Tummi Limited (“we”) are committed to protecting and respecting your privacy. We have in place a comprehensive Company data protection policy and code of practice. We are registered with the UK Information Commissioner’s Office as a Data Controller (Reg No. ZA547760).
1. Purpose of this Policy
2. Which data we hold and how we get it
We may collect and process information provided by filling in forms on the Website or App, including information provided during the completion of surveys and other online tools, posting of comments in the Community or requesting further services, and when you report a problem with our System. If you contact us, we may also keep a record of that correspondence. Tummi also collects and processes data with the meal tracking technology with provide you as part of the System.
Throughout your use of the System we may collect information such as: personal data (including but not limited to first and last names, date of birth or age, address, email, phone number); lifestyle or health data.
We collect as well technical information and analytics from you concerning your use of the System, including but not limited to pages visited, links clicked, non-sensitive text entered, system and operating system type and version, browser or app version, time zone setting and usage of our iPhone and Android apps.
The information described in this Policy that is collected through either the System, Apple HealthKit / Google Fit, or your electronic patient record is known as “personal data”.
But don’t worry, we are required by law to maintain the privacy of your personal data and lifestyle or health data and to provide you with this notice of our legal duties and privacy practices with respect to them. When we use or disclose your personal data, we are required to abide by the terms of this Policy (or other Policy in effect at the time of the use or disclosure).
3. IP addresses and cookies
We may collect information about your device, including where available your IP address, operating system, browser type and screen size for use in system administration, to tailor your experience of the System, provide you with customer support and to report aggregate information internally.
For the same reason, we may obtain information about your usage of the System by using a cookie file which is stored on the hard drive of your device. Cookies help us to give you a smooth user experience, improve the System and deliver a better and more personalized service. They enable us: To recognize you when you return to our site. To maintain data you have entered e.g. during completion of a survey. To speed up your searches. To estimate our audience size and usage pattern. To store information about your preferences, and so allow us to customize our site according to your individual interests.
Both Tummi and third-party vendors, including Google, may use first-party cookies (such as the Google Analytics cookie) to inform, optimize, and serve ads based on your past visits to the Website on sites across the Internet (also known as ‘remarketing’). If you would like to opt out of this you can do so via your Google Ads Preferences Manager.
4. What we use your data for
Tummi is dedicated to maintaining the privacy and integrity of your personal data. As such, we have policies and procedures and other safeguards to help protect your personal data from improper use and disclosure.
We collect and use your personal data to deliver our contract to you. We may collect and use your health data only if you have given us your specific consent.
We may use and disclose your personal and special category data for our internal operations, which include administration, planning and various activities that assess and improve the quality and cost effectiveness of the service that we deliver to you. Examples are using information about you to improve quality of the service, satisfaction surveys, de-identifying personal data, customer services and internal training. We may use and disclose your personal data to contact you as a reminder to interact with, or complete tasks relating to your use of the System.
We follow a Minimum Necessary Access Policy, so any required disclosure of your identifiable information is minimized. The following categories describe different ways that we use your personal data within Tummi and disclose your personal data to persons and entities outside of Tummi. We have not listed every use or disclosure within the categories below, but all permitted uses and disclosures will fall within one of the following categories. In addition, there are some uses and disclosures that may require your specific authorization.
How much personal data is used or disclosed without your written permission will vary depending, for example, on the intended purpose of the use or disclosure.
Disclosure at your request: We may disclose information relating to your use of the System when requested by you. This disclosure at your request may require written authorization by you.
Payment: We do not store your credit/debit card details; they are processed directly by a third party processor that will store all payment information and transaction details. We will only retain details of transactions on secure servers and we will not retain your credit or debit card information.
Operations: We may use and disclose your personal data for our internal operations, which include administration, planning and various activities that assess and improve the quality and cost effectiveness of the service that we deliver to you. Examples are using information about you to improve quality of the service, satisfaction surveys, de-identifying personal data, customer services and internal training.
Reminders and notifications: We may use and disclose your personal data to contact you as a reminder to interact with, or complete tasks relating to your use of the System.
Third party service providers:
We may share anonymised information with third-party service providers who assist us in our marketing and advertising activities or in the improvement of Tummi app or website. These are third party services that allow Tummi to collect information from you concerning your use of the System, including but not limited to pages visited, links clicked, non-sensitive text entered and usage of our iPhone and Android apps. These services are used to help Tummi enhance or improve the user experience on this website and to perform any other function that Tummi reasonably believe in good faith is required to protect and ensure the proper functionality and security of this website.
Third party medical professionals: with additional permission that we will separately explain to you and request your consent for, we may disclose your personal data to a third-party medical professional nominated by you: e.g. your GP or local NHS service. This may be in the form of an electronic disclosure to an electronic patient record.
Threat to health or safety: We may use and disclose your personal data when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.
As required by law: Certain laws permit or require certain uses and disclosures of personal data for example, for public health activities, health oversight activities and law enforcement. In these instances, Tummi will only use or disclose your personal data to the extent the law requires.
For research and publicity purposes: We may use personal data for internal and external research and publicity purposes. This may include publishing aggregate, anonymous information about our users in the context of providing public information and conducting academic research.
Transfer of business assets: If Tummi or substantially all of its assets are acquired by a third party, personal data held by it about its customers will be one of the transferred assets.
Except as described above, we will never share your personal information with any other party without your consent.
5. Where we store your personal data
All information and data you provide to us is stored on secure servers with trusted 3rd party suppliers, Amazon Web Services (‘AWS’) within the European Economic Area (‘EEA’). AWS complies with EU Data Protection Directive (‘Directive 95/46/EC’), which sets out several data protection requirements, which apply when personal data is being processed. AWS are industry leaders in the provision of hosting services and take security very seriously – you can find out more about their security policies and processes in their .
Unfortunately, despite these measures, the transmission of information via the internet is never completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to the System, and any transmission is at your own risk. Once we have received your personal data, we will use strict procedures to try to prevent unauthorized access in accordance with our Company data protection policy and code of practice.
6. Your rights regarding your personal data
You have certain rights with respect to your personal data. If we do not agree to a request by you with respect to your personal data, please contact us.
If we do not comply with any of the below, you have the right to complain to the ICO and to a judicial remedy without undue delay and at the latest within one month.
Restrictions: You have the right to request in writing that we do not disclose certain information about you. To request a restriction, please contact the Privacy and Security Officer whose contact information is below.
Confidential Communications: You have the right to request in writing that we restrict the way in which we communicate information regarding your health and health care services, such as ceasing to send email or SMS messages to notify or remind you about aspects of the System or your progress through the Tummi program. We will make every effort to accommodate your request.
Access: You have the right to inspect and copy your personal data maintained by us. Normally, we will provide you with access within one month of your request.
To request your data:
Please download a subject access request form, fill it in and return it to us using the contact details on the form, along with copies of information that confirms your identity (if applicable). Please do not send in any original copies of documents. More details of acceptable types of identification documents are included in the application form.
You can email your completed form and electronic copies of your identification documents to: support@Tummi.co.uk
Or print the form, fill it in and post it with paper copies of your identification documents to:
80 wood lane London
We will endeavour to respond promptly and in any event within one month.
Deletion: You have the right to ask that we delete all information that the System has collected on you via email to the Tummi privacy and Security whose contact information is below.
Amendment: You have the right to request that we amend your written personal data. For instance, you can request that we correct an incorrect date of birth in your records. We will amend your personal data within one month of your request, and will notify you when we have amended your personal data. We can deny your request in certain circumstances, such as when we believe that your personal data is accurate and complete.
Accounting: You have the right to request an accounting from us of certain disclosures made by us. We will provide you with your accounting within one month of your request. In addition, we will notify you as required by law if there has been a breach of the security of your personal data.
Data Portability: You have the right to obtain and reuse your personal data from Tummi for your own purposes across different services. This can be freely downloaded in .csv format within the settings page of your Tummi account.
Objection: You have the right to object to processing based on legitimate interests or the performance of a task in the public interest, to direct marketing, and to processing for the purposes of scientific research & statistics. To request an objection, please contact the Privacy and Security Officer whose contact information is below.
Automated Decision Making & Profiling: You have the right not to be subject to a decision based on automated processing and it produces a legal effect or a similarly significant effect on you. To request an opt-out of automated decision making & profiling, please contact the Privacy and Security Officer whose contact information is below.
7. Data Retention
As per the ICO’s ‘Principle 5’, we retain personal data no longer than is necessary for the purpose we obtained it for. With the context that your personal data may be used for research purposes (as covered in section 3), Tummi will retain any information held on an individual for up to 10 years after that individual has ceased use of the System. At that point, the individual’s information will be deleted. As covered in section 5, you may request that we delete your data at any time.
8. Data Breach
Tummi’s information systems are highly protected, encrypted, and secure – but no system is completely impenetrable. Tummi has procedures and tools in place to detect, report, and investigate a data breach. When a breach may result in a high risk to your rights and freedoms, we will notify both you and the ICO of this.
9. Concerns or complaints
If you believe that any of your rights with respect to your personal data has been violated by us, our employees or agents, please communicate with the Tummi Privacy and Security Officer at: support@Tummi.co.uk
10. Amending this Policy
We reserve the right to revise this Policy and to make the revised Policy effective for all personal information that we created or received prior to the effective date of the revised Policy. If you are a registered user, we will notify you of changes by the email address we have for you on file.
Questions relating to revisions to this Policy may be addressed to the Privacy and Security Officer whose contact information is above. This Policy will be promptly revised if there is a material change to a policy described herein.
Effective Date: This Policy is effective as of 1 September 2019