Planet MUTU Ltd (“MUTU”, “we”, “us”, or “our”) is committed to protecting your personal data and respecting your privacy. We handle personal data with care, transparency, and in accordance with applicable data protection law.
This Privacy Policy explains how we collect, use, store, and protect personal data when you use MUTU services.
1. Scope of this policy
This policy applies to personal data processed through services provided via:
the UK Information Commissioner’s Office (ICO), or
your local EEA data protection authority.
3. Personal data we collect
We collect only the personal data necessary to provide safe, effective, and supportive women’s health services.
3.1 Information you provide directly
This may include:
name and contact details (email address and optional mobile number)
account login credentials
programme progress, responses, and interactions
health-related information you choose to share
communications with customer support
survey or feedback responses
Some of this information may constitute special category health data under UK/EU data protection law.
We process special category data:
only with your explicit consent, and
solely to deliver, personalise, and improve MUTU services.
We do not require information about ethnicity, religion, political opinions, or sexual orientation.
If voluntarily provided, it is used solely to support monitoring of inclusion, accessibility, or equality and never to restrict access to services.
3.2 Information collected automatically
When you use our website or platform, we may collect:
device, browser, and operating system information
IP address and approximate location
usage data such as pages viewed and actions taken
cookie and analytics data
This information helps us:
maintain security and performance
understand how MUTU services are used
improve functionality and user experience
You can manage cookies via our cookie consent banner and browser settings.
Further information is available in our Cookie Policy.
3.3 Information from third parties
We may receive limited personal data from:
payment processors
secure hosting and infrastructure providers
analytics and communication service providers
We do not purchase sensitive health data from third parties.
4. How we use personal data
4.1 To provide MUTU services
We process personal data to:
create and manage your account
deliver digital programmes and guidance
personalise support and track progress
provide customer service
Legal basis:
Contract performance
Explicit consent (for special category health data)
4.2 To communicate with you
We may send:
supportive health content such as ‘Notes from MUTU’ emails
programme-related updates and service information
security or administrative messages
occasional relevant offers where permitted by law
You can unsubscribe from non-essential communications at any time.
Legal basis:
Consent (for marketing communications)
Legitimate interests (for essential service messages)
4.3 To improve and safeguard MUTU
We use personal data to:
analyse service usage and outcomes
develop and test improvements
ensure clinical safety and effectiveness
prevent fraud, misuse, or security incidents
Where possible, we use aggregated or anonymised data.
Legal basis: Legitimate interests and, where required, consent.
4.4 To meet legal obligations
We may process personal data to:
comply with applicable law or regulation
respond to lawful requests from authorities
establish, exercise, or defend legal claims
Legal basis: Legal obligation and legitimate interests.
5. Email and SMS communications
5.1 Email
Where you have given consent, we may send:
supportive health information
programme updates and service information
occasional relevant offers
You may withdraw consent at any time using the unsubscribe link in our emails.
5.2 SMS messages (optional)
If you provide a mobile number and opt in, we may send occasional supportive or service-related text messages.
Message frequency varies
Message and data rates may apply
You may opt out at any time by replying STOP
SMS consent is separate and optional.
6. Sharing personal data
1. Sharing personal data
We do not sell personal data.
We may share personal data with trusted service providers who support MUTU’s operation, including:
secure hosting and infrastructure providers
payment processors
analytics and communication platforms
professional advisers where required
All processors must:
act only on our instructions
keep data confidential
implement appropriate security measures
comply with UK/EU data protection law
Business transfers
If Planet MUTU Ltd is involved in a merger, acquisition, investment, restructuring, or sale of assets, your personal data may be transferred to the relevant third party as part of that transaction.
Any such transfer will take place only where permitted by applicable data protection law, and the recipient will be required to:
use your personal data in a manner consistent with this Privacy Policy, and
provide a level of protection that is no less protective than that described here.
Where required by law, we will notify you of any material change in data control or data use and explain the choices available to you.
7. International data transfers
Your personal data may be processed outside the UK or EEA.
Where this occurs, we ensure appropriate safeguards, including:
UK adequacy regulations
EU Standard Contractual Clauses
other lawful transfer mechanisms recognised under UK/EU law
These safeguards ensure your data remains protected.
8. Data retention
We retain personal data only as long as necessary to:
provide MUTU services
comply with legal obligations
resolve disputes
maintain safety and accountability
In general:
account and health-related data are retained while your account remains active and for a limited period afterwards, where necessary for legal, safety, or audit purposes
financial records are retained in line with statutory requirements
data may be anonymised and retained for research, safety monitoring, or service improvement
9. Children
MUTU services are intended for adults.
We do not knowingly collect personal data from children under the applicable age for digital consent in their country (typically 13–16 years).
If we become aware that such data has been collected without appropriate consent, we will delete it promptly.
10. Your rights
Under UK/EU data protection law, you may have the right to: