Privacy Policy

hello world!

Last Updated 22nd January 2025

We are Wellbeing First Limited – a company incorporated and registered in England and Wales with company number 16126873. Our registered office address is C/O 7 Murray Crescent, Pinner, Middlesex, Select County, United Kingdom, HA5 3QF. Our ICO Data Protection Registration Number is ZB855120. You can contact Wellbeing First by email on contact@wellbeingfirst.co.uk; email may also be sent via the “Contact” page.

How we use your information

Wellbeing First works on behalf of your GP Practice, who provide information about you for your health and wellbeing. Wellbeing First uses information about:

Patients, staff, health and wellbeing coaches using the web platform, or who engage me to provide services.
Other suppliers of health and wellbeing support and services
Persons who contact Wellbeing First by any means
Our staff and suppliers

This information is used to:

Provide you as a practice patient with health and wellbeing support and guidance
With your consent as a patient, engage other providers to provide you with health and wellbeing support and guidance
Fulfil contracts with our customers
Manage our employees and contractors, and ensure that we comply with employment law
Manage our supplier relationships and payments
Ensure the safety of our staff, customers and equipment
Prevent and detect crime

If we hold data about you, you have rights in respect of your data including:

to be supplied information on our uses
to see what data we are holding about you
to request correction or erasure of your data
to object to processing
to withdraw your consent to processing if the original legal basis was consent
to complain to us about our data or the supervisory authority

If you wish to exercise any of these rights, please contact us as noted above.

This Privacy Notice is updated regularly. The latest version will always be on our website, so please check back here for the newest version.

The rest of this document gives further details on our collection, storage and use of data for each type of data we hold. It also provides information on who we share with and how to exercise your rights if you are not happy.

We welcome your comments on how we can improve this notice; please contact us using the contact link at the top of this page.

The categories of information that we collect, hold and share include:

Personal contact information (name, address, telephone number)
Details of your support needs. This may include medical information about you.
Records of financial transactions and contracts with you
Email and other records of correspondence
Journal records of discussions / treatments / sessions
For staff, required taxation, contract and bank details
Cookies as required to run this website; these are anonymous in the sense we do not record names or emails but do include IP addresses and similar identifiers that under UK law are regarded as personal. You can opt out of tracking cookies on our cookie banner – we do not use advertising cookies.

Why we collect and use this information

We use this information to:

run our business including fulfilling our contracts with you, making and receiving payment and administration of our services
to stay in touch with you if you have requested us to do so
ensure the safety of our staff and customers

The lawful basis on which we use this information

We collect and use this information under:

The UK General Data Protection Regulation (GDPR) Article 6 (b) – to fulfil contracts
The GDPR Article 6(c) – to fulfil legal obligations e.g. financial and tax records
The GDPR Article 6 (a) – for example, where you have consented for us to be given your data to your GP, asked us to keep in touch or accept cookies
The GDPR Article 6 (f) – our legitimate interests, for example protecting the organisation from theft. We have considered our uses of data and our interest in protecting our organisation is sufficient to take precedence over your other rights in the specific cases such as CCTV recording.

We only use special category data under our contracts and with your explicit consent. Specifically, where you have agreed with your Practice to provide us with medical details. This is under the legal basis of:

The GDPR Article 9 2(a)

Collecting your information

Information is collected in the course of business e.g. when receiving referrals, when taking out contracts, when making payments. All collection is overt, we do not receive data from others about you nor collect data in covert manners.

Storing Your Data

All data is stored encrypted on our devices and we make every effort to ensure it is encrypted in transit if this is practicable. All data is stored on servers in countries with appropriate levels of data protection (a “decision of adequacy” by the UK ICO).

We retain your data for the following periods:

Contractual and financial – 6 years plus current financial year
Contact information – 5 years after our last contact with you
Medical information and personal details supplied with consent – 1 year after our last contact with you.

Who we share information with and why

We only share information where we are legally required to do so or have your consent to do so.

Algorithms and Profiling

We do not use algorithms or profiling on your data.

If you have concerns about our data use or wish to make a subject request

To make a request about your data or to express a concern to us, please use the contact us link at the top of the page, or by post to ADDRESS.

Alternatively, you may contact the Information Commissioner’s Office at https://ico.org.uk/concerns/. You have the right to raise concerns with us and the commissioner, although we would prefer that you tried to resolve matters with us first.