Effective date: 11 October 2026
1. Who we are
This website, bewelltoday.co.uk, and the BeWellToday clinic are operated by Medisoma Ltd, a company registered in England and Wales (company number 13332396). Our clinic is located at Armada Shopping Centre, Drake Road, Chafford Hundred, Essex RM16 6PS.
Medisoma Ltd is the data controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO) under registration number ZB261038.
If you have any questions about this policy or how we handle your data, please contact us:
- Email: info@bewelltoday.co.uk
- Phone: 07853396767
2. The information we collect
Information you give us when booking or contacting us
- Your name, email address and phone number
- Booking details, such as the service, date, time and practitioner you choose
- Any notes you add to your booking or messages you send us
Health information
To provide safe treatment, we collect information about your health before and during your care. This may include your medical history, current medicines, allergies, symptoms, consultation notes, treatment records, photographs of the treatment area (with your consent) and blood test results. Health information is a special category of personal data under UK data protection law, and we treat it with extra care.
Payment information
If you pay online, your card details are entered directly into our payment provider’s secure system. We do not see or store your full card number.
Information collected automatically
When you visit our website, we and our service providers may collect technical information such as your IP address, browser type, device type and the pages you visit. This is mainly used to keep the website secure and working properly.
3. How and why we use your information
UK data protection law requires us to have a lawful basis for using your personal data. We use your information as follows:
| Purpose | Lawful basis |
|---|---|
| Managing your bookings, reminders and appointments | Performance of a contract |
| Providing consultations and treatment, and keeping clinical records | Performance of a contract; for health data, the provision of health care (UK GDPR Article 9(2)(h)) |
| Taking payments and keeping financial records | Performance of a contract; legal obligation |
| Responding to your enquiries | Legitimate interests |
| Keeping our website secure and preventing fraud | Legitimate interests |
| Taking before-and-after photographs | Your explicit consent |
| Sending you offers or news by email or text | Your consent, which you can withdraw at any time |
| Meeting legal, regulatory and insurance requirements | Legal obligation; legitimate interests |
We will only send you marketing messages if you have agreed to receive them. Every message includes a way to unsubscribe.
4. Who we share your information with
We never sell your personal data. We only share it when necessary, with:
- Our practitioners, who need your information to treat you safely
- Laboratories, when you book a blood test, so that your sample can be analysed
- Your GP or another healthcare professional, if we need to refer you or your safety requires it. We will normally discuss this with you first.
- Service providers who help us run our business, such as:
- our website hosting provider
- Cloudflare, for website security and performance
- Stripe, for online card payments
- our email and booking system providers
- Professional advisers, insurers and regulators, where required
- Police, courts or other authorities, when we are legally required to do so
All service providers act on our instructions and must keep your data secure and confidential.
5. International transfers
Some of our service providers, such as Stripe and Cloudflare, may process data outside the UK, including in the United States. When this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework.
6. How long we keep your information
We keep your personal data only for as long as we need it:
- Clinical and treatment records: at least 8 years after your last treatment, in line with UK guidance for healthcare records
- Booking and payment records: 6 years, for accounting and tax purposes
- Enquiries that do not lead to a booking: up to 12 months
- Marketing preferences: until you unsubscribe or withdraw your consent
After these periods, your data is securely deleted or anonymised.
7. How we protect your information
We use appropriate technical and organisational measures to protect your data. These include encrypted connections (SSL), secure servers, restricted access to clinical records and confidentiality obligations for all staff. No method of transmission over the internet is completely secure, but we take every reasonable step to keep your information safe.
8. Cookies and third-party content
Our website uses cookies that are essential for it to work, for example to keep the booking system running and to protect the site from attacks. These cookies do not require your consent.
Our website also loads content from third parties, which may receive your IP address and set their own cookies:
- Google Fonts, to display text correctly
- Trustindex, to display Google reviews
- WhatsApp, if you use the chat button
- Facebook and Instagram, if you click our social media links
You can block or delete cookies in your browser settings. Some parts of the website may not work correctly without essential cookies.
9. Your rights
Under UK data protection law, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your data, where we have no legal reason to keep it
- Restrict how we use your data
- Object to our use of your data, including for direct marketing
- Data portability, meaning you can receive your data in a commonly used format
- Withdraw your consent at any time, where we rely on consent
Please note that we may not be able to delete clinical records before the end of the retention period, because we are required to keep them for your safety and to meet legal requirements.
To use any of these rights, contact us at [EMAIL]. We will respond within one month and may ask you to confirm your identity first. There is normally no charge.
10. Complaints
If you are unhappy with how we have handled your data, please contact us first and we will try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Phone: 0303 123 1113
11. Children
Our services are only available to people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their information, please contact us and we will delete it.
12. Links to other websites
Our website may contain links to other websites. We are not responsible for the privacy practices of those websites, so please read their privacy policies.
13. Changes to this policy
We may update this policy from time to time. The latest version will always be available on this page, with the effective date shown at the top. If we make significant changes, we will let you know by email or through a notice on our website.