You are handing us the most personal data you have.

Under UK GDPR, data about your physical health sits in a protected category of its own (Article 9). It cannot be processed on the ordinary grounds that cover a name and address. It needs your explicit consent — freely given, specific, and separately asked for.

That is why the Meo app asks you to consent to health-data processing as its own deliberate step, rather than folding it into a tick-box next to the terms of service. Consent is the basis we rely on for your metabolic data, and consent you have given you can take back. Withdraw it and we stop processing on that basis.

Two narrower grounds sit alongside it: we process your order and account details because we need them to perform our contract with you — we cannot ship a device without an address — and we keep invoice records because the law requires us to. Those are not health data and are not covered by your health consent.

The full notice, with the formal detail, is the Privacy Policy. This page is the version written to be read.

Population averages are why metabolic advice usually fails. “Eat less fat” is a statement about a cohort; it is not a statement about your triglycerides on a Tuesday. Everything Meo collects exists to replace an average with a measurement of you.

We do not buy data about you from anyone else, and we do not enrich your profile from third-party sources. What we hold is what you gave us or measured yourself.

“Bank-grade security” means nothing. Here is what is actually true, and we have tried to be equally clear about where it stops.

• Your record lives in London. The primary database holding your readings, profile and conversation history is a managed PostgreSQL instance in Amazon Web Services’ London region (eu-west-2).
• Encrypted in transit, everywhere. Traffic to the site and app is served over HTTPS, and our own services talk to the database over TLS. Nothing about your health moves across a network in the clear.
• Logging in is handled by AWS Cognito. We do not store your password. Every request carries a signed token that our services verify cryptographically against Cognito before returning a single row.
• Your records are scoped to you. Requests are answered against the identity in your token, never an account number supplied in the request. Ask our API for a record that is not yours and it reports that no such record exists — it will not even confirm the row is there.
• Food photos are not on a public URL. They sit in a private store. When one needs to be displayed, we mint a link to that single image which expires within minutes. There is no permanent address for your photograph.

Being straight about the edges: the master record is in London, but not every piece of processing happens inside the UK. Some of the services we rely on — parts of the AI processing, and image storage — run in other regions operated by the same providers. If you want the specifics for your own assessment, ask us and we will tell you exactly which service runs where.

Our main processors are Amazon Web Services (hosting, database, identity, and the AI models), and Stripe (payments). We maintain a full list of sub-processors and will send it on request.

These are the questions people actually want answered about an AI health coach, and they are usually the ones left out.

A single cholesterol reading is close to meaningless. Fourteen readings over eleven weeks is a trend you can act on. So we keep your metabolic history for as long as you have an account — deleting last year’s readings would quietly destroy the thing you bought.

When you close your account, we delete your record: your readings, profile, food log, conversations and session history all go. Invoice and tax records we are legally obliged to keep for a fixed period, so those survive — that is a legal requirement, not a preference.

What we are not going to do is invent a number. We have not yet published a fixed retention period for every individual category of data. When those periods are set, they will appear here and in the Privacy Policy. In the meantime, if you want your data gone, you do not have to wait for a policy — ask us, or delete your account, and it goes.

These are rights under UK GDPR, not concessions we are granting. One email starts any of them.

• Access. Get a copy of everything we hold about you.
• Rectification. Make us correct anything that is wrong.
• Erasure. Have it deleted, except where the law makes us keep it.
• Portability. Receive your data in a machine-readable form and take it elsewhere.
• Objection. Object to how we are processing it, or withdraw a consent you gave.
• Complaint. Escalate past us entirely and go to the regulator.

Meterbolic is sold co-branded. A partner supplies the human layer — coaching, clinical or therapeutic — wrapped around the device and the Meo subscription, and their clients arrive on a page carrying their logo. That makes data protection a shared reputational question, not just ours.

If you are conducting due diligence before you put your name to us: start with the ICO certificate above, then email partner@meterbolic.com and ask for the data-protection pack. We would rather answer a hard question at the diligence stage than have it surface in front of your client.

Short list, because a long one is a sign nobody intends to keep it. These are commitments about our own conduct, and we can keep every one.

• Sell your health data. Not to insurers, not to employers, not to data brokers, not to anyone, at any price.
• Use your health data to target advertising at you, or share it with an advertising network.
• Hand your data to a third party to train their AI models on.
• Disclose your results to your employer, your insurer or your GP without you asking us to.
• Make a diagnosis. Meo is a wellness and monitoring tool; where something needs a doctor, we will tell you to see one.
• Quietly widen what we do with your data. If the purpose changes materially, we will ask you again rather than update a policy page and hope you miss it.

Trust pages tend to imply more than they say. Here is what we are not telling you, stated plainly, so you can price it into your decision.

• We are not ISO 27001 or SOC 2 certified. We hold neither certification. Anyone implying otherwise — including us, in some future draft of this page — would be wrong. What we do instead is described above, in specifics.
• HIPAA does not apply to us. HIPAA is US legislation covering US healthcare providers and their business associates. We are a UK company regulated under UK GDPR and the Data Protection Act 2018. A HIPAA badge on a UK consumer wellness product is decoration.
• Meo is not a diagnostic device. The Digital Lipid Meter is CE-marked for wellness monitoring. It does not diagnose, treat, cure or prevent disease, and neither does the AI coach.
• We are a young company, not a fortress. We are building a metabolic health platform, and our security programme is growing alongside it. We would rather tell you what is true today than describe the company we intend to be.