Background
Zults is a sexual health app that enables users to turn their existing STI test results into verified, shareable digital credentials known as ‘Rezults’. Users can connect with participating healthcare providers or upload existing results, before choosing when and how to share their information with others. Designed with privacy and user control at its core, the platform combines secure STI result sharing with social and educational features that encourage open conversations around sexual health.
Ahead of launching the app, Zults engaged the DPO Centre to ensure data protection was embedded into its design from the outset. With plans to process special category health data and integrate third-party healthcare services, the company required specialist support to establish appropriate consent mechanisms, safeguards, and documentation in line with the UK GDPR.
Key Challenges
- Establishing appropriate consent mechanisms
- Safeguarding special category health data
- Integrating 3rd party healthcare providers
Solution
The designated DPO worked closely with Zults to understand how personal data would be collected, used, and shared throughout the app. By reviewing individual user journeys and functionality, the DPO identified the appropriate lawful bases for different processing activities, and where consent was needed for meeting Article 9 UK GDPR requirements. Data Protection Impact Assessments (DPIAs) and a Legitimate Interests Assessment (LIA) helped ensure higher-risk processing was properly assessed before launch.
Given the sensitivity of STI data, particular attention was given to limiting unnecessary exposure and giving users meaningful control over what they shared. The DPO advised on consent and transparency measures alongside technical safeguards, including restricting third-party access and ensuring health information accessed through the Single Sign-On (SSO) functionality was not retained beyond the relevant session. This allowed Zults to offer social and healthcare functionality whilst maintaining a secure, privacy-conscious environment.
The DPO also supported Zults in integrating third-party healthcare and technology providers, reviewing relationships and establishing appropriate Data Processing and Data Sharing Agreements. Privacy Notices were developed to clearly explain how information is shared, while additional support around Data Subject Access Request (DSAR) procedures and response templates gave Zults a practical framework for managing individuals’ rights as the platform grows.
Outcome
Rachel Cantwell, Project Manager at Zults, said: ‘The DPO’s expertise and attention to detail were invaluable as we developed Zults App. They helped us understand which data privacy precautions were needed and why, guided us through new features, and thoroughly reviewed our third-party integrations. We particularly appreciated their personable approach and having a dedicated officer who understood our product and its development. Their support gave us confidence in our decisions, and we would highly recommend them.’
