This notice explains how we use your personal data when you use the Wellzone Clinics – London app on iPhone or Android (“the app”). It adds to our clinic privacy policy at wellzoneclinics.co.uk/privacy-policy, which covers the care we provide at our clinics.
1. Who we are
The data controller is Olive Health & Travel Ltd, trading as WellZone Medical and Wellzone Clinics (“Wellzone”, “we”, “us”), a company registered in England and Wales (company number 09087640; registered office: Unit 3b Berol House, 25 Ashley Road, London N17 9LJ). We are registered with the Information Commissioner’s Office under number ZA152476.
Address: 15-19 Bakery Street, Bermondsey, London SE16 3GF, United Kingdom
Email: info@wellzoneclinics.co.uk · Phone: 0330 221 5953
2. What we collect through the app
- Account details: your name, email address and a user ID. You can create an account with an email address and password, or sign in with Google or Apple. If you use Sign in with Apple, Apple may give us a private relay email address instead of your own.
- Appointments: the treatment, clinic, practitioner and time you choose when you book, and any online consultation request you send. Because the treatment you choose can reveal information about your health, we treat it as special category (health) data.
- Phone number: when you request an appointment we ask for your mobile number, if we do not have it yet, so the clinic can call you to confirm or rearrange the time.
- Messages: messages you send to a clinic in the app and the clinic’s replies. Our clinic team reads and answers them. Messages can contain health information, so we treat them as special category (health) data. Messages are not for emergencies.
- E-mail news (optional): if you choose to receive news and visiting consultant dates by e-mail, or you are an existing patient, we may send you occasional e-mails about similar services. We measure whether these e-mails are opened and which links are clicked, using a small image and tracked links. You can unsubscribe with one click in any e-mail or in the app (Notifications → E-mail news); we then stop, and keep your address only on a do-not-email list.
- Care plans: if your clinic adds a care plan for you, the app shows the plan and the step you are on.
- Your clinic record: if you are already a patient, the app links your account to your existing record using your verified email address and shows your appointments and care information from it.
- Notifications: if you allow notifications, we store a push notification token, a random device ID created by the app, your platform (iOS or Android) and your language, so we can tell you about your appointments (confirmations, changes, cancellations and reminders), replies from the clinic and updates to your care plan. Notification text does not name your treatment or clinician.
Kept on your phone only. Answers and photos you add to a pre-consultation assessment, your language choice and your sign-in session are stored on your device. Assessment answers and photos are not sent to us in this version of the app.
What we do not collect. The app does not use your location, contacts, camera or microphone. It does not contain advertising, analytics or crash-reporting software, does not read your advertising ID and does not track you across other companies’ apps or websites. The app does not use Apple Health or Health Connect.
3. How we use your data and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Create and run your account; let you sign in | Contract, or steps at your request before a contract (Article 6(1)(b)) |
| Send e-mail news and measure opens and clicks | Your consent, or for existing patients our legitimate interest in telling you about similar services (soft opt-in, Privacy and Electronic Communications Regulations, regulation 22). You can unsubscribe at any time. |
| Answer your messages and run your care plan | Article 6(1)(b); for health information, the provision of health care (Article 9(2)(h)) |
| Book appointments, handle consultation requests and show your appointments | Article 6(1)(b); for health information, the provision of health care (Article 9(2)(h)) |
| Send notifications you have allowed | Our legitimate interest in running your care and keeping you informed (Article 6(1)(f)). You can turn notifications off at any time. |
| Keep clinical and booking records | Legal obligation (Article 6(1)(c)) and Article 9(2)(h) |
| Keep the app secure and prevent misuse | Legitimate interests (Article 6(1)(f)) |
We do not sell your data and we do not use it for advertising.
4. Who processes your data for us
We use the following service providers. They act on our instructions and may not use your data for their own purposes:
- Supabase – secure hosting, sign-in and database for the app (data stored in London, United Kingdom).
- Pabau – our clinic management system, which holds appointments and clinic records.
- Amazon Web Services (Amazon SES, London) – sends our e-mail news.
- Expo – delivers push notifications to Apple and Google’s notification services.
- Google and Apple – only if you choose to sign in with them; Apple and Google also deliver notifications to your phone.
Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the ICO’s International Data Transfer Agreement or Addendum.
We may also share information with laboratories, specialists or other healthcare professionals when this is needed for your care, or when the law requires it, as described in our clinic privacy policy.
5. How long we keep your data
- App account and notification settings: until you delete your account.
- E-mail news: until you unsubscribe; your address then stays on a do-not-email list so we do not write to you again.
- Messages with the clinic: kept with your clinical record, because they can be part of your care.
- Clinical and appointment records: for at least 8 years after your last contact with us, in line with the NHS Records Management Code of Practice for adult health records, even if you delete your app account.
6. Deleting your app account
You can delete your account at any time in the app (Profile → Delete account) or by following the steps on wellzoneclinics.co.uk/app/delete-account. We then delete your login, your app settings and your notification devices, and remove your email address from the app account. Your clinical records are kept by the clinic as UK law requires. To clear data stored on your phone, remove the app.
7. Security
Data sent between the app and our systems is encrypted in transit (HTTPS). Access to records is limited to authorised staff, and each patient can only see their own information in the app.
8. Your rights
You have the right to access your personal data, to have it corrected, to have it erased where the law allows, to restrict or object to its use, and to data portability. Where we rely on your consent, you can withdraw it at any time. To use these rights, email info@wellzoneclinics.co.uk.
If you are unhappy with how we use your data, please contact us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
9. Children
The app is intended for adults aged 18 and over.
10. Changes to this notice
We will update this page when the app changes how it uses personal data and change the “Last updated” date above.