Privacy policy
Last updated 28 August 2026
Who we are
fira is a brand of Orbyt Group Ltd, a company registered in England and Wales with its registered office at 167-169 Great Portland Street, London, England, W1W 5PF. Orbyt Group Ltd is the data controller for the personal information described in this policy. You can write to us at care@joinfira.com, or at that address, about anything in it.
What we collect
- Your health assessment. The answers you give in our assessment, including your symptoms, medical history and medication. This is special category health data and we treat it that way throughout.
- Who you are. Your name, date of birth, email address and phone number. We ask for your exact date of birth because our safety checks depend on your age.
- Delivery details. The address your treatment is sent to, kept as an append-only history so we always know where an order actually went.
- Orders and billing records. What you ordered, its status, and references to payments. Your card details never reach us: payment is handled entirely by Stripe, and there is no card number anywhere in our systems.
- Your messages. Conversations with our care team by email or WhatsApp.
- Consent records. Every consent you give or withdraw, with the exact wording you saw at the time, kept append-only so the history cannot be rewritten.
- Technical information. First-party usage events (which screens of our own site you reached) and a one-way hashed form of your IP address. We do not run third-party analytics or advertising trackers.
Why we use it
- To provide the service you asked for: assessing your suitability for treatment, issuing prescriptions through registered prescribers, dispensing through a registered pharmacy, and delivering to you. For your health data we rely on your explicit consent and on the provision of health care under the responsibility of regulated professionals (UK GDPR Articles 9(2)(a) and 9(2)(h)).
- To keep you safe: our assessment applies safety rules, and anything that needs a clinical eye goes to a person.
- To keep required records: prescription and clinical records are kept for the periods professional record-keeping rules require.
- To message you about your own care: reminders and follow-ups about an assessment or order you started.
- Marketing, only with your consent: email and WhatsApp marketing are separate consents, asked separately, and you can withdraw either at any time. Every marketing email carries an unsubscribe link that works without logging in.
Our care assistant uses AI
Messages from Marta, our care coordinator, are drafted with the help of an artificial intelligence service (Anthropic) operating under strict rules we set. It cannot give medical advice, cannot see your assessment answers when writing marketing or reminder messages, and no decision about your treatment is ever made by it. Prescribing decisions are made by GMC-registered prescribers, always.
Who we share it with
We use a small number of service providers, each doing one job:
- Supabase hosts our database.
- Vercel hosts our website.
- Stripe processes payments. Card details go to Stripe directly and never touch us.
- Resend delivers our emails; Telnyx delivers WhatsApp and SMS messages.
- Anthropic provides the AI service behind our care assistant.
- Ideal Postcodes looks up UK addresses at checkout.
- Our clinical partner and dispensing pharmacy receive what they need to prescribe and dispense your treatment: your identity, relevant assessment answers, the prescription, and your delivery address.
Some of these providers process data in the United States. Where they do, transfers are protected by UK-approved safeguards (the UK International Data Transfer Addendum or equivalent). We never sell your data, and nobody receives it for advertising.
Cookies
We set one cookie of our own, fira_resume. It lets you pick up your assessment where you left off on the same device. It contains a random reference, no personal information, cannot be read by scripts on the page, and expires after 30 days or as soon as you complete a purchase, whichever comes first. Logging in stores a session in your browser so you stay signed in. We set no advertising cookies and no third-party analytics cookies, which is why we do not show a cookie banner: everything we set is strictly necessary to provide what you asked for.
How long we keep it
Clinical and prescription records are kept for the retention periods professional rules require. Consent history is kept as long as we need to prove what you agreed to. If you ask us to erase your data, we honour it by redaction: your personal details are removed, any resume links and cookies stop working immediately, and a suppression record keeps us from ever contacting you again. The bare fact that an order was once dispensed is retained where pharmacy rules require it.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to erase it, restrict or object to processing, take your data elsewhere, and withdraw any consent at any time. Write to us at care@joinfira.com, or at our registered address above. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can fix it.
Changes
If this policy changes in a way that matters, we will tell you before it takes effect, not after.