Privacy Policy

Who we are and who controls your data

Normal is a private, clinician-led service for adults in the United Kingdom. Normal is the trading name of Eco Science Limited, a company incorporated in the Cayman Islands, and Eco Science Limited is the data controller for the personal information used to run this website, run assessments, arrange treatment, provide support and meet its legal obligations. "Normal", "we" and "us" mean that company.

Controller

Normal is the trading name of Eco Science Limited, registered in the Cayman Islands

Privacy enquiries and rights requests

hello@whatsnormal.com

UK and EEA representative, Article 27 UK GDPR and EU GDPR

hello@whatsnormal.com

Data Protection Officer

dpo@mishcon.com

You can contact the Data Protection Officer directly, in confidence, about anything in this policy, and you do not have to go through us first.

Because we are established outside the United Kingdom and the European Economic Area, three sets of rules protect you at the same time:

• the Cayman Islands Data Protection Act (2021 Revision), because Eco Science Limited is established in the Cayman Islands;
• the UK GDPR and the Data Protection Act 2018, under Article 3(2) UK GDPR, because we offer this service to people in the United Kingdom and show prices in pounds; and
• the EU GDPR, under Article 3(2), because we offer this service to people in the European Economic Area.

Where those rules differ, we apply the standard that protects you most, and we do not treat our location outside the UK and the EEA as a reason to give you less. Nothing in this policy limits a right you have under any of them.

Scope of this policy

This policy applies when you visit whatsnormal.com, complete the free assessment, create an account, buy or receive treatment, use the support built into your account, or contact us. Read it alongside our Terms and Conditions.

It does not replace the privacy notice of the dispensing pharmacy, or of a clinician involved in your care. They hold records of their own and have their own obligations, and we explain the split below.

The assessment itself runs on a separate application at waitlist.whatsnormal.com. Everything you type into the assessment is collected there, not on the pages you are reading now.

Useful terms

A few words appear throughout, and they have specific meanings.

• Assessment means the online questions you complete so a clinician can consider whether treatment is appropriate for you.
• Clinician means a UK-registered healthcare professional who reviews your assessment and, where appropriate, prescribes.
• Pharmacy means Smartway Pharma Limited, which dispenses and supplies prescriptions.
• Controller means the organisation that decides why and how personal information is used. It is the one accountable for it.
• Processor means an organisation that uses personal information only on a controller's written instructions, and never for its own purposes.
• Special category data means the categories the UK GDPR protects most strictly, which for us means health information. Everything you tell the assessment is in this category.
• Personal information and personal data mean the same thing: information that identifies you, or could identify you when combined with something else.

Who this policy covers

Most of this policy is about people who use the service, because that is where nearly all the information we hold comes from. It also covers everyone else whose information reaches us.

Our role, and the role of the pharmacy and clinicians

Three different organisations touch your information at different points, and they do not all have the same role in law. Getting this right matters, because it decides who you ask when you want a copy of something, or want something corrected.

Where Normal and a clinician or the pharmacy decide something together, for example how the assessment is routed to the right clinician, we may be joint controllers for that specific step.

Information we collect

• identity and contact details, such as your name, email address, telephone number, delivery address and date of birth;
• your assessment answers, including what you tell us about drinking or porn use, your goals, and any history you choose to give. Fertility is not open yet: if you join the waitlist we hold only your email address;
• the score or result the assessment produces, and which area you selected;
• health information you or a clinician add, including conditions, current medicines, allergies, previous treatment and safety information;
• records of clinical review, what was recommended, and whether treatment was approved or declined;
• anything you write to the support built into your account, and the record of those exchanges ;
• identity verification data: an image of the photo identity document you provide, a facial image, and the result of the check. A facial similarity check produces biometric data, which the UK GDPR protects as strictly as health information;
• order, delivery, subscription and refund records. Full card details are handled by our payment provider, and we do not receive or store them;
• messages, support conversations, feedback and complaints, and how a concern was handled;
• technical and usage data, such as IP address, device and browser information, security events, page requests, timestamps and cookie or storage identifiers; and
• marketing preferences, and records of consent or objection.

Please do not send more health information than the assessment or your clinician reasonably needs, and do not give us another person's information unless you have their authority.

Where information comes from

Most of it comes directly from you. Some is collected automatically from your browser or device. Some comes from the clinicians and the pharmacy involved in your care, for example confirmation that a prescription was dispensed or that an order was delivered. Some comes from the advertising platform that sent you here, in the form of the campaign identifiers in the link you clicked. We may also receive information from a person lawfully acting for you.

Why we use information, and our legal bases

Under the UK GDPR we need an Article 6 basis for any personal information, and an additional Article 9 condition on top of that for health information. Where we rely on Article 9(2)(h) or 9(2)(i) we also need a condition in Schedule 1 of the Data Protection Act 2018, which is set out in the section after this one.

Where we rely on legitimate interests, we have weighed our interest against your rights and you can ask us for that assessment. We do not sell personal information, and we do not use health information for advertising.

Information we need, and what happens if you do not provide it

Some questions are required, because a clinician cannot make a safe decision without them, because we must confirm you are 18 or over, or because the law requires it. If required information is not provided we may not be able to continue. You can stop at any point before treatment is approved, without giving a reason.

How we use health information

What you tell us about drinking, porn use or fertility is health information, and under the UK GDPR it is special category data. It gets the strictest handling we have. We use only what is reasonably necessary to run the assessment, let a clinician reach a decision, arrange dispensing, support you, and keep the records we are required to keep.

We do not use health information to target advertising, we do not build advertising audiences from it, and we do not share it with advertising platforms. It is available inside Normal only to the people who need it for the task in front of them, and every one of them is under a confidentiality obligation.

The conditions we rely on for health information

Article 9(2)(h) of the UK GDPR is not enough on its own. Section 10(2) of the Data Protection Act 2018 says that when we rely on Article 9(2)(b), (h), (i) or (j) we must also meet a condition in Part 1 of Schedule 1 to that Act. Section 10(3) says the same for Article 9(2)(g) and Part 2. Section 11(1) sets out who counts as owing the obligation of secrecy that Article 9(3) requires. Here is what we rely on, and whether an appropriate policy document is needed for each.

The short version: our everyday clinical processing does not need an appropriate policy document, but our safeguarding, fraud and regulatory processing does. We hold one. It was approved on 6 October 2026 and is reviewed at least every 12 months. You can ask us for a copy at hello@whatsnormal.com.

Confidentiality, which is separate from data protection

Most privacy policies stop at the UK GDPR. In the UK, health information is protected twice over, and the second protection is older than the first.

What you tell a clinician in the course of your care is confidential under the common law duty of confidence. That duty is owed to you directly by the clinicians and by the pharmacy, and by us where we hold information given in confidence. It exists whether or not the UK GDPR applies, and meeting the UK GDPR does not by itself satisfy it. A disclosure that has a lawful basis under Article 6 and a condition under Article 9 can still be a breach of confidence.

Information given in confidence is disclosed only where one of the following applies:

• you consent to the disclosure, which is the ordinary route;
• the law requires it, for example a court order or a statutory reporting duty;
• there is an overriding public interest in disclosure, which is the test applied where there is a serious risk of harm to you or to somebody else; or
• it is necessary to protect someone's vital interests and they cannot consent.

Where we can, we will tell you before a confidential disclosure is made, and we will disclose the minimum needed. The clinicians and the pharmacy also owe you their own professional obligations to the General Medical Council, the General Pharmaceutical Council or their own regulator, which sit on top of both the common law and the UK GDPR.

Who receives information

We name our suppliers rather than describing them in categories, because you cannot judge a supplier you cannot see.

Every supplier acting as our processor is under a written contract that meets Article 28 of the UK GDPR, including a duty of confidentiality, security obligations, restrictions on sub-processors, and deletion or return at the end of the contract. We check a supplier before we appoint it and we review it afterwards.

We do not sell personal information, we do not share it for anyone else's marketing, and we do not disclose to your GP or your employer without your agreement, unless one of the exceptions in the confidentiality section applies.

The assessment, and what leaves this website

We do not ask you to type anything into the pages you are reading. They do store your cookie choice on your device, and they read a cookie that tells the menu your first name if you are signed in. When you select a treatment area or press a button that starts the assessment, we send you to the assessment application at waitlist.whatsnormal.com, and the link we build carries the query parameters that were on the address you arrived at, so that we can tell which advertisement brought you here. On some pages we add a parameter naming the area the page is about.

Query parameters travel in a web address, which means they can end up in your browser history and in the server logs at both ends. If you are on a shared device, clear your history, or use the quick exit link, which replaces this page in your history rather than adding to it.

Third party links and services

The website links to other organisations, including the dispensing pharmacy, the General Pharmaceutical Council register, NHS services and Samaritans. Following a link takes you to somebody else's website, which has its own privacy policy and its own cookies. We do not control those sites and we are not responsible for them.

The quick exit button on every page sends you to the BBC weather site. It replaces this page in your browser history rather than adding to it, so the page you were on does not appear if somebody presses back.

The other link that matters is the assessment. Starting it takes you to a separate application at waitlist.whatsnormal.com, which is where your answers are collected. The section above on what leaves this website explains what travels with you.

Safeguarding and disclosures in the public interest

If we have a genuine and serious concern about your safety or somebody else's, including a risk of significant harm to a child or to an adult at risk, we may share the minimum necessary information with your GP, emergency services, a local authority, a safeguarding board or another appropriate body.

For that we rely on Article 6(1)(d) vital interests or 6(1)(f) legitimate interests, and on Article 9(2)(c) vital interests, 9(2)(h) health care, or 9(2)(g) substantial public interest with paragraph 18 of Part 2 of Schedule 1 to the Data Protection Act 2018, depending on the situation. We also rely on the common law where a disclosure is justified in the public interest, which is a separate test we apply separately.

We will tell you that a disclosure has been made where it is safe and appropriate to do so. We will not tell you where doing so would increase the risk to somebody.

Normal is not an emergency service. For urgent health concerns contact your GP or call 111. In an emergency call 999. If you are struggling to cope, Samaritans are there day or night on 116 123, free from any phone.

International data transfers

We aim to keep personal information in the United Kingdom or the European Economic Area.

Where information does go outside the United Kingdom, we use one of these mechanisms under Chapter V of the UK GDPR:

• UK adequacy regulations, where the destination country has been approved by the Secretary of State;
• the UK Extension to the EU-US Data Privacy Framework, the "UK-US data bridge", for a United States recipient that is certified under it;
• the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment; or
• in a one-off situation, a derogation in Article 49, which we do not use for routine or ongoing transfers.

We add technical and organisational safeguards on top, including encryption in transit and at rest, and access controls. You can ask us which mechanism applies to a particular transfer, and we will send you a copy of the safeguards.

Security

We apply risk-based technical and organisational measures under Article 32 of the UK GDPR: encrypted transmission and storage, access control and authentication, role-based access so that health information reaches only the people who need it, logging and monitoring, supplier due diligence, written confidentiality obligations for everyone who handles information, training, and documented incident response procedures. We separate the systems that hold health information from the systems that handle advertising measurement.

No system connected to the internet is completely secure, so we cannot promise absolute security. If a personal data breach happens we investigate it, contain it, and make the notifications the law requires, including to the Information Commissioner's Office within 72 hours of becoming aware where the Article 33 threshold is met, and to you without undue delay where Article 34 applies.

Two things you can do that help: use a strong and unique password for your account, and use the quick exit link if you are on a device somebody else uses.

Accountability and impact assessments

We keep a record of processing activities under Article 30. We apply data protection by design and by default under Article 25. We contract with processors on Article 28 terms. We train the people who handle personal information and we review this policy when the service changes.

We carry out a data protection impact assessment before starting anything likely to result in a high risk to you. Because Normal processes health information at scale, combined with online tracking and advertising, a data protection impact assessment under Article 35(3)(b) is mandatory rather than optional, and it covers the assessment, the clinical review, the support built into your account, and the advertising measurement.

How long we keep information

We keep information for as long as we need it for the purpose we collected it, and then delete it or make it properly anonymous. Some periods are our choice. Some are set by law or by professional duty and are not ours to shorten, which is why the middle column matters.

We may delete or anonymise earlier where information is no longer needed. We may keep a limited record longer where the law requires it, to resolve a dispute, or to prove that an opt-out was honoured. Where a clinician or the pharmacy is required to keep a record, closing your Normal account does not remove it, and we cannot ask them to remove it.

Your data protection rights

Under the UK GDPR you have the right to:

• Be informed. This policy is how we do that.
• Access. Get confirmation that we hold information about you and a copy of it, free of charge.
• Rectification. Have inaccurate information corrected and incomplete information completed. In a clinical record, an entry that was a clinician's honest opinion at the time is usually not deleted or rewritten. A note recording your disagreement is added instead, and that note stays with the record.
• Erasure. Ask us to delete information where the conditions in Article 17 are met. This one has real limits: Article 17(3)(b) and (c) mean we do not delete records we are required to keep for a legal obligation, or that are needed for health care under Article 9(2)(h), and Article 17(3)(e) means we do not delete information needed to establish, exercise or defend a legal claim.
• Restriction. Ask us to pause using information while a dispute about accuracy or lawful basis is resolved.
• Portability. Receive information you gave us, in a machine-readable format, where we rely on consent or contract and the processing is automated.
• Object. Object to processing based on legitimate interests. Where you object to direct marketing, that objection is absolute and we stop immediately.
• Withdraw consent at any time, as easily as you gave it.
• Not be subject to a solely automated decision with legal or similarly significant effects. See the section on automated decision-making.
• Complain to the Information Commissioner's Office, and to seek a remedy or compensation through the courts.

To use a right, email hello@whatsnormal.com. We may ask for proportionate proof of identity, and the clock starts once we have it. We respond within one month. Where a request is complex or you have made several, we can extend by up to two further months under Article 12(3), and we will tell you within the first month if we do, and why.

Two limits specific to health information. First, an exemption in Part 2 of Schedule 3 to the Data Protection Act 2018 lets us withhold health information from a subject access response where disclosing it would be likely to cause serious harm to your physical or mental health, or to somebody else's. Before relying on it we take advice from the appropriate health professional. We do not use it to avoid an awkward answer, and we tell you if we have relied on it. Second, we will redact information that identifies a third party who has not consented, unless it is reasonable to disclose it anyway.

Withdrawing consent

Where we rely on your consent, you can withdraw it at any time, and it must be as easy to withdraw as it was to give. For cookies, use the cookie settings link in the footer of every page. For marketing email, use the unsubscribe link in any message, or email us. For anything else, email hello@whatsnormal.com.

Withdrawing consent does not make what we did beforehand unlawful, and it does not require a clinician or the pharmacy to delete a record they are required to keep. It also does not stop service messages about your assessment, your order, your treatment or your safety, which are not marketing. We keep a minimal record that you withdrew, because that record is what makes the withdrawal stick.

Marketing and electronic messages

Marketing email is governed by the Privacy and Electronic Communications Regulations 2003 as well as by the UK GDPR. We send it in only two situations: you consented, or you bought or asked about a similar service from us, did not object at the time, and are given an unsubscribe option in every message, which is the soft opt-in in regulation 22.

Every marketing message carries a working unsubscribe link and the sender's identity. Unsubscribing is free and takes effect promptly.

We never use health information to decide who receives which marketing, we never build advertising audiences from assessment answers or scores, and we do not share your details with anybody else for their marketing.

Service messages are different, and you cannot opt out of them while you are using the service. They are the ones about your assessment result, your order, your delivery, your subscription, a safety matter, or a change to these terms.

Cookies and similar technologies

Regulation 6 of the Privacy and Electronic Communications Regulations 2003 says we can store things on your device, or read things from it, only with your consent, unless it is strictly necessary to provide the service you asked for. That rule covers cookies, local storage, session storage and similar identifiers, whoever sets them.

So: strictly necessary items are set without asking. Nothing else is set until you choose. The banner offers "Accept all" and "Reject all" with equal prominence and equal effort, and rejecting has no effect on your ability to use the service or to get treatment.

You can change your mind at any time using the "Cookie settings" link in the footer of every page.

Cookies in detail

Fonts, images and scripts on this website are served from our own domain. There is no font service and no embedded third-party widget on the pages you are reading. The site itself is delivered through Cloudflare’s network, which is why Cloudflare is named as a supplier above: every visit passes through it, and it keeps short-lived security logs that include your IP address.

Before you make a cookie choice, the only address your browser contacts other than this site is m.whatsnormal.com, which is ours. It serves the PostHog library, which is loaded but set to record nothing and to store nothing until you accept analytics. Measured on this build: with a clean browser and no choice made, no cookies are set at all.

Your browser also has its own controls for blocking or deleting cookies. Blocking strictly necessary ones may stop parts of the site working.

Adults only

The service is for adults aged 18 or over in the United Kingdom, and nothing on this website is directed at children. You give your date of birth in the assessment, and a clinician checks your age before treatment is considered. Age is then verified properly: once treatment has been paid for, and before it is dispensed, you complete a one-off identity check. The lawful bases for that check are set out in the table above. We do not rely on a legal obligation for it, because no enactment requires a facial check before a prescription-only medicine is supplied.

If you believe a person under 18 has given us information, contact us and we will investigate and delete or restrict it, while keeping any record we need for safeguarding or because the law requires it.

Automated decision-making

Article 22 of the UK GDPR gives you the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you.

The assessment scores and routes your answers. That scoring is a tool that helps a clinician, and it is not the decision. A UK-registered clinician reads what you wrote and decides whether treatment is appropriate, and if it is not they tell you why. That means no decision about your treatment is made solely by automated means.

Some administrative steps are automated, for example an age check that stops the assessment if you say you are under 18, and automated fraud screening by our payment provider. Where an automated step could stop you receiving the service, you can ask for a person to look at it, express your point of view, and contest the outcome. Email hello@whatsnormal.com.

The identity check is the one place an automated score could stop you receiving treatment. It does not decide anything on its own: where a check does not pass, a trained person reviews the document and the result before anything is refused, and you can ask us to look again.

We do not profile you for advertising purposes using health information.

Anonymised information

We use aggregated and anonymised information to understand how the service performs and how to improve it, for example how many people complete the assessment, or how long a step takes. Genuinely anonymised information is not personal information, cannot be traced back to you, and is not covered by the UK GDPR, so we may keep and use it indefinitely.

We take that word seriously. Removing your name is not anonymisation. Information that could still identify you by combining it with something else is pseudonymised, not anonymous, and we treat it as personal information with the same protections as the rest.

If we want to use information that still identifies you for research or product development beyond what is needed to provide your care, we ask for your explicit consent first, under Article 9(2)(a), and you can say no without it affecting your care in any way.

Complaints

Please contact us first, at hello@whatsnormal.com, so we can try to put it right. We will acknowledge your complaint within 5 working days and respond substantively within 20 working days.

You do not have to complain to us first, and doing so does not affect any of your other rights. You can complain directly to the Information Commissioner's Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Complaints about the care you received, rather than about your information, go to us and to the clinician's regulator. Complaints about dispensing go to Smartway Pharma Limited and to the General Pharmaceutical Council. Normal is not registered with the Care Quality Commission, so the CQC is not a route for a complaint about us.

Changes to this policy

We update this policy when the service, our suppliers, the technology or the law changes. The current version is always on this page with its effective date and version number. Where a change is material we give additional notice if it is reasonably practicable, for example by email, and where a new use needs your consent we ask for it rather than assuming it.

Version history

Contact us

Controller. Eco Science Limited, registered in the Cayman Islands, trading as Normal. Registered office: The Cayman Islands.

Privacy enquiries and rights requests. hello@whatsnormal.com.

Data protection contact. Data Protection Officer, Mishcon de Reya LLP, dpo@mishcon.com. You can contact the Data Protection Officer directly, in confidence, and you do not have to come to us first.

Dispensing pharmacy. Smartway Pharma Limited, 10 Lyon Road, London SW19 2RL. Company number 08252650. Registered with the General Pharmaceutical Council under 9010774.

Prescribers. Registered with the General Medical Council.

Supervisory authority. Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. ico.org.uk. 0303 123 1113.