We use cookies to improve your experience on our site. By using our site, you consent to the use of cookies. Rejecting cookies will prevent non-essential cookies from loading.
This Privacy Notice provides you with details of how we collect, use and process your personal data when you use our website, www.thehealthhut.net, and when you use our services.
By providing us with your personal data, you confirm that you are over 13 years of age.
The Health Hut Limited is the data controller responsible for your personal data. In this Privacy Notice, the terms “we”, “us” and “our” refer to The Health Hut Limited.
We are responsible for ensuring that your personal data is handled in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact details
Our full details are:
The Health Hut RCT Limited Contact: Stephanie Smith, Director Email:[email protected] Postal address: 103 Partridge Road, Llwynypia, RCT, CF40 2LS Telephone: 01443 709146 Website:www.thehealthhut.net
If you have any questions about this Privacy Notice or how we handle your personal data, please contact us using the details above.
It is important that the personal information we hold about you is accurate and up to date. Please let us know if your personal information changes by contacting us at [email protected].
2. What Data We Collect, Why We Collect It and Our Lawful Basis
Personal data means any information relating to an identifiable individual. It does not include data that has been anonymised so that you can no longer be identified.
Depending on how you interact with us, we may collect and process the following categories of personal data.
Communication Data
This includes information contained in any communication you send to us, including communications through our website contact forms, email, telephone, text message, social media or other communication channels.
We process this information for the purposes of:
Responding to your enquiries and communications;
Maintaining appropriate records;
Providing and administering our services; and
Establishing, exercising or defending legal claims where necessary.
Our lawful basis for processing this information is generally our legitimate interests, where those interests are not overridden by your rights and interests.
Customer Data
This may include your name, title, billing address, delivery address, email address, telephone number, contact details, purchase or appointment details and transaction information.
Where applicable, payment information may be processed by our payment service provider. We do not generally need to retain your full payment card details ourselves.
We process Customer Data for the purposes of:
Providing goods and/or services that you have requested;
Processing and administering purchases and payments;
Managing appointments and customer relationships;
Keeping appropriate business and transaction records; and
Complying with our legal and contractual obligations.
Our lawful basis for this processing is generally the performance of a contract with you and/or taking steps at your request before entering into a contract.
Payment Information
The Health Hut does not store patients’ full payment card details. All online payments are processed through Stripe, and membership payments are collected throughGoCardless. We may retain relevant transaction and payment records where necessary for administration, accounting and legal purposes.
User Data
This includes information about how you use our website and online services, together with information that you may submit or publish through our website or other online services.
We process this information to:
Operate and administer our website;
Provide relevant content and services;
Maintain the security of our website and systems;
Maintain appropriate backups; and
Administer and develop our business and online services.
Our lawful basis for this processing is generally our legitimate interests in properly administering and operating our website and business.
Technical Data
This may include your IP address, browser type and version, device information, operating system, time zone setting, length of visits to pages, page views, navigation paths and other technical information relating to the device you use to access our website.
We may obtain this information through analytics and similar technologies.
We process Technical Data for purposes including:
Analysing how visitors use our website;
Maintaining and protecting our website and systems;
Improving website performance and content;
Understanding the effectiveness of advertising and marketing; and
Developing our business and marketing strategy.
Our lawful basis for this processing will depend on the particular technology and circumstances and may include legitimate interests or consent, where consent is required.
Marketing Data
This may include your preferences regarding receiving marketing communications from us and your communication preferences.
We may process Marketing Data to:
Send you information about our products and services;
Administer promotions, competitions, prize draws and giveaways;
Provide relevant marketing communications;
Measure the effectiveness of our advertising; and
Understand customer preferences and develop our services.
Where required by law, we will obtain your consent before sending certain marketing communications or using certain marketing technologies.
In other circumstances, we may rely on our legitimate interests, where permitted by applicable law.
Use of Data for Legal Claims
We may use Communication Data, Customer Data, User Data, Technical Data and Marketing Data where reasonably necessary for the establishment, exercise or defence of legal claims.
Our lawful basis for this processing is our legitimate interests and/or compliance with a legal obligation, as applicable.
3. Health and Other Special Category Data
As a healthcare provider, we may need to collect and process information relating to your health in order to provide our services.
Health information is considered special category data under the UK GDPR and is subject to additional legal protections.
Depending on the circumstances, we may collect information such as:
Medical or health history;
Information about existing conditions;
Information relating to your treatment or healthcare needs;
Information about medications or other relevant health information; and
Other information that is necessary to provide appropriate healthcare services.
We will only collect and process health information where we have an appropriate lawful basis under data protection legislation and an applicable condition for processing special category data.
Where explicit consent is required, we will ask you to provide that consent.
You may withdraw consent where consent is the lawful basis for processing. However, withdrawing consent will not affect the lawfulness of processing carried out before you withdrew your consent, and there may be circumstances where we are required or permitted by law to continue processing certain information.
We will only collect health information that is reasonably necessary for the purposes for which it is processed.
4.Criminal Conviction Data
We do not routinely collect or process information relating to criminal convictions or offences.
If we ever need to process such information, we will do so only where permitted by applicable law and where an appropriate legal basis and safeguards apply.
5. Automated Decision-Making and Profiling
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
We may use automated processes or analytical tools to assist us with activities such as:
Improving our services;
Analysing trends and customer preferences;
Understanding website usage;
Managing administrative processes; and
Improving the efficiency of our business.
These processes are not intended to make decisions that have a legal or similarly significant effect on you.
Where appropriate, human oversight will be applied.
When you use our website, we may automatically collect certain Technical Data through cookies, analytics and similar technologies.
Please see our Cookie Policy for further information.
Information received from third parties
Where appropriate and lawful, we may receive personal data from third parties, including:
Analytics providers;
Advertising networks;
Search information providers;
Payment providers;
Delivery and technical service providers; and
Other service providers supporting our business.
Some of these providers may be located outside the UK. Where this occurs, we will ensure that appropriate safeguards are in place as required by applicable data protection law.
7. Marketing Communications
We may use your personal data to send you information about our products, services, offers and other communications that may be relevant to you.
Our lawful basis for sending marketing communications will depend on the circumstances and may include your consent or our legitimate interests, where permitted by law.
Under the Privacy and Electronic Communications Regulations (PECR), there are circumstances in which we may send marketing communications to existing customers or individuals who have requested information about our goods or services, subject to applicable legal requirements and your right to opt out.
Where required, we will obtain your consent before sending marketing communications.
We will not sell your personal information to third parties or share your personal information with third parties for their own independent marketing purposes without your express consent.
You can ask us to stop sending you marketing communications at any time by:
Following the unsubscribe or opt-out instructions contained in a marketing communication;
Otherwise contacting us using the details set out in this Privacy Notice.
If you opt out of marketing communications, this will not affect personal data that we need to retain or process for other purposes, such as fulfilling purchases, providing healthcare services, maintaining records or complying with legal obligations.
8. Disclosure of Your Personal Data
We may share your personal data with selected third parties where this is necessary, lawful and appropriate.
These may include:
Service providers who assist us in operating our business;
Payment providers;
IT and website providers;
Analytics providers;
Professional advisers, including lawyers, accountants, auditors, insurers and financial advisers;
Delivery and technical service providers;
Emergency services where necessary; and
Regulators, government bodies or other authorities where we are legally required to do so.
We require third parties who process personal data on our behalf to respect the security of your personal data and to process it only in accordance with applicable law and our instructions.
We do not permit our service providers to use your personal data for their own purposes unless they are acting as an independent data controller and have their own lawful basis for doing so.
CCTV and Ring Security Cameras
The Health Hut uses CCTV and Ring security cameras at our Llwynypia and Talbot clinic locations for security and the protection of patients, staff, visitors and premises.
For further information about our use of CCTV and Ring cameras, please see our CCTV Policy.
9. International Transfers
Some of the service providers we use may be based outside the United Kingdom or may process personal data outside the UK.
Where your personal data is transferred outside the UK, we will ensure that appropriate safeguards are used in accordance with applicable data protection legislation.
Depending on the circumstances, this may include:
Transferring data to a country recognised as providing an adequate level of protection;
Using an approved international data transfer mechanism;
Using appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, where applicable; or
Relying on another lawful transfer mechanism permitted by applicable law.
Where required, we will provide further information about the safeguards applicable to a particular international transfer.
10. Data Security
We have appropriate technical and organisational security measures in place to help prevent your personal data from being accidentally lost, misused, altered, disclosed or accessed without authorisation.
Access to personal data is restricted to those employees, contractors, partners and service providers who have a legitimate business need to access it.
Where appropriate, those who process personal data on our behalf are subject to duties of confidentiality and are required to handle the information securely and in accordance with applicable data protection legislation.
We have procedures in place to deal with suspected personal data breaches. Where we are legally required to do so, we will notify the relevant supervisory authority and affected individuals of a personal data breach.
Although we take appropriate steps to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we work to protect your information using appropriate measures.
