Privacy Policy
Effective Date: 19 February 2026
Welcome to Hellier Health. This privacy policy explains how we collect, use, store, and protect your personal data. It applies to all patients, website visitors, and anyone who contacts us.
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Who We Are
Hellier Health is the data controller for your personal data. This means we decide how and why your data is processed.
Contact Details
Email: info@hellierhealth.com
Address: 12 Stortford Road, Great Dunmow, Essex, CM6 1DA
Phone: 01371 502088
What Data We Collect
We collect the following types of personal data:
• Identity and Contact Data: Your name, address, telephone number, email address, and date of birth.
• Health and Treatment Data: Your medical history, details of your condition, treatment notes, and clinical outcomes. Under UK GDPR, health data is classified as “special category data” and receives the highest level of legal protection.
• Payment Data: Payment card details (processed securely by our payment providers — we do not store card numbers), transaction records, and invoices.
• Technical Data: When you visit our website, we may collect your IP address, browser type, pages visited, and cookies (see Cookies section below).
How We Use Your Data and Our Legal Basis
UK GDPR requires us to have a lawful basis for processing your data. Here is how we use it and why we are permitted to do so:
• Providing treatment and managing appointments — Legal basis: Legitimate interests (healthcare provision) and DPA 2018 Schedule 1 (health purposes). We are registered healthcare professionals and this processing is necessary to provide you with care.
• Collaboration between practitioners — Legal basis: Legitimate interests (ensuring the best clinical outcome for you). Where appropriate, practitioners within our team may discuss your case to provide coordinated care.
• Processing payments and billing — Legal basis: Contract (necessary to fulfil our agreement with you) and legal obligation (HMRC record-keeping requirements).
• Sending appointment reminders and clinic communications — Legal basis: Legitimate interests (managing our relationship with you).
• Marketing (newsletters, offers, service updates) — Legal basis: Consent. We will only send you marketing communications if you have given us permission to do so. You can withdraw consent at any time by emailing info@hellierhealth.com or clicking “unsubscribe” in any marketing email.
• Personalised advertising on social media — Legal basis: Consent. With your explicit permission, we may use your data to show you relevant advertising on platforms such as Facebook and Instagram. You can withdraw consent at any time by contacting us.
• Responding to enquiries — Legal basis: Legitimate interests. We may use AI-assisted tools to help respond to your messages. These are supervised by our team and no clinical decisions are made by automated systems.
• Improving our website — Legal basis: Legitimate interests (understanding how our website is used so we can improve it).
Third-Party Service Providers
We use trusted third-party providers to help run our clinic. These include:
• Clinical records and booking: Cliniko (patient records, appointment scheduling)
• Payment processing: Stripe, Square, and GoCardless
• Communication: Secure messaging and email platforms
• Marketing: Email marketing tools and social media platforms
• Analytics: Website analytics to understand visitor behaviour
We only share the data necessary for each provider to perform their function. All providers process data in accordance with UK GDPR and have appropriate data processing agreements in place.
International Data Transfers
Some of our service providers are based outside the UK (for example, payment processors and social media platforms). Where your data is transferred internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or transfers to countries with a UK adequacy decision.
How Long We Keep Your Data
We keep your data only for as long as necessary. Our specific retention periods are:
• Clinical and treatment records: 8 years from your last appointment, in line with NHS and professional body guidelines.
• Financial and payment records: 6 years, as required by HMRC.
• Marketing consent records: Until you withdraw your consent.
• Website analytics data: 90 days.
• Enquiry and contact form data: 2 years from your last contact, unless you become a patient.
After these periods, your data is securely deleted or anonymised.
Your Rights
Under UK data protection law, you have the following rights:
• Access: You can request a copy of the personal data we hold about you.
• Rectification: You can ask us to correct any inaccurate or incomplete data.
• Erasure: You can ask us to delete your data in certain circumstances (though we may need to retain clinical records for the periods above).
• Restriction: You can ask us to limit how we process your data.
• Objection: You can object to processing based on legitimate interests.
• Portability: You can request your data in a portable format to transfer to another provider.
• Withdraw consent: Where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at info@hellierhealth.com. We will respond within one month.
Cookies
Our website uses cookies — small files stored on your device — to help it work properly and to understand how visitors use it.
• Essential cookies: Required for the website to function (e.g. remembering your preferences). These do not require consent.
• Analytics cookies: Help us understand how visitors use our website (e.g. Google Analytics). These are only set with your consent.
• Advertising cookies: Used to show you relevant advertisements on other platforms (e.g. Meta Pixel). These are only set with your consent.
You can manage your cookie preferences through your browser settings or our cookie consent banner.
Data Security
We take the security of your data seriously. We have implemented appropriate technical and organisational measures to protect your personal data, including encrypted data storage, secure server access controls, firewalls, antivirus protection, automated monitoring, and regular security reviews.
Data Protection Complaints
If you believe we have mishandled your personal data, you may complain to us by email at info@hellierhealth.com. We will acknowledge your complaint within 30 days and investigate it without undue delay. We will keep you informed of progress and tell you the outcome as soon as reasonably possible.
If you are unhappy with how we have handled your data, we would first like the chance to resolve it ourselves. If we cannot, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.
Changes to This Policy
We keep this privacy policy under regular review. Any updates will be published on this page. This policy was last updated on 19 June 2026.