Special category data: your health information

Because Level 7 provides clinical services, much of the information we hold about clients is health data, which UK GDPR treats as a special category of personal data requiring extra protection.

We rely on the following to process this lawfully:

• Explicit consent, given at your consultation, when you agree for us to record and use your health information to plan and deliver your treatment

• Provision of health or social care, which allows regulated health professionals, and those working under a duty of confidentiality, to process health data for care purposes without needing consent for every individual use

Your health information is only used to provide and manage your care at Level 7, and to meet our professional and regulatory obligations. It is not used for marketing, and it is not sold or shared with third parties for their own purposes.

Where your care involves more than one specialist within the team, for example if your skin health treatment is being considered alongside Lifestyle Medicine or GP input, relevant clinical information may be shared internally between the clinicians involved in your care, so that your treatment is properly coordinated.

Who we share your information with

We share personal data with the following categories of third party, only where necessary:

• Our clinical team. Clinicians at Level 7 involved in delivering or coordinating your care.

• Fresha, our booking platform, which processes your booking details when you schedule a consultation or treatment.

• GoCardless, our payment provider, which processes Direct Debit payments for The Circle membership.

• Google, through Google Analytics, for website usage data. This is set out in more detail in our Cookies Policy.

• Regulatory or professional bodies, where we are legally required to disclose information, for example to a professional registration body, or where required by law.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

Some of these providers may process data on servers outside the UK. Where this happens, we rely on their compliance with UK GDPR safeguards, such as the UK's international data transfer agreement or equivalent standard contractual clauses, to ensure your data continues to be protected to an appropriate standard.

How long we keep your information

We keep personal data for as long as necessary to provide our services and to meet our legal and professional obligations. Clinical records, in particular, are generally subject to minimum retention periods set by professional and regulatory guidance for the relevant discipline, which can be longer than for other business records.

[Insert confirmed retention periods here once agreed with Emma and, where relevant, the individual clinicians' professional bodies, since retention obligations can differ between skin health, GP services, and women's health records.]

Your rights

Under UK GDPR, you have the right to:

• Ask us what personal data we hold about you, and receive a copy of it (the right of access)

• Ask us to correct inaccurate or incomplete information (the right to rectification)

• Ask us to delete your information, in certain circumstances (the right to erasure)

• Ask us to restrict how we use your information, in certain circumstances (the right to restriction)

• Object to us using your information for certain purposes, including direct marketing (the right to object)

• Ask us to provide your information in a portable format, where technically feasible (the right to data portability)

• Withdraw consent at any time, where we are relying on consent, without affecting the lawfulness of anything done before you withdrew it

To exercise any of these rights, please contact us at emma@level7clinic.co.uk. We may need to verify your identity before responding, and there may be limits on some rights where, for example, clinical record-keeping obligations require us to retain certain information.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, if you believe we have not handled your information properly. Details are available at ico.org.uk.

Marketing communications

If you've agreed to receive marketing from us, you can opt out at any time by contacting us directly or using the unsubscribe link in any marketing email. Opting out of marketing does not affect communications we need to send you about your appointments or treatment.

Cookies

Our website uses cookies. Full details are set out in our separate Cookies Policy.

Changes to this policy

We may update this policy from time to time to reflect changes in how we handle personal data, or for legal or regulatory reasons. Please check back periodically to stay informed.

Contact us

If you have any questions about this policy or how we handle your personal data, please contact us at emma@level7clinic.co.uk or write to us at Level 7, Hollybank, Market Street, Hambleton, Poulton Le Fylde, FY6 9AS.