Privacy Policy

Who we are

Ujana is a performance nutrition platform currently in its early access phase. In this policy, “we”, “us”, and “our” refer to Ujana, the data controller responsible for your personal data. Once Ujana is formally incorporated, this policy will be updated with our registered company name and address. If you have any questions, email us at hello@ujana.co.

What we collect

At this stage, the only personal data we collect is your email address, submitted when you join our waitlist. We also record that you gave consent and the date and time you did so. We do not collect your name, location, or any health or biometric data at this stage.

Why we collect it

We use your email address solely to contact you about early access to Ujana, including when the pilot launches in London and when invitations become available.

Our lawful basis (UK GDPR)

We rely on your consent as our lawful basis for processing your email address, under Article 6(1)(a) of the UK GDPR. You give this consent by ticking the box on our signup form. You can withdraw it at any time, as described under “Your rights” below, and doing so will not affect the lawfulness of any processing carried out before you withdrew.

How we store and protect it

Your data is stored in a Postgres database provided by Supabase and hosted in a European Union region. We apply row-level security policies so that waitlist data cannot be read, changed, or deleted from the browser. New signups can only be added, not retrieved, by the public website.

How long we keep it

We keep your email address until the Ujana pilot launches and early access invitations have been sent, or for up to 24 months from the date you signed up, whichever comes first. If you ask us to delete your data sooner, we will do so promptly.

Who we share it with

We do not sell, rent, or trade your email address, and we do not share it with third parties for their own marketing. We use Supabase as our database processor; their privacy policy is available at supabase.com/privacy. We may disclose data where required to do so by law.

International transfers

Your data is held within the European Union. Where any data is transferred outside the UK or EU, we will ensure appropriate safeguards are in place as required by UK GDPR.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted (the “right to erasure”)
• Withdraw your consent at any time
• Object to, or ask us to restrict, our processing of your data
• Receive a portable copy of your data

To exercise any of these rights, email hello@ujana.co. We will respond within one month.

Complaints

If you have concerns about how we handle your data, you can contact us at hello@ujana.co. You also have the right to lodge a complaint with the UK’s Information Commissioner’s Office (ICO) at ico.org.uk.

Changes to this policy

If we make material changes to this policy, particularly when we begin collecting health or biometric data in future phases, which carries additional protections under UK GDPR, we will update this page and, if you are on our waitlist, notify you by email.