Daye Privacy Policy

Version 1.8

Effective Date: September 17, 2026

1. Important information and who we are

Daye is a group of companies offering Daye products and services globally (“Daye”, “we” or “us”). Daye is made up of different legal entities registered throughout the United Kingdom, the European Union and the United States of America. When we mention Daye in this document, we are referring to the relevant company in the Daye Company Group which provides products and services to you and is therefore responsible for the processing of your personal information.

This Privacy Policy explains what personal information we collect when you visit our website at www.yourdaye.com, purchase our products, subscribe to our communications or otherwise interact with us, how and why we use that information, who we share it with, and what your rights are. Please read it carefully.

Daye operates in your region through the relevant Daye company identified above. To run our services efficiently, the members of the Daye Company Group support each other with activities such as hosting, technical operations, platform administration and customer support. This means that, while your data controller is the Daye company identified above, your personal information may be transferred to and processed by another Daye group entity. Wherever your information is processed within the group, it remains protected by this Privacy Policy and the safeguards described in the “International transfers” section below.

If you have any questions about this Privacy Policy or our data protection practices, or if you wish to exercise your data protection rights, please contact our Data Protection Officer at privacy@yourdaye.com.

EU and EEA representative (Article 27 GDPR): Daye UK acts as data controller for individuals in the European Economic Area but is not established in the Union. We have therefore appointed Daye Biotech Limited (company number 788588, registered at Pavilion House, 31 Fitzwilliam Square, Dublin 2, Ireland, D02 F403) as our representative in the Union under Article 27 of the EU GDPR. You may contact our representative regarding the processing of your personal data or the exercise of your data protection rights at privacy@yourdaye.com.

A note on health information

This Privacy Policy covers data processing performed in the context of operating our website (identified by the domain “www.yourdaye.com”, incl. any subdomains, www.dayediagnostics.co.uk), the Daye online shop available through our website and our general customer relationships. If you use Daye’s diagnostic screening or other healthcare services offered through the Daye Health Platform (DHP), your health information is processed in accordance with the Daye Health Platform Privacy Notice, which supplements this Privacy Policy for those services (see the “Health Platform” section at the end of this document).

Daye is a health platform, not a healthcare provider. Clinical services, laboratory testing, telemedicine consultations and pharmacy services connected with our products are provided by independent, appropriately regulated third-party providers (such as accredited laboratories, regulated clinicians and licensed pharmacies). Those providers are responsible for the clinical services they deliver to you and may process your information as independent controllers in accordance with their own privacy notices.

If you are a resident of the USA, please also review our Washington Consumer Health Data Privacy Policy, which explains how we collect, use and disclose consumer health data as defined by the Washington My Health My Data Act. Residents of other US states with consumer health data laws may also refer to that policy for a description of our consumer health data practices.

2. The information we collect about you

Depending on how you interact with us, we collect and process the following categories of personal information:

• Identity and contact information. Your first name, last name, email address, phone number, delivery and billing address, country and city, for example when you place an order, create an account, sign up to our newsletter or contact us.
• Order and payment information. Details of the products and services you have purchased, order IDs, purchase history, subscription details and payment-related information. Card payments are processed by our external payment service providers; we do not store your full card details.
• Communications. Records of your correspondence with us, including support requests, emails, reviews and your responses to voluntary surveys or forms.
• Marketing preferences. Your preferences for receiving marketing from us, including your email and SMS opt-in status and your interaction with our messages (such as delivery and engagement data).
• Technical and usage information. Information about your device and your interactions with our website, such as your IP address, browser type, operating system, device identifiers, pages viewed and how you navigate and interact with our website. Some of this information is collected through cookies and similar technologies, as described in our Cookie Policy available at www.yourdaye.com/cookies.
• Approximate location. Country-level or city-level location derived from your IP address or as provided by you, used to show you the correct store version, currency, delivery options and, with your consent, location-based features.

We collect this information directly from you, automatically when you use our website, and in limited cases from third parties who work with us (for example, our payment providers confirming that a payment was successful).

We do not collect health information through our general website and e-commerce shop. Health-related information (such as screening results and health questionnaires) is only collected when you use the Daye Health Platform and is governed by the Daye Health Platform Privacy Notice.

3. How and why we use your information

We use your personal information for the purposes set out below. For customers in the UK, the EEA and Switzerland, we also identify the legal bases we rely on under applicable data protection law.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible reason. If we need to use your personal information for an unrelated and incompatible purpose, we will notify you and explain the legal basis which allows us to do so.

Marketing

You will receive direct marketing communications from us if you have created an account, requested them or purchased products from us and have not opted out. You can opt out at any time by clicking the unsubscribe link in any marketing email, by replying “STOP” to any marketing SMS, or by contacting us at hello@yourdaye.com. Opting out of marketing does not affect service communications we need to send you, such as order confirmations.

We do not sell your mobile telephone number, SMS opt-in status or related data to unaffiliated third parties for their own marketing purposes.

4. Who we share your information with

We share personal information with the following categories of recipients, only where necessary for the purposes described in this policy:

• Daye group companies. Other entities in the Daye Company Group, where necessary for the delivery of our products and services or the management of our business.
• Payment service providers. External providers that process your payments. You provide your payment details directly to them; we receive confirmation of whether payment was completed.
• Delivery and fulfilment partners. Couriers, postal operators and logistics providers who deliver your orders.
• IT, hosting and infrastructure providers. Cloud hosting, website infrastructure, security and monitoring providers who help us run our services.
• Customer support, communications and survey providers. Platforms we use to manage support requests, send emails and SMS, collect reviews and run surveys.
• Analytics and advertising partners. Providers that help us understand how our website is used and, where you have consented via our cookie banner, advertising and social media platforms that help us show relevant Daye advertising and measure campaign performance. Details of these technologies are set out in our Cookie Policy available at www.yourdaye.com/cookies.
• Professional advisers. Lawyers, accountants, auditors and insurers, where necessary.
• Authorities and regulators. Public authorities, regulators, courts and law enforcement, where we are legally required to disclose information or where disclosure is necessary to protect our rights or the safety of any person.
• Business transfers. If our business is subject to a reorganisation, merger, acquisition or sale of assets, personal information may be disclosed in connection with that transaction, where permitted by applicable law.

We require all third parties that process personal information on our behalf to respect the security of your personal information and to treat it in accordance with the law.

5. International transfers

We generally seek to store your personal information in the region where you reside. However, we may also transfer, store and process your personal information in another country or region, such as the United Kingdom, the European Economic Area (EEA) and the United States of America.

When we do that, we will ensure compliance with the applicable rules on transfers of personal information to countries outside of the region where you are established.

For example, if you are a resident of the UK, an EEA country or Switzerland, whenever your personal information is stored or otherwise processed in a country that is not considered to offer an adequate level of protection compared to the standards of your country of residence, we will make sure the recipient of the data in that third country is bound by the standard contractual clauses as approved by the UK Parliament or, respectively, the European Commission, and we will rely on any other supplementary safeguards necessary to ensure your personal information continues to enjoy the same level of protection. You can contact us for more information about the safeguards we use.

6. How we protect your information

We have put in place appropriate technical and organisational security measures designed to prevent your personal information from being accidentally lost, used, accessed, altered or disclosed in an unauthorised way. These include, among others, encryption, access controls, security monitoring and staff confidentiality obligations. Access to your personal information is limited to those employees, agents and contractors who have a business need to know.

We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

7. How long we keep your information

We keep your personal information only for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements, resolving disputes and enforcing our agreements.

To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and the applicable legal requirements. When your personal information is no longer required, we securely delete or anonymise it. Retention periods for health information processed through the Daye Health Platform are described in the Daye Health Platform Privacy Notice.

8. Cookies and similar technologies

Our website uses cookies and similar technologies to operate securely, remember your preferences, understand how our services are used and, where you agree, support advertising.

Where required by applicable law, we ask for your consent before using non-essential cookies, including advertising cookies and certain analytics cookies. In some countries, limited analytics technologies may be used without prior consent where they are used only to understand and improve how our website works. Where this applies, you can still object or opt out at any time.

You can review or change your choices through the Privacy Preferences link on our website. For more information about the technologies we use, please see our Cookie Policy at www.yourdaye.com/cookies.

We also honour recognised browser-based privacy signals, such as Global Privacy Control (GPC), where required by applicable law.

9. Your legal rights

Depending on where you live, you have rights under data protection law in relation to your personal information. Under the UK GDPR and EU GDPR, you have the right to:

• Access your information and obtain a copy of the personal information we hold about you.
• Rectification – ask us to correct incomplete or inaccurate personal information.
• Erasure – ask us to delete your personal information, where there is no good reason for us to continue processing it.
• Restriction – ask us to suspend the processing of your personal information in certain scenarios.
• Objection – object to processing based on our legitimate interests, and object at any time and free of charge to processing for direct marketing purposes.
• Portability – receive your personal information in a structured, commonly used, machine-readable format and have it transmitted to another controller, where technically feasible.
• Withdraw consent – withdraw your consent at any time where we rely on consent to process your personal information. This will not affect the lawfulness of processing carried out before you withdrew consent.

To exercise any of these rights, contact us at privacy@yourdaye.com. Exercising your rights is generally free of charge. However, where permitted by applicable law, we may charge a reasonable administrative fee or refuse to act if a request is manifestly unfounded or excessive, including because it is repetitive. If this applies, we will explain our decision.

We will respond as soon as possible and within the period required by applicable law. We may ask for specific information to confirm your identity and protect your personal information.

Right to lodge a complaint

If you have a concern about our handling of your personal information, we would appreciate the chance to deal with it first – please contact us at privacy@yourdaye.com. You also have the right to lodge a complaint at any time with your data protection supervisory authority:

• United Kingdom: the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; www.ico.org.uk.
• Bulgaria: the Commission for Personal Data Protection (Комисия за защита на личните данни – КЗЛД), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; www.cpdp.bg.
• Germany: the competent data protection supervisory authority of the German federal state (Land) where you live or work, or where the alleged infringement took place. A list of the German federal and state data protection authorities is available from the Federal Commissioner for Data Protection and Freedom of Information (BfDI).
• Other EEA countries: the data protection authority of the EU or EEA country where you live or work, or where the alleged infringement took place. A list of EU data protection authorities is available at edpb.europa.eu.
• Switzerland: the Federal Data Protection and Information Commissioner (FDPIC); www.edoeb.admin.ch.
• United States: depending on your state of residence, you may raise a concern with your state Attorney General (or, in California, the California Privacy Protection Agency), and you may report unfair or deceptive privacy practices to the Federal Trade Commission at www.reportfraud.ftc.gov.

10. Additional information for US residents

This section supplements this Privacy Policy for residents of US states with comprehensive consumer privacy laws (including, among others, California, Colorado, Connecticut, Texas, Virginia and Washington). Regardless of your state of residence, we will endeavour to honour reasonable requests you make in relation to your privacy.

Consumer health data. If you are a Washington resident, our Washington Consumer Health Data Privacy Policy applies to the collection, use and disclosure of your consumer health data as defined by the Washington My Health My Data Act, and describes your rights to confirm, access, withdraw consent, delete and appeal, as well as the categories of third parties (including our laboratory, telemedicine and pharmacy partners) with whom such data may be shared. We do not sell consumer health data for monetary consideration, and where applicable law requires a separate authorisation before any sale of consumer health data, we will obtain it.

Depending on your state, you may have the right to: know and access the personal information we process about you; correct inaccurate personal information; delete your personal information; obtain a portable copy of your personal information; opt out of the “sale” or “sharing” of personal information and of targeted advertising; limit the use of sensitive personal information; and not be discriminated against for exercising your rights.

Where our use of cookies and advertising technologies constitutes a “sale”, “sharing” or targeted advertising under applicable state law, you can opt out at any time through the “Privacy Preferences” link on our website or by using a global opt-out signal such as the Global Privacy Control (GPC), which we honour. We do not sell your personal information for monetary consideration, and we do not knowingly sell or share the personal information of consumers under 16 years of age.

To exercise your rights, contact us at privacy@yourdaye.com. We will verify your identity before acting on your request and will respond within the timeframe required by applicable law (generally 45 days, extendable where permitted). You may designate an authorised agent to submit a request on your behalf. If we decline your request, we will explain why, and you may appeal our decision by replying to our response or writing to privacy@yourdaye.com with the subject line “Privacy Appeal”. If your appeal is unsuccessful, you may contact your state Attorney General.

11. Children’s privacy

Our website, products and services are intended for individuals aged 18 and over, and we do not knowingly collect personal information from anyone under 18. If you believe we may hold information from or about a person under 18, please contact us at privacy@yourdaye.com so that we can delete it.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated version number and effective date, and, where the changes are significant, we will take additional steps to notify you (for example, by email or a notice on our website). Please check this page regularly.

13. Contact us

Questions, comments and requests regarding this Privacy Policy are welcome and should be addressed to:

Email: privacy@yourdaye.com

Health Platform

If you use Daye’s diagnostic screening or other healthcare services, your health information will be processed in accordance with the applicable Daye Health Platform Privacy Notice, which supplements this Privacy Policy for those services. The Daye Health Platform Privacy Notice is available at www.yourdaye.com/dhp-privacy.

For United States of America residents, the Washington Consumer Health Data Privacy Policy additionally applies to consumer health data as defined by the Washington My Health My Data Act.