Privacy notice

Who we are

The Rose Clinic Ltd is the data controller responsible for the personal information described in this notice.

Privacy contact: Elizabeth Bayliss
Email: liz@theroseclinic.co.uk
Telephone: 07775 692225

Information we collect

The information we collect depends on how you contact us and which service you use. It may include:

• Your name, address, email address and telephone number.
• Appointment details and the service you are interested in.
• Information you choose to provide in an enquiry, by telephone, email or WhatsApp.
• Health information, symptoms, medical history, clinical findings, treatment notes, thermography images and reports where relevant to your care.
• Correspondence with you and, where appropriate, other healthcare professionals.
• Metulas order details, delivery address and payment or transaction records.
• PEMF product enquiries, purchases, demonstrations and customer-support correspondence.
• Website technical information such as IP address, browser information, timestamps and security logs generated by the hosting service.

Please do not send detailed medical information through the initial website contact form. We will request relevant health information through an appropriate clinic process when necessary.

How and why we use your information

Health information is special-category personal data. We use it only when necessary for providing or managing healthcare, maintaining appropriate clinical records, meeting professional responsibilities or establishing, exercising or defending legal claims. We do not use health information for advertising.

We do not use personal information for automated decision-making or profiling. We do not send marketing emails unless you have specifically agreed to receive them, and you may withdraw that agreement at any time.

Who we may share information with

We share information only where necessary and appropriate. Recipients may include:

• Healthcare professionals involved in your care, including reporting clinicians for thermography, where appropriate.
• Service providers supporting secure hosting, email, IT, record management or business administration.
• Royal Mail and other delivery providers where needed to fulfil an order.
• Payment providers where a payment service is used.
• Accountants, insurers, legal advisers and professional or regulatory bodies where necessary.
• Public authorities where disclosure is required by law or necessary to protect someone from serious harm.

We do not sell your personal information.

International processing

Some providers, including email, messaging, mapping and social-media services, may process information outside the UK. Where this involves a restricted transfer, we rely on a UK adequacy regulation or appropriate contractual and organisational safeguards as required by UK data-protection law.

How information is stored and protected

Clinical records are stored securely onsite at The Rose Clinic, either as paper records or in a secure computer database. Reasonable physical and technical safeguards are used, including restricted access, password protection, secure devices and appropriate backups. Access is limited to people who need the information for an authorised purpose.

No internet transmission can be guaranteed completely secure. Please avoid sending detailed or urgent health information by ordinary email, website form or social-media messaging.

How long we keep information

• Clinical records: retained for the periods required by applicable professional standards, legal limitation periods, safeguarding responsibilities and insurance requirements. Records are reviewed when those requirements expire and securely destroyed when no longer needed.
• Children’s clinical records: may need to be kept for longer because relevant legal and professional periods can continue beyond the child reaching adulthood.
• General enquiries that do not lead to an appointment or purchase: normally deleted within 12 months of the last meaningful contact, unless needed for an ongoing complaint, safeguarding matter or legal reason.
• Orders, payments and accounting records: normally retained for six years after the end of the relevant accounting period, or longer if required by law.
• Website security logs: retained by the hosting provider for its standard security and operational period and then deleted or anonymised.

We may retain information for longer where there is an unresolved complaint, legal claim, regulatory requirement or safeguarding concern.

Website, cookies and external services

The website uses essential technology required to deliver pages securely and operate requested functions. We do not currently use advertising cookies or behavioural profiling on this website.

The Location page offers an optional Google map. The map connects to Google only after you choose to load it. The website also links to Google Reviews, Facebook, YouTube, PEMF Magazine and other external websites. When you load the map or open an external service, that provider may receive information such as your IP address and browser details and will process it under its own privacy policy.

If analytics, embedded videos, advertising tools or other non-essential tracking technologies are added later, this notice and the website’s cookie controls will be updated before those technologies are activated.

Children’s information

Where clinic services are provided to a child or young person, we may collect information about them and their parent or guardian. We handle that information with particular care and take account of the young person’s age, understanding, confidentiality and safeguarding needs.

Your data-protection rights

Depending on the circumstances, you may have the right to:

• Ask for a copy of your personal information.
• Ask us to correct inaccurate or incomplete information.
• Ask us to erase information where there is no continuing lawful reason to keep it.
• Ask us to restrict how information is used.
• Object to processing based on legitimate interests.
• Receive certain information in a portable format.
• Withdraw consent where consent is the basis being relied upon.

Some rights are subject to legal exceptions, particularly where clinical records must be retained or disclosure could affect another person’s rights. We may need to confirm your identity before responding.

Questions and complaints

Contact Elizabeth Bayliss at liz@theroseclinic.co.uk if you have a question, wish to exercise a data-protection right or are concerned about how your information has been handled.

You also have the right to complain to the Information Commissioner’s Office:

Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint/ ↗

Changes to this notice

We may update this notice when our services, suppliers or legal responsibilities change. The latest version will always be published on this page with its revision date.