Privacy Policy
Last updated: 2nd October 2026
1. Who We Are
After The Jabs is operated by After The Jabs Ltd, a company registered in England and Wales under company number 15419154, with its registered office at B4 Marquis Court, Team Valley, Gateshead, NE11 0RU.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller of the personal data described in this policy.
ICO registration number: ZC229617
If you have any questions about this policy or how we handle your data, contact us at:
Email: neil@afterthejabs.com
Post: After The Jabs Ltd, B4 Marquis Court, Team Valley, Gateshead, NE11 0RU
We do not have a formal Data Protection Officer. Privacy queries are handled by the company director, Louise Atkinson.
2. Who This Policy Covers
This policy applies to:
– Visitors to afterthejabs.com and any related web pages
– Subscribers to our email list
– Members of the ATJ community, whether accessing it through the website or through the ATJ mobile app on iOS or Android
– Anyone who contacts us by email, post or social media
It does not cover third-party websites we link to. Those sites have their own privacy policies.
3. Important: ATJ Is Not a Medical Service
ATJ is a membership community offering information, education and peer support around maintaining weight after using GLP-1 medication. We are not a clinic, we do not provide medical advice, and we do not hold clinical records about you. Anything you choose to share with us about your health, weight or medication is shared voluntarily and is treated as described in section 5.
4. What Personal Data We Collect
4.1 Data You Give Us Directly
Account and membership data:
– Name
– Email address
– Password (stored in hashed form; we cannot read it)
– Username and display name
– Profile photo, if you choose to add one
– Postal address, if you choose to provide it so we can send printed welcome materials
– Country and time zone
Payment data:
– Subscription plan, start date, renewal dates and payment history
– The last four digits and card type of your payment method
– Billing name and address
We never see or store your full card number. Payments are processed by our payment processor (see section 7).
Email list data:
– Email address
– Name, if you gave it
– The date you subscribed and the page or form you subscribed through
– Which emails you open and which links you click
Content you post:
– Posts, comments, replies, reactions and media you share in the community feed, groups and forums
– Private messages you send to other members
– Replies you send to our emails
– Anything you submit in polls, challenges, surveys or feedback forms
Correspondence:
– Emails, support requests and any other messages you send us
4.2 Data We Collect Automatically
– When you use the website or app:
– IP address
– Device type, operating system and browser
– App version and device identifiers (for push notifications and crash reporting)
– Pages and screens visited, features used, time and date of visits
– Login times and activity within the platform (for example, which weeks you were active, which challenges you completed, which badges you earned)
– Cookies and similar technologies (see section 12)
4.3 Data From Third Parties
– If you sign up via a social login (where offered), we receive the name and email address that service provides
– Our payment processor tells us whether a payment succeeded, failed or was refunded
– If a friend refers you, we record that referral against both accounts
4.4 Data We Do Not Collect
We do not collect data from any health app, wearable, scale or medical provider. We do not ask for, and do not want, medical records, prescriptions or clinical test results. Please do not upload them.
5. Health-Related Data: Please Read This Section
Because of what ATJ is about, you will almost certainly talk about your weight, your eating, your medication and your wellbeing inside the community. Under UK GDPR, information about health is “special category data” and gets extra protection.
How we treat it:
– We never require you to share any health information. Your membership works without it.
– Any health information you choose to post in the feed, groups, forums, profile or messages is shared on the basis of your explicit consent, which you give by ticking the box at sign-up and by choosing to post it. You can withdraw that consent at any time by deleting the content or closing your account.
– We do not use your health information to make automated decisions about you, to profile you for advertising, or to sell or share it with anyone outside the processors listed in section 7.
– Activity and gamification records (active weeks, badges, points, completed challenges) are records of your engagement with the platform. They are not clinical measures and we do not treat them as health records.
– We strongly recommend you do not post anything you would be uncomfortable having other members see. Posts in the community are visible to other members (see section 8).
6. Why We Use Your Data and Our Lawful Basis
Under UK GDPR we must have a lawful basis for each use of your data.
To provide your membership (lawful basis: performance of a contract)
– Create and manage your account
– Give you access to the website, app and member content
– Process subscription payments, renewals and refunds
– Run gamification, challenges and progress tracking
– Send you service emails about your account, payments, and changes to the platform or this policy
– Post printed welcome materials to you, if you asked for them
– Provide support
To run and improve the service (lawful basis: legitimate interests)
– Understand how members use the platform and what they find useful
– Fix bugs, monitor performance and keep the service secure
– Moderate content, enforce our community guidelines and deal with abuse
– Prevent fraud and misuse
– Keep records of decisions and communications in case of a dispute
When we rely on legitimate interests we have weighed our interests against your rights and do not believe our use of your data overrides them. You can object at any time (see section 11).
To send you marketing emails (lawful basis: consent, or the soft opt-in for existing customers)
– Send daily emails, promotions, news and offers about ATJ
– You can unsubscribe at any time using the link in every email
To process health-related content you post (lawful basis: explicit consent, as described in section 5)
To comply with the law (lawful basis: legal obligation)
– Keep accounting and tax records
– Respond to lawful requests from regulators or law enforcement
– Comply with data protection law itself, including responding to your rights requests
7. Who We Share Your Data With
We do not sell your personal data. We share it only with:
7.1 Service Providers (Processors) Who Help Us Run ATJ
These companies process data on our instructions under written contracts. At the date of this policy they are:
– WP Engine, who host the website and database
Location: worldwide
– BuddyBoss (BuddyBoss Ltd / AppBoss), who provide the community platform software and the white-label mobile app infrastructure, including push notifications
Location: [United States]
– MemberPress (Caseproof LLC), who provide our membership and subscription management software
Location: United States
– Stripe Payments UK Ltd / PayPal (Europe) S.a r.l., who process payments
Location: UK / EU, with some processing in the United States
– Berserker Mail, who send our emails and record opens and clicks
Location: United States
– Vimeo, Inc., who host our member videos and may record viewing data
Location: United States
– GamiPress, which runs inside our own website and does not send data elsewhere
– Google, whose reCAPTCHA service helps protect our forms against automated submissions.
– Apple and Google, who distribute the app through their stores and may collect device and crash data under their own policies
7.2 Other Members
Content you post in public areas of the community is visible to other members. See section 8.
7.3 Professional Advisers
Our accountants, solicitors and insurers, where necessary.
7.4 Authorities
Where we are legally required to, or where we reasonably believe it is necessary to protect someone’s safety or to prevent fraud or crime.
7.5 Business Changes
If ATJ is sold, merged or restructured, your data may be transferred to the new owner, who must honour this policy.
8. What Other Members Can See
– Your display name, profile photo and any profile fields you choose to fill in are visible to other members.
– Posts in the main feed and in open groups are visible to all members.
– Posts in private groups are visible only to members of that group.
– Private messages are visible only to the people in the conversation.
– Leaderboards, if enabled, show your display name and points or badges to other members. You can ask us to hide you from leaderboards.
– ATJ is a private, paid community. Nothing you post is visible to the public or indexed by search engines. However, we cannot control what other members do with what they see, so please post with care.
– Our moderators and administrators can see all content, including private messages, for moderation, support and safety purposes. We only look at private messages where there is a genuine reason, such as a complaint or a technical fault.
9. International Transfers
Some of our service providers are based in, or store data in, the United States or other countries outside the UK. Where that happens we make sure the transfer is protected by one of the safeguards recognised under UK law, which may include:
– The UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses
– The UK Extension to the EU-US Data Privacy Framework, for providers certified under it
– A UK adequacy decision for the country concerned
You can ask us for more information about the safeguard used for a particular provider.
10. How Long We Keep Your Data
– Account and profile data: for as long as your membership is active, and then for 12 months after your account closes, in case you rejoin or there is a dispute. After that it is deleted or anonymised.
– Content you posted: deleted or anonymised when your account is deleted, except where another member’s content would become meaningless without it (for example a reply thread), in which case it is attributed to “Former member”.
– Private messages: deleted from your account when you delete it. The other party retains their copy.
– Payment and accounting records: 6 years after the end of the tax year they relate to, as required by HMRC.
– Email list data: until you unsubscribe, plus a suppression record of your email address so we do not email you again by mistake.
– Support correspondence: 2 years.
– Server logs and security data: 90 days.
– Backups: deleted data may persist in encrypted backups for up to 30 days before being overwritten.
Where we no longer need to identify you, we may keep anonymised statistics indefinitely.
11. Your Rights
Under UK GDPR you have the right to:
– Access: ask for a copy of the personal data we hold about you
– Rectification: ask us to correct inaccurate or incomplete data
– Erasure: ask us to delete your data, subject to the retention obligations in section 10
– Restriction: ask us to pause processing in certain circumstances
– Portability: receive the data you gave us in a machine-readable format
– Objection: object to processing based on legitimate interests, and object at any time to direct marketing
– Withdraw consent: where we rely on consent, withdraw it at any time without affecting processing that happened before
– Complain: to the Information Commissioner’s Office (see section 14)
To exercise any of these rights, email neil@afterthejabs.com. We will respond within one month. We may ask you to confirm your identity first. We will not charge you unless a request is clearly excessive.
You can also delete your own posts, edit your profile, unsubscribe from emails, and delete your account yourself from within the platform.
12. Cookies and Similar Technologies
Our website uses cookies and similar technologies for:
– Essential functions: keeping you logged in, remembering your preferences, protecting against security threats. These cannot be switched off.
– Analytics: Google Analytics is currently disabled.
– Video: Vimeo may set cookies when you watch an embedded video. You can enable Vimeo through the video consent prompt.
– Form protection: Google reCAPTCHA is used on our forms. Where it is blocked by your cookie choice, the form shows a control to enable it.
We do not use advertising cookies and we do not allow third parties to track you across other websites for advertising purposes.
You can change your cookie choices at any time using Manage Cookie Consent on our website. You can also manage cookies through your browser settings. Blocking essential cookies will stop the site working properly.
The mobile app does not use cookies but uses equivalent device storage to keep you logged in, and uses a device token to deliver push notifications. You can switch off push notifications in your device settings.
13. Security
We take reasonable technical and organisational steps to protect your data, including:
– Encryption of data in transit (HTTPS) across the website and app
– Hashed storage of passwords
– Access to administrative functions limited to named individuals
– Regular software updates and encrypted backups
– Staging environments for testing changes before they go live
– Contracts with every processor requiring appropriate security
No system is perfectly secure. If we become aware of a breach that is likely to put your rights at risk, we will tell you and, where required, the ICO, without undue delay.
Please use a strong, unique password and do not share your login.
14. Complaints
If you are unhappy with how we have handled your data, please tell us first at neil@afterthejabs.com so we can try to put it right.
You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
If you are outside the UK you may also be able to complain to your local data protection authority.
15. Children
ATJ is for adults. You must be 18 or over to join. We do not knowingly collect data from anyone under 18. If you believe a minor has joined, contact us and we will remove the account.
16. Changes to This Policy
We may update this policy from time to time. Minor changes will simply be published here with a new date. If we make a significant change to how we use your data, we will email members before it takes effect.
This version: 2nd October 2026
Previous versions are available on request.
17. Contact
After The Jabs Ltd
B4 Marquis Court, Team Valley, Gateshead, NE11 0RU
neil@afterthejabs.com
Company number: 15419154
ICO registration: ZC229617