Privacy notice
Last updated: 13 September 2026.
This notice explains what personal information we collect, why we collect it, how we look after it, and the rights you have. We have tried to write it in plain English. If anything is unclear, ask us.
1. Who we are
Elevate Lifestyle Medicine Ltd ("Elevate", "we", "us") is the data controller for the personal information described in this notice. That means we decide how and why your information is used, and we are responsible for looking after it.
| Company | Elevate Lifestyle Medicine Ltd, registered in England and Wales, company number 17004396 |
|---|---|
| Registered office | 54 Pembroke Road, Salisbury, SP2 9DQ |
| ICO registration | ZC241559 |
| Contact for privacy questions | hello@elevatelifestylemedicine.co.uk |
Our clinicians are registered nurses. Their professional duty of confidentiality under the Nursing and Midwifery Council (NMC) Code sits alongside the legal duties described here.
2. What this notice covers
It covers information we collect through this website, by email or phone, and during appointments. It does not cover other websites we link to, which have their own notices.
3. The information we collect
When you contact us
If you use the enquiry form on this website we ask for your name, email address, a phone number if you would like us to call you, who the enquiry is for, which service you are interested in, how you would like us to reply, and a short general question if you have one. We deliberately do not ask for health details on the form, and we ask you not to include any in your question. If you send us health information by email or in a message before an appointment, we will treat it with the same care as information given at an appointment, but please keep it to a minimum.
When you book and attend an appointment
To provide education, advice and consultations we collect contact details, date of birth, details of who is attending (for example a parent or carer), and the health information you choose to share with your nurse, including your concerns, relevant history and the plan we agree. Health information is "special category" data under UK data protection law and gets extra protection.
Information from parents and carers
Where a parent or carer books for someone under 18, we receive the young person's name, date of birth and any details the parent or carer chooses to share. We explain to the young person what we hold and why at their first session, in a way that fits their age.
What we need, and what is your choice
To arrange a session we need a name, a way to contact you and, for anyone under 18, the details of the parent or carer making the booking. Without those we cannot arrange a session. Everything else you share is your choice.
Information about children and young people
Many of our sessions involve girls and young women under 18. We collect only what we need to provide the session safely, and we explain to young people, in a way that fits their age, what we record and who can see it. See our confidentiality and safeguarding page.
Information from this website
We do not use analytics or advertising cookies. Our hosting provider records standard technical information (such as IP address and browser type) in server logs for security purposes. We do not use that information to identify visitors.
4. Why we use your information and the lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Replying to an enquiry and arranging an appointment | Taking steps at your request before entering into a contract (Article 6(1)(b)), and our legitimate interest in running the service (Article 6(1)(f)) |
| Health information you choose to send us before an appointment, by email or message | Taking steps at your request before entering into a contract (Article 6(1)(b)). For health information: provision of health care by, or under the responsibility of, a professional bound by confidentiality (Article 9(2)(h)) |
| Providing education, advice and consultations, and keeping a record of them | Performance of our contract with you (Article 6(1)(b)). Where the session is for someone under 18 and the booking was made by a parent or carer, our legitimate interest in providing the service the young person is attending (Article 6(1)(f)). For health information: provision of health care by, or under the responsibility of, a professional bound by confidentiality (Article 9(2)(h)) |
| Safeguarding a child or an adult at risk | Our legitimate interest in keeping the people we see safe (Article 6(1)(f)); protecting someone's life where that is at stake (Article 6(1)(d)); and, where a specific legal duty applies, our legal obligations (Article 6(1)(c)). For health information: substantial public interest, safeguarding of children and individuals at risk (Article 9(2)(g) with Schedule 1, paragraph 18, of the Data Protection Act 2018) |
| Invoicing, accounts and tax records | Our legal obligations (Article 6(1)(c)) |
| Dealing with a complaint or legal claim | Our legitimate interests (Article 6(1)(f)); for health information, establishing, exercising or defending legal claims (Article 9(2)(f)) |
We do not use your information for marketing unless you have asked us to keep in touch, and you can change your mind at any time. We do not make automated decisions about you.
5. Who we share your information with
We do not sell your information and we do not share it with anyone for their own marketing. We share it only:
- With suppliers who process it for us, under contracts that require them to protect it. At the moment these are Netlify (which hosts this website and receives enquiry form submissions), Google (email), and Cloudflare (domain and email routing). We do not use booking software: appointments are arranged by email.
- With PayPal, if you choose to pay that way. PayPal handles your payment details as a separate controller under its own privacy statement, and we see only your name, the amount and the date. If you pay by bank transfer, your bank does the same and we see only what appears on our statement.
- With your GP or another health professional, only with your agreement, or where we believe it is necessary to protect you or someone else from serious harm.
- With safeguarding authorities where we have a legal duty or a serious concern for a child or an adult at risk. We will tell you when we do this unless doing so would put someone at risk.
- With professional advisers such as our accountant, insurer or solicitor, where needed.
6. Where your information is stored
Some of our suppliers store information outside the UK, mainly in the United States. Netlify, Google and Cloudflare each commit in their data processing terms to the UK International Data Transfer Addendum to the EU standard contractual clauses, and Google and Cloudflare are also certified under the UK Extension to the EU-US Data Privacy Framework. These safeguards are recognised under UK law, so your information keeps the same level of protection. Ask us if you would like a copy of the relevant terms.
7. How long we keep it
| Information | How long |
|---|---|
| Enquiries that do not lead to an appointment | Deleted within 12 months of our last contact |
| Appointment and consultation records for adults | 8 years after the last appointment, in line with the NHS Records Management Code of Practice |
| Records for children and young people | Until the person's 25th birthday, or 26th if they were 17 at the last appointment, in line with the NHS Records Management Code of Practice |
| Complaint records | 10 years after the complaint is closed, in line with the NHS Records Management Code of Practice |
| Invoices and accounting records | 6 years after the end of the financial year, as required by HMRC |
| Website server logs (technical information only) | Held by our hosting provider for a short period for security purposes and deleted on its standard schedule. We do not keep copies. |
8. How we keep it safe
Access to your information is limited to the two clinicians and, where necessary, our professional advisers. Records are kept in password-protected systems with two-factor authentication where available, and paper notes, if any, are locked away. We review our arrangements regularly.
9. Your rights
You have the right to:
- ask for a copy of the information we hold about you (a "subject access request");
- ask us to correct anything that is wrong or incomplete;
- ask us to delete your information, where we no longer have a reason to keep it;
- ask us to restrict how we use it, or object to a particular use;
- ask for information you gave us to be sent to you or another provider in a usable format;
- withdraw consent at any time, where consent is the basis we rely on.
To use any of these rights, email hello@elevatelifestylemedicine.co.uk. We will normally respond within one month. The law allows longer for complex requests, and we will tell you if that applies. Some rights have limits, for example we may need to keep clinical records even if you ask us to delete them, and we will explain if that applies.
Young people can use these rights themselves if they understand what they are asking for. Parents and carers may be able to act on behalf of a younger child. We look at each request individually and always put the young person's interests first.
10. Complaints
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or by phone on 0303 123 1113.
11. Changes to this notice
We will update this notice when our services or suppliers change. The date at the top tells you when it was last updated.