsubscribe link in any marketing email. Where SMS marketing is offered, you can use the opt-out method stated in the message. You may also contact us to update your preferences.

Opting out of marketing does not prevent us from sending non-promotional communications needed to manage an order, account, return, safety matter or legal obligation.

Your right to object: You have an absolute right to object to the use of your personal information for direct marketing. Once we receive a valid objection, we will stop using the relevant information for that purpose.

9. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to:

  • fulfil orders and provide customer support;

  • maintain an account or subscription;

  • meet tax, accounting, product-safety and other legal obligations;

  • prevent fraud and maintain security;

  • manage complaints, disputes and legal claims; and

  • retain suppression records so that marketing opt-outs continue to be respected.

Retention periods vary according to the type of information, the relationship with you, legal requirements, limitation periods, risk and whether the information can be securely deleted or anonymised. When information is no longer required, we delete, anonymise or securely restrict it as appropriate.

Health & Performance information. Health Profile and connected-health information is retained while you choose to keep it in My CoreOptimise® and for as long as reasonably necessary to provide the features you requested.

Revoking Apple Health or Health Connect permission on your device stops future access by the companion app, but it may not automatically delete information already synchronised to your CoreOptimise® account. To remove previously synchronised information, use the My CoreOptimise® disconnect/delete controls or contact us.

We do not retain health information for advertising or marketing purposes.

10. International transfers

Some of our providers, including Shopify and providers supporting payments, hosting, analytics, marketing, customer service and AI-assisted support, may process information outside the United Kingdom.

Where a restricted transfer is made, we use a lawful transfer mechanism as applicable, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another permitted safeguard. You may contact us for further information about the safeguards relevant to your information.

Where optional AI Context Intelligence is used, selected information may be processed by OpenAI and its service infrastructure in locations permitted under our provider arrangements. We do not promise a specific processing region unless that region is actually configured for the relevant service.

11. Security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, misuse, alteration, unauthorised access or disclosure. These may include access controls, secure service providers, encrypted connections, authentication measures, monitoring and staff or contractor confidentiality requirements.

Connected-health information is transmitted over encrypted connections and associated with the authenticated CoreOptimise® customer account through secure pairing and server-side access controls. Mobile pairing codes are time-limited and single-use, and paired-device credentials can be revoked when a connected source is disconnected or the companion app is unpaired.

No system is completely secure. Please use a strong, unique password where an account is available, keep login details confidential and avoid sending payment-card details or other sensitive information through ordinary email or public messaging channels.

12. Your data-protection rights

Depending on the circumstances and applicable law, you may have the right to:

  • request access to your personal information and related information about its use;

  • ask us to correct inaccurate or incomplete information;

  • ask us to erase information in certain circumstances;

  • ask us to restrict processing in certain circumstances;

  • object to processing based on legitimate interests and object to direct marketing;

  • receive certain information in a structured, commonly used and machine-readable format, and request transfer where applicable;

  • withdraw consent where processing relies on consent; and

  • complain to the Information Commissioner’s Office.

For Health & Performance information, you can also:

  • change or revoke Apple Health / Health Connect permissions through your device;

  • disconnect a connected health source from My CoreOptimise®;

  • unpair a paired mobile companion app;

  • disable optional AI Context Intelligence;

  • export available Health & Performance information; and

  • use the available Health Profile deletion controls.

Where we rely on consent or explicit consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

These rights are not absolute and may be subject to legal conditions or exemptions. We may ask for information needed to verify your identity and protect your data before acting on a request. We normally respond within the period required by law.

To exercise a right, email contactteam@coreoptimise.co.uk with the subject line "Data Protection Request".

You can also review the practical controls available to you on our Privacy & Data Choices page.

13. Children’s information

The Services and our food supplements are not directed at children. We do not knowingly collect personal information from children for the purpose of selling products to them.

If you are a parent or guardian and believe a child has provided personal information to us, contact us so that we can investigate and take appropriate action.

14. Third-party websites and platforms

The Services may contain links to third-party websites, social networks, marketplaces or other platforms. Those organisations control their own privacy and security practices. Review their privacy notices before providing information to them.

We are not responsible for third-party content or privacy practices merely because a link appears on our website.

15. Changes to this policy

We may update this Privacy Policy to reflect changes to our Services, providers, business operations or legal requirements. The revised version will be posted on this page with an updated date. We will provide additional notice where required by law.

16. Contact us and make a complaint

Questions, rights requests and privacy complaints can be sent to:

Email: contactteam@coreoptimise.co.uk

Contact page: www.coreoptimise.co.uk/pages/contact

Address: CoreOptimise Ltd, International House, 61 Mosley Street, Manchester, M2 3HZ, United Kingdom

Please contact us first so we have an opportunity to investigate and respond. You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Website: ico.org.uk/make-a-complaint

CoreOptimise Ltd | Privacy Policy