Privacy Policy

1. Who We Are

Vibber ("we", "us", "our") operates vibberhealth.com (the "Site"), an independent informational matching service that helps users in the United States identify GLP-1 weight loss programs from third-party providers. We are not a healthcare provider, pharmacy, telehealth platform, or clinical practice.

Vibber is the data controller responsible for personal data collected through this Site. We are based in the United Kingdom.

Contact: hello@vibber.co

If you have any questions about this Privacy Policy or how we handle your data, please email us at the address above.

2. Who This Policy Applies To

This policy applies to all visitors to vibberhealth.com, including people who:

• Browse the Site without completing the assessment
• Complete all or part of the eligibility assessment quiz
• Submit a creator partnership application
• Correspond with us by email

The Site is intended for adults aged 18 and over located in the United States. We do not knowingly collect data from individuals under 18.

3. What Personal Data We Collect

3a. Assessment (Quiz) Data

When you complete the eligibility assessment, we collect:

• Primary health goal (e.g. lose weight, manage appetite, improve metabolic health)
• Biological sex
• US state of residence
• Body weight and height (used solely to calculate your BMI)
• First name and email address (collected at quiz completion)

Your weight, height, BMI result, and health goal constitute health-related personal data (special category data under UK GDPR). We process this data only with your explicit consent, given when you proceed through the assessment having read the inline notice presented at the start of the quiz.

This data is used to compute your match result and is stored in our CRM. It is not transmitted to matched providers — providers conduct their own clinical intake independently.

3b. Creator Application Data

If you submit a creator partnership application at vibberhealth.com/creators, we collect:

• Name and email address
• Social media handles and platform links
• Self-reported audience size and niche information
• Any other information you voluntarily provide in the application form

3c. Technical and Usage Data

We automatically collect certain data when you visit the Site:

• IP address and approximate geographic location (country/region level)
• Browser type and version
• Device type and operating system
• Pages visited and time spent on each
• Referring URL (how you arrived at the Site)
• Click events and interactions with page elements

3d. Advertising and Analytics Data

We use third-party tools that collect data in connection with their own privacy frameworks (see Section 8).

4. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases:

• Health-related quiz data (goal, weight, height, BMI, sex) — Explicit consent, given when you proceed through the quiz.
• Name and email address (quiz completion) — Legitimate interests; operating the matching service you requested.
• Email marketing communications — Consent, given at opt-in.
• SMS marketing (planned — see Section 7) — Consent, will be obtained at time of opt-in.
• Creator application data — Contract; processing necessary to respond to your application.
• Analytics and site performance data — Legitimate interests; understanding how the Site is used to improve it.
• Advertising pixel data (Meta, Google) — Consent, obtained via cookie/tracking consent mechanism.

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. You may object to processing based on legitimate interests at any time (see Section 11).

5. How We Use Your Data

We use the data we collect to:

• Compute and display your GLP-1 program match result
• Present the appropriate matched provider based on your state, goals, and BMI
• Send follow-up email communications about your match result and relevant provider options (where you have provided your email address)
• Send SMS messages about your match and relevant providers (when SMS capability is activated and you have opted in)
• Manage creator partnership applications and communications
• Measure Site performance and user behaviour via analytics
• Operate and optimise paid advertising campaigns
• Comply with our legal obligations

We do not use your quiz responses to make automated decisions that produce legal or similarly significant effects.

6. Email Communications

If you provide your email address when completing the quiz, we may send you:

• Your match result and matched provider information
• Follow-up emails about GLP-1 programs and providers in our network
• Educational content related to weight management care

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any email we send, or by emailing hello@vibber.co. Unsubscribing will not affect transactional or service-related messages.

We use ActiveCampaign to manage and send email communications. ActiveCampaign acts as a data processor on our behalf (see Section 9).

7. SMS Communications

We may in the future collect mobile phone numbers to send SMS messages about your match result and relevant GLP-1 providers. If and when we introduce SMS:

• We will collect your phone number separately and only after obtaining your explicit opt-in consent
• Each SMS will include clear opt-out instructions (reply STOP to unsubscribe)
• We will not send SMS without your prior consent
• Consent to SMS is not a condition of using the Site or accessing your match result

This section will be updated when SMS communications are activated.

8. Cookies and Tracking Technologies

We use the following categories of cookies and tracking technologies:

Strictly Necessary

Session cookies required for the Site to function. These cannot be disabled.

Analytics

Google Analytics — we use Google Analytics to understand how visitors use the Site. This may include data on pages visited, session duration, device type, and approximate location. Google processes this data in the United States. You can opt out at tools.google.com/dlpage/gaoptout or by refusing analytics cookies via our consent mechanism.

Advertising

Meta Pixel — we use the Meta (Facebook) Pixel to measure the performance of our advertising campaigns. The pixel records events such as page visits and quiz completions. We do not pass health-related quiz responses (such as your health goal, BMI, or weight) through the pixel.

Google Ads Tag — we use Google Ads tracking to measure conversions from our Google advertising campaigns.

Both advertising pixels are loaded only with your consent. You can withdraw consent at any time via your browser settings or a cookie management tool.

You can also manage advertising preferences directly with these platforms:

• Meta: facebook.com/adpreferences
• Google: adssettings.google.com

9. Who We Share Your Data With

We do not sell your personal data. We do not share your quiz responses with matched providers — providers conduct their own independent clinical intake.

We work with the following categories of third-party processors who handle your data on our behalf, under appropriate data processing agreements:

• ActiveCampaign — CRM and email delivery — United States
• Meta Platforms — Advertising measurement — United States
• Google LLC — Analytics and advertising measurement — United States

We may also disclose data where required by law, court order, or regulatory authority.

10. International Data Transfers

We are based in the United Kingdom. Several of our third-party processors operate in the United States, which means your personal data may be transferred outside the UK.

Where we transfer personal data to the United States, we ensure appropriate safeguards are in place in accordance with UK GDPR, including:

• Reliance on the UK-US Data Bridge (where applicable), or
• Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO)

For more information on the safeguards applied by specific processors, you can review their privacy policies directly. If you would like details of the specific mechanisms we rely on, please contact us at hello@vibber.co.

11. Your Rights Under UK GDPR

If you are located in the United Kingdom or the European Economic Area, you have the following rights:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your personal data in certain circumstances.
• Right to restriction — you can ask us to restrict processing of your data in certain circumstances.
• Right to data portability — you can ask us to provide your data in a portable format where processing is based on consent or contract.
• Right to object — you can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds.
• Right to withdraw consent — where we process data on the basis of consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email hello@vibber.co. We will respond within one month. We may need to verify your identity before actioning a request.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

12. Your Rights Under the CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and its amendments give you additional rights:

• Right to know — you can request information about the categories and specific pieces of personal data we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete — you can request deletion of personal data we have collected, subject to certain exceptions.
• Right to correct — you can request correction of inaccurate personal data.
• Right to opt out of sale or sharing — we do not sell your personal data. We do not share your personal data with third parties for cross-context behavioural advertising without your consent.
• Right to limit use of sensitive personal information — health-related data (including your health goals and BMI inputs) constitutes sensitive personal information under the CCPA. We use this data solely to provide the matching service you requested. You may direct us to limit use of this data by emailing hello@vibber.co.
• Right to non-discrimination — we will not discriminate against you for exercising any of your CCPA rights.

To submit a CCPA request, email hello@vibber.co with the subject line "California Privacy Request." We will respond within 45 days.

13. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this policy, unless a longer retention period is required by law.

• Quiz responses and match data — 24 months from collection, or until deletion is requested
• Email address (marketing) — Until you unsubscribe or request deletion
• Creator application data — 12 months from application, unless a partnership is ongoing
• Analytics and advertising data — As determined by Google and Meta's own retention settings

After the applicable retention period, data is securely deleted or anonymised.

14. Children

This Site is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us at hello@vibber.co and we will delete it promptly.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated by a notice on the Site. Continued use of the Site after changes are published constitutes acceptance of the updated policy.

16. Contact

For any questions, requests, or complaints regarding this Privacy Policy:

Email: hello@vibber.co
Entity: Vibber
Country of incorporation: United Kingdom

For complaints not resolved to your satisfaction, you have the right to contact the ICO at ico.org.uk.