Privacy Notice

Privacy Notice

Effective Date: 24th July 2026 

(This notice updates the previous notice dated 9th October 2023)

Your Privacy

We process personal data lawfully, fairly and transparently; collect only the information we need; keep it accurate and secure; and retain it only for as long as necessary for the purposes explained in this Privacy Notice.

This Privacy Notice explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, and the rights you have under UK data protection law.

Compliance with the Law

Our Privacy Notice aims to comply with the UK Data Protection Act 2018 (DPA) and the UK General Data Protection Regulation (UK GDPR). 

We have divided this Notice into key sections to make it easier for you to find the information you need: 

  1. Information: Who we are and what our obligations are. 

  2. Disclosure: Who collects your personal data and what is collected. 

  3. Purpose and Legal Basis: Why we collect your data, how we use it, and our legal basis for processing. 

  4. Security: How we keep your personal data safe and how we store it. 

  5. Access and your data protection rights: How you access, change, or edit your data, and your data protection rights. 

  6. Accountability and Complaints: How you can correct your data and contact the person responsible for overseeing your data. 

1. Information

Who Are We?

  • Company Name: Wellthy Clinic Ltd 

  • Registered Address: Unit 28 City Business Centre, Lower Road, London, SE16 2XB

  • Company Number: 12411051

  • ICO Registration Number: ZB383117

What Are Our Responsibilities?

We provide Osteopathy, Nutrition, and Pilates services online and at our clinic. 

We are the Data Controller of your personal data. Where necessary, we maintain Data Processing Agreements with our partners and service providers to ensure your data is handled appropriately, securely, and in compliance with the law. 

How Does This Notice Affect You?

This Privacy Notice helps you understand why and how we collect, process, and store your information. It also outlines your statutory rights to help you make informed choices. 

For further information about your rights under UK data protection law, please visit the Information Commissioner's Office at www.ico.org.uk

Cookies

We use cookies on our website. You will be asked for your consent to use non-essential cookies when you first visit our site. 

  • You may refuse all non-essential cookies via our cookie banner or browser settings. 

  • You can change your cookie preferences at any time. 

  • Please read our Cookie Notice for further details. 

2. Disclosure

2.1 Categories of Data Processed

We collect and process the following categories of information: 

  • Basic Identifiable Data: Name, email address, postal address, telephone number and date of birth. 

  • Verification Data: Information required to verify your identity

  • Process Payments we need to use you data to process payments. 

  • Special Category Data: Health-related information, medical history, and assessment records. 

  • Electronic Identifiable Data: Cookies, IP addresses, and tracking beacons. tracking technology, device details, and IP location data. 

  • Internet Activity: pages viewed on our website. 

2.2 Sources of Data

We obtain personal data from the following sources: 

  • Directly from you: For example, when you fill in intake forms, book an appointment, or contact us. 

  • Indirectly from you: Through automated tracking and analytics during your interactions with our website. 

  • Third parties: For example, if you are referred to us by another healthcare professional. 

2.3 Special Category Health Data

Under the UK GDPR (Article 9), certain types of personal information are designated as Special Category Data because they are sensitive and require additional protection. In our practice, health data such as medical history, clinical notes, and health assessment records falls into this category. 

  • Collection and Use: We only collect, process, and store health data that is necessary to provide you with safe, effective, and high-quality healthcare services as registered healthcare professionals or healthcare practitioners.

  • Third-Party Disclosures: We do not release clinical records, diagnostic notes, or medical reports to third parties, including insurance companies, employers, or legal representatives, without your explicit, written consent (in accordance with the UK GDPR and common law duty of confidentiality), or unless required to do so by a binding court order or legal obligation. 

  • Sharing with Healthcare Professionals: We will only share health data with other healthcare professionals or our healthcare practitioners. (e.g., your GP or referring specialists) where necessary for your care, or where required by law. 

  • Data Security: Health data is stored at a high level of security, utilising robust encryption, access controls restricted to authorised personnel, and secure transfer protocols. 

  • Access and Retention: You have the right to request access to your health records at any time. While you may also request the erasure of your data, please note that clinical records are subject to statutory retention requirements under UK healthcare law and must be retained for mandatory statutory periods. 

(For more information on individual access rights and health data exceptions, you can visit the ICO Health Information Guidance). 

2.4 Google Analytics

We use Google Analytics to gather statistics and basic analytical tools to optimise our search engine presence and marketing efforts. Google may collect: 

  • browser information

  • IP address

  • pages visited

  • approximate location

You may opt out of tracking by Google Analytics at any time using the Google Analytics Opt-out Browser Add-on. For further information, please read Google's Privacy Notice. 

2.5 Third-Party Service Providers

We work with external service providers to operate our business: 

2.6 International Transfers

Some of our third-party service providers may process or store personal data outside the United Kingdom.

Where personal data is transferred internationally, we ensure that appropriate safeguards are in place to protect your information in accordance with Chapter V of the UK GDPR. Depending on the provider and destination country, these safeguards may include:

  • an adequacy decision or adequacy regulations issued by the UK Government; 

  • the UK Extension to the EU-U.S. Data Privacy Framework; or 

  • the UK International Data Transfer Agreement (IDTA) or other approved contractual safeguards. 

We take reasonable steps to ensure that any organisation receiving your personal data provides an appropriate level of protection consistent with UK data protection law.

3. Purpose and Legal Basis

Under the UK GDPR, we must have a lawful basis to collect, process, and store your personal data. 

3.1 Standard Personal Data (Article 6 UK GDPR)

We process standard personal data under the following lawful bases: 

  • Performance of a Contract (Article 6(1)(b)): Necessary to enter into or perform our agreement with you, including managing bookings, providing healthcare services, handling pre-contractual inquiries, and account administration. 

  • Legitimate Interests (Article 6(1)(f)): Necessary for our legitimate business interests, provided these are not overridden by your rights. This includes website optimisation, internal business analytics, handling complaints, and defending legal claims. 

  • Consent (Article 6(1)(a)): Where you have given clear consent for a specific purpose, such as subscribing to our email newsletters. You may withdraw consent at any time. 

  • Legal Obligation (Article 6(1)(c)): Necessary to comply with statutory legal and financial requirements such as health record retention or tax record-keeping. 

3.2 Special Category Health Data (Article 9 UK GDPR)

We process sensitive health information under the following conditions: 

  • Provision of Healthcare and Treatment (Article 9(2)(h)): Our primary condition for processing health data is that it is necessary for healthcare provision, diagnosis, treatment, and clinical management by registered health professionals. 

  • Explicit Consent (Article 9(2)(a)): We will obtain your explicit, written consent before sharing clinical notes or medical reports with any third party (e.g., insurance companies, employers, legal representatives) or for non-treatment purposes. 

3.3 Is Providing Your Personal Data Mandatory?

Some of the personal data we request is necessary for us to provide safe and effective healthcare services and to comply with our legal and professional obligations. If you choose not to provide information that is required for these purposes, we may be unable to provide treatment or continue to provide our services safely and appropriately.

Where we request information solely on the basis of your consent (for example, for marketing communications), you give us this information entirely voluntarily.

3.4 Marketing & Communications

We only send updates, health advice, and newsletters by email where you have provided explicit opt-in consent. 

  • Third-Party Sharing: We will not sell or share your contact details with third parties for marketing purposes. 

  • Withdrawing Consent: You can unsubscribe at any time using the link at the bottom of our emails or by contacting us. Withdrawing marketing consent will not affect your ability to receive healthcare or use our services. 

3.5 Your Right to Withdraw Consent & Request Erasure

Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time (Article 7(3) UK GDPR). This will not affect the lawfulness of any processing carried out before consent was withdrawn.

You may also request the deletion of your personal data by contacting us

(Please note: Requests to erase medical records are subject to statutory retention obligations under UK healthcare regulations). 

3.6 Children’s Information

Website and Online Services

Our website and online services are not intended for children under the age of 13. Where we rely on consent for online services provided directly to a child, we will obtain parental or guardian consent where required by UK data protection law.

Clinical Services

We provide healthcare services to children and young people where appropriate. Personal data relating to children will be processed only where this is necessary for the provision of healthcare and in accordance with UK data protection law.

For younger children, a parent or person with parental responsibility will normally provide information and consent on their behalf. Where appropriate, and in accordance with the principles of Gillick competence, a healthcare practitioner may determine that a young person has sufficient maturity and understanding to make decisions about their own healthcare.

4. Security

4.1 How Your Data Is Stored

We implement appropriate technical and organisational security measures to protect your personal information: 

  • Cloud Platforms: Information stored on cloud systems (such as Cliniko or Square) is protected under strict Data Processing Addendums (DPAs) and robust security standards. 

  • Internal Systems: Computer systems and mobile devices used to access client records are encrypted, password-protected, and restricted strictly to authorised staff. 

  • Payment Data: Payment card details are processed directly through secure payment gateways (Square/PayPal). Our staff never store or have access to full payment card numbers. 

4.2 Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected from the date of your last treatment.

  • Financial Records: Financial and tax records (invoices) are retained for 6 years in accordance with UK tax laws. 

  • Clinical Health Records: Clinical records are retained for the periods required by applicable legal, regulatory and professional record-retention requirements. Records for children are retained until their 25th/26th birthday in accordance with healthcare regulatory guidance. 

4.3 Data Encryption

We use Secure Sockets Layer (TLS) encryption to secure data transmitted across our website. You can verify this by checking for the padlock icon in your browser's address bar. 

5. Access and Your Data Protection Rights

Under the UK GDPR, you have the following statutory rights: 

  • Right of Access (Article 15): Request copies of your personal data. 

  • Right to Rectification (Article 16): Request corrections to inaccurate or incomplete data. 

  • Right to Erasure (Article 17): Request the deletion of your personal data, subject to statutory health record retention limits. 

  • Right to Restrict Processing (Article 18): Request that we restrict the processing of your data in certain circumstances. 

  • Right to Data Portability (Article 20): Request the transfer of your data to another organisation or directly to you. 

  • Right to Object (Article 21): Object to processing based on legitimate interests or direct marketing. 

Exercising Your Rights

To exercise any of these rights, please contact us by email. We have One Calendar Month to respond to your request. Subject Access Requests (SARs) are fulfilled free of charge, unless the request is manifestly unfounded, excessive, or repetitive, in which case a reasonable administrative fee may apply. 

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

6. Accountability & Complaints

How to Contact Us

If you have questions about this Privacy Notice or wish to exercise your data rights, please contact us: 

  • Data Protection Lead: Matthew Glithero

  • Contact Us: Here

  • Postal Address: 63 New Cavendish Street, London, W1G 7LP.  

How to Lodge a Complaint

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO): 

  • Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

  • Telephone: 0303 123 1113 

  • Website:https://ico.org.uk

Privacy Notice Last Updated: 24th July 2026