Effective date: 30 September 2026. This policy covers the Here’s Health website and app, including our shop, café and sauna booking services. Availability of a feature does not change the privacy rights explained below.
Who we are and how to contact us
Here’s Health is operated by Tynestyle Trading Ltd. In this policy, “we”, “us” and “our” mean that company. We are the data controller for personal information used to provide our shop, café, sauna and app services. We handle it under the General Data Protection Regulation (GDPR), the Irish Data Protection Act 2018 and applicable electronic communications rules.
For privacy questions or to exercise your data protection rights, contact info@hereshealth.ie or write to Here’s Health, 51 Patrick’s Street, Cork City, Cork, Ireland. For an app account deletion request when you cannot use the app, contact online@hereshealth.ie, with the subject Here’s Health app account deletion.
OpenHouse AI Limited provides app development and technical operation services on our instructions. It does not receive permission to use your customer information for its own unrelated purposes through that arrangement.
This policy covers our website and the Here’s Health app. Separate payment, shopping and booking providers may also give you privacy information about their own services. We remain responsible for explaining how we use the information we receive from them.
Information we use
The information depends on the services you choose:
- App accounts: your email address, account identifier, authentication information and relevant account or support records. Your password is sent securely to the authentication provider. The app keeps authentication tokens in protected storage on your device.
- Orders and fulfilment: items, options, prices, order and payment references, collection details, and the name, email address, telephone number or delivery address you provide for the order. Refund and order-status information may also be recorded.
- Payments: payment providers process the information needed to authorise your payment and perform security checks. The app’s café payment integration receives a payment token and transaction result rather than storing your full card number or security code in app-managed order records. Provider processing still involves personal information.
- Browsing and service operation: catalogue requests, searches, device and network information, service logs and diagnostics. Information collected by integrated payment software can include device identifiers, user identifiers, product interactions and crash information.
- Optional café order notifications: a device notification token linked to your app account, notification preference, and the order and delivery records needed to send transactional updates. These identifiers are personal information even when stored in hashed form.
- Support and privacy requests: correspondence, proportionate verification information and records needed to handle and explain the outcome of your request.
You can browse without a registered account. Some commerce functions use a guest identifier to keep your basket, orders and recovery information separate from other customers. Guest use does not mean that no information is processed.
Why we use it
We use the information needed to manage your account, answer an enquiry, maintain a basket, process an order, arrange fulfilment, handle a refund or send an order update. For account, order and booking administration, our legal basis is performance of a contract with you or steps you ask us to take before entering one. For accounting and other mandatory records, our basis is compliance with legal obligations.
We also use relevant information to protect accounts and payments, investigate faults, prevent misuse, keep necessary business records and comply with legal obligations. Where we rely on legitimate interests for security or service reliability, we assess the need for that processing against your rights. Where consent is required, including for applicable marketing or non-essential cookies, you can withdraw it.
Information required for an order or account may be necessary to provide that particular service. You can continue to use available browsing features if you choose not to provide it.
Providers and sharing
Our app uses Supabase for authentication and backend services. Café payment and order services use Square. Online shop services use Shopify and the payment services presented at checkout. Sauna bookings are handled through Acuity Scheduling. Apple Push Notification service delivers optional café order alerts on iOS.
OpenHouse AI and authorised service providers receive access only for the work they perform. Depending on the service, providers may process information on our behalf or for their own stated payment, fraud-prevention or legal purposes. Please read the relevant information shown at checkout or booking.
We may share necessary information with fulfilment partners, professional advisers or authorities where needed for a service, a legal obligation or a specific claim. Any proposed business transfer must preserve applicable privacy rights.
Shop, app and sauna accounts
Your app account, Shopify store account and Acuity booking records are separate. Signing out of one service does not sign you out of every other service. Deleting app sign-in is not proof that all separate provider records have been erased.
Sauna bookings collect the name, email address and booking details you provide; the booking form also offers a telephone field and requires agreement to terms containing a health and safety declaration. Those answers are submitted to Acuity Scheduling for booking administration and the venue’s safety and liability records. They are not copied into the app’s account or notification records by the current integration. Read the information and terms displayed by the booking service before submitting. Contact us before booking if you need information about the handling or retention of a health declaration. Do not include medical details in an ordinary app support message.
Notifications and marketing choices
Café push notifications are optional transactional updates about your orders. They do not subscribe you to promotional marketing. Where this feature is available, you can change the preference in Account → Notifications and change notification permission in your device settings. Turning alerts off does not cancel an order or delete the account.
We send only the information needed for the alert and its secure routing. A notification can appear on a device’s lock screen, depending on your settings. Notification delivery is not guaranteed; check your order in the app where available.
Any separate marketing subscription must explain its choice and withdrawal method. Website and embedded-provider cookies need to be considered separately from the app’s notification preference. Essential cookies support the service; non-essential analytics and advertising require the applicable choice before use.
Account deletion and retention
We keep information for the purpose for which it is needed, then remove it or make it no longer identifiable, subject to applicable legal duties and specific, reviewed claims. We distinguish account details from minimum transaction records that must be retained for accounting or a dispute. Irish tax record requirements generally require relevant business records to be kept for six years; that does not justify keeping every app profile, device token or booking health answer for six years.
Request app account deletion under Account → Delete account. If you cannot access the app, use the app deletion email above. Do not send passwords or card information. We may need proportionate information to verify that the account belongs to you.
Our operating target is to fulfil a verified app deletion request within 28 days. If an unresolved order, refund, legal obligation or specific claim affects the request, we will explain the remaining information and the reason for retaining it. Provider records are reviewed separately; removing app authentication alone is not the full fulfilment process.
Account → Deletion requests can show a minimal secure receipt saved on that device after sign-out or account removal. Keep the app installed until you have checked completion. Receipt access expires 90 days after completion. Completed request evidence is then eligible for scheduled removal unless a documented, reviewed hold applies. Removing the app or losing the device can remove access to that local receipt; it is not itself an account deletion request.
Our approved app-managed retention schedule makes notification delivery evidence eligible for cleanup after 30 days, and disabled routing and unreferenced notification state after 90 days. These app-managed periods do not state how long separate provider logs or backups are retained. Separate transaction, security and backup records may remain for their applicable retention period; we assess provider deletion as part of a verified request and explain any records retained for legal obligations or a specific claim. Booking declarations are assessed separately according to their safety or claim purpose and any continuing need, rather than treated as general marketing or account data.
Security and international processing
We use secure connections, access controls and protected credential storage to reduce the risk of unauthorised access. No system can guarantee absolute security. Send sensitive account information only through the appropriate service, and never send a password or full payment-card details to support.
The app’s primary Supabase database is hosted in the Ireland region. Some providers, their support teams or subprocessors process information outside the European Economic Area, including in the United States. Their published data-processing terms describe the safeguards used for relevant transfers, including European Commission standard contractual clauses and, where applicable, recognised adequacy arrangements. These arrangements depend on the provider, destination and service; an Ireland database does not mean that all processing stays in Ireland. You can contact info@hereshealth.ie for information about safeguards relevant to your data.
Provider information is available in the Supabase data-processing addendum, Shopify data-processing addendum, Squarespace/Acuity data-processing addendum and Square privacy information for payment users. These provider notices complement our responsibility for our own use of your information.
Your rights
Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal information, and object to relevant processing. You can withdraw consent where we rely on it. Withdrawal does not undo processing lawfully carried out before withdrawal. Some rights are subject to legal conditions. We respond to data-protection requests within the applicable legal time limit, normally one month; if a lawful extension is needed, we explain it.
Contact us using the privacy details above. We may verify identity proportionately and explain any lawful limitation. You can also raise a concern with the Irish Data Protection Commission, at dataprotection.ie.
Updates
We will update this notice when our services or information practices materially change, and identify the effective date. Significant changes will be communicated through an appropriate website, app or direct notice.