Privacy Notice
This notice explains what personal information Better Health Medical collects, why, how long we keep it and the rights you have. It applies to this website, to the contact form and to the clinical assessment service.
1. Who is responsible for your data
Better Health Medical Limited, a company registered in England and Wales under number 16995586, is the data controller. Our data protection lead can be reached at neil@betterhealthmedical.co.uk or by post at First Floor, The Foundation, Herons Way, Chester Business Park, Chester CH4 9GB.
2. Information we collect
Contact details: your name, email address, telephone number and postal address.
Health information: the symptoms, diagnoses, medicines, allergies, medical history and records you provide, notes made by clinicians, prescriptions and follow-up information. This is special category data under UK GDPR and is handled with additional safeguards.
Identity and eligibility information: date of birth, confirmation of UK residence and, where required, proof of identity.
Payment information: we do not take card payments on this website at present, and we never store card details.
Technical information: the IP address, browser type and pages requested when you visit the site. This is recorded in standard web-server logs for security and fault-finding only.
3. Why we use it and our lawful basis
To answer an enquiry sent through the contact form: our legitimate interest in responding to you (Article 6(1)(f) UK GDPR). Please do not include detailed health information in the contact form; the assessment process has its own secure route for that.
To provide clinical assessment and treatment: performance of a contract with you (Article 6(1)(b)) and, for health data, the provision of health care by or under the responsibility of a health professional (Article 9(2)(h)), together with the Data Protection Act 2018.
To meet legal and regulatory duties, for example clinical record keeping, controlled-drug requirements and Care Quality Commission obligations: legal obligation (Article 6(1)(c)).
To keep the site and service secure and to investigate complaints: our legitimate interests (Article 6(1)(f)).
We do not use your information for marketing unless you have opted in, and you can withdraw at any time.
4. Who we share it with
The clinicians who assess and treat you, all of whom are bound by professional confidentiality.
The dispensing pharmacy, so that a prescription can be checked and supplied. The pharmacy is an independent controller for the dispensing record.
Your GP, where you consent or where a clinician judges that sharing is necessary for your safety. We will discuss this with you.
Service providers who process data on our behalf under written contracts: MediStack, the clinical records and patient platform we use, which holds your patient record, your contact details and your eligibility answers and, as the service develops, your appointments, consultation notes and prescriptions, on servers in the United Kingdom; our hosting provider for the servers in Frankfurt, Germany, that run this website, the booking calendar, the video consultation service and the voice option; and Brevo (Sendinblue SAS, Paris, France), which relays contact-form messages and booking emails, and sends our team a copy of an eligibility submission only if it could not be recorded in MediStack automatically.
Meta Platforms Ireland Limited, but only if you accept advertising cookies. Meta receives the fact that a page was viewed or an enquiry was sent, together with the identifier in its own cookie. It does not receive your health information or your contact details. Meta is an independent controller for that data and uses it under its own privacy policy. Section 8 explains how to accept or refuse this.
Regulators, courts or law-enforcement bodies where the law requires it.
We never sell personal information.
5. Where your data is kept
Your patient record and eligibility answers are held by MediStack on servers in the United Kingdom. This website is hosted on a server in Frankfurt, Germany. Contact-form messages pass through Brevo in the European Union. Transfers between the UK and the EU are covered by the UK adequacy regulations, so no additional safeguard is required. If you accept advertising cookies, data reaches Meta in the United States under the UK extension to the EU-US Data Privacy Framework. Our website, booking, video consultation and voice servers are in Germany, which is covered by the UK adequacy regulations.
5a. Answering the eligibility questions by voice
Answering by voice is optional. The written form asks the same six questions. You can switch to it before submitting and keep the answers you have already confirmed.
If you choose voice, we record each spoken answer and transcribe it so you can check what was heard and our clinicians can review how you answered. We record your confirmed answers, any corrections, the relevant times, and the versions of the questions and consent information shown to you.
We rely on your explicit consent to record, transcribe and retain your spoken answers for clinician review, under Article 6(1)(a) and Article 9(2)(a) UK GDPR. You give this consent before recording starts.
When you submit, we send your contact details, six confirmed answers, submission reference, an indication that you used voice, and a link to our secure review page to MediStack, the clinic's patient record system. Where an intake needs manual handling, it is sent securely to our clinic team to check and enter into MediStack.
Speech recognition runs on our server in Frankfurt, Germany. Recordings and transcripts are stored encrypted there and are not uploaded to MediStack or an external speech-recognition service. The review link does not itself grant access: only authorised clinicians can open the review page and listen after signing in. Access is logged.
We keep submitted recordings and transcripts for 90 days after submission, then delete them. The review link will no longer provide access after deletion. Your confirmed answers and other submitted clinic-record information remain subject to the purposes and retention arrangements described in sections 3 and 6; deleting recordings does not automatically delete that record.
Switching to the written form before submission requests deletion of your recordings and transcripts immediately. Unsubmitted recordings and transcripts are deleted within 24 hours.
You can withdraw consent for continued use of your recordings and transcripts at any time by contacting neil@betterhealthmedical.co.uk. Withdrawal does not affect processing already carried out lawfully. We will stop processing based on that consent and explain any information we must retain under a separate legal duty.
The voice option reads fixed questions and collects your answers. It does not provide medical advice. Clinical decisions remain with the clinicians.
6. How long we keep it
Clinical records: in line with the NHS Records Management Code of Practice, normally eight years from the last contact for adult records, or longer where a specific rule applies.
Contact-form enquiries that do not lead to an assessment: up to 12 months.
Web-server logs: up to 90 days.
Financial records: six years after the end of the financial year, as required by tax law.
7. Your rights
You can ask for a copy of the information we hold about you, ask us to correct it, ask us to delete it where we no longer need it, object to or restrict certain processing, and ask for information you provided to be given to you in a portable form. Where we rely on consent you can withdraw it at any time. Clinical records are subject to retention rules, so deletion may not always be possible; we will explain if that applies.
To exercise a right, contact neil@betterhealthmedical.co.uk. We respond within one month. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
8. Cookies and advertising
Strictly necessary cookies: none are set for ordinary browsing. Your cookie choice itself is stored in your browser only, is never sent to us, and is kept for six months before we ask again.
Advertising cookies: with your agreement we run the Meta advertising pixel, which sets the cookies _fbp and, if you arrived by clicking one of our adverts, _fbc. It tells Meta that a visit or an enquiry followed one of our adverts so that we can measure whether our advertising works. Nothing loads and no cookie is set unless you press Accept. If you press Decline, nothing is loaded and any Meta cookie already present is deleted.
If you accept advertising cookies and then send us an enquiry, Meta also receives your name, email address and telephone number in a scrambled form, which lets Meta match the enquiry to a Facebook or Instagram account without us passing your details in the clear. This is a Meta feature called advanced matching. We never send Meta your health information, the symptoms you describe, or anything from a clinical assessment.
You can change your mind at any time:
Most browsers also let you block or delete cookies in their own settings.
9. Security
Health information is held in MediStack, a system designed for clinical records, with access limited to staff who need it. Connections to this site are encrypted. Staff receive data-protection and confidentiality training. No system is completely secure, and if a breach affects your rights we will tell you and the Information Commissioner's Office as the law requires.
10. Children
Our service is for adults aged 18 and over. We do not knowingly collect information from anyone under 18.
11. Changes
We review this notice at least once a year and whenever our processing changes. The date below shows the current version.