Privacy policy

This privacy policy explains how Good Things Clinic collects, uses, stores and protects your personal information when you visit our website, contact us, book an appointment or receive care at the clinic. We take your privacy seriously, and we handle your information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Good Things Clinic is a nurse prescriber-led aesthetics, skin health and wellness clinic based at Theobalds Enterprise Centre, Innovation Place, Platinum Way, Cheshunt, Hertfordshire, EN8 8YD.

Good Things Clinic is the trading name of Good Things Clinic Ltd, a private limited company registered in England and Wales under company number 15255551. Our registered office is Theobalds Business Park, Innovation Place, Platinum Way, Cheshunt, Waltham Cross, Hertfordshire, EN8 8YD.

Good Things Clinic Ltd is the data controller for the personal information described in this policy. This means we decide how and why your information is used and we are responsible for looking after it. We are registered with the Information Commissioner’s Office (ICO) under registration number 00015922268.

If you have any questions about this policy or about your information, please contact us by email at hello@goodthingsclinic.co.uk, by phone or WhatsApp on 0800 061 4652, or by post at the clinic address above.

2. The Information We Collect

Contact and booking details: your name, date of birth, address, email address, phone number, appointment history and booking preferences.

Health and medical information: your medical history, medications, allergies, pregnancy or breastfeeding status, previous treatments, skin assessments, consultation notes, treatment records, consent forms and aftercare notes.

Clinical photographs and images: photographs taken for assessment, treatment planning and monitoring your progress, skin analysis images, and mole or skin lesion images taken for review.

Test results: results from point-of-care blood tests and from laboratory or advanced screening tests that you choose to have.

Payment information: records of deposits and payments. Card payments are processed securely by the payment provider used by our booking system. We do not see or store your full card details.

Communications: emails, phone calls, WhatsApp messages and any other messages you send us.

Website information: information collected through cookies and similar technologies when you visit our website, such as the pages you view, your device and browser type, and approximate location. See section 10 for more detail.

3. How We Collect Your Information

We collect most information directly from you when you book online, complete a consultation or medical history form, attend an appointment, or contact us.

We may also receive information from other organisations when this is part of your care, for example test results from a laboratory or a report from a consultant dermatologist following a mole or skin lesion check.

4. How We Use Your Information

We use your information to:

• arrange, manage and confirm your appointments, and send reminders
• assess whether a treatment is safe and suitable for you
• provide your treatment, aftercare and any follow up or review
• keep accurate and complete clinical records, as required of a registered nurse prescriber
• arrange tests and share the results and recommendations with you
• take and process payments and deposits
• respond to your questions, feedback and concerns
• meet our legal, regulatory and insurance obligations
• send you news, offers and updates, but only where you have agreed to this
• understand how our website is used so we can improve it

We will never use your clinical photographs for marketing, on our website or on social media without your separate, explicit written consent.

5. Our Lawful Basis for Using Your Information

UK data protection law requires us to have a lawful basis for using your information. We rely on the following:

Providing your care and services: we use your information to take the steps you ask for before treatment and to deliver the care you have booked (contract).

Health information: because health information is special category data, we also rely on the condition that allows it to be used for the provision of health care and treatment by a registered health professional who owes you a duty of confidentiality.

Legal obligations: we keep records and share information where the law, our professional regulator or our insurers require it (legal obligation).

Running the clinic: we use some information for everyday administration, record keeping, improving our services and protecting the clinic against legal claims (legitimate interests). We always balance these interests against your rights.

Marketing, optional cookies and use of photographs: we only do these with your consent, and you can withdraw your consent at any time.

6. Who We Share Your Information With

We only share your information where it is necessary, and we never sell it. Depending on the services you use, we may share it with:

• our online booking and clinical records system, which stores your appointments and records securely
• payment providers, to process your deposits and payments
• laboratories and screening partners, such as Genova Diagnostics and MAP Health, when you choose a test they process
• Map My Mole and the UK consultant dermatologists who review mole and skin lesion images
• our email, website and secure storage providers, which help us run the clinic and this website
• your GP or another healthcare professional, where this is needed for your safety or you have asked us to
• our insurers, professional advisers, regulators or the police, but only where the law requires or allows it

These organisations may only use your information for the purpose we share it for, and they must keep it secure.

If you buy skincare through the AlumierMD online shop linked from our website, AlumierMD is responsible for the information you give them, and their own privacy policy applies.

7. International Transfers

Some of our service providers, such as our website and email providers, may store or process information outside the UK. Where this happens, we make sure appropriate safeguards are in place as required by UK law, such as the UK-US Data Bridge or approved contractual clauses.

8. How Long We Keep Your Information

We keep clinical records, including consultation notes, consent forms, test results and clinical photographs, for at least 8 years after your last appointment. This is in line with NHS guidance on retaining adult health records and allows us to answer any later questions about your care.

We keep payment and accounting records for 6 years to meet tax and accounting rules.

If you contact us but do not become a patient, we keep your enquiry for up to 2 years and then delete it.

If you have agreed to receive marketing, we keep your details until you unsubscribe or ask us to stop.

9. Keeping Your Information Secure

We use appropriate technical and organisational measures to protect your information, including secure password-protected systems, restricted access and encrypted connections. Only people who need your information to provide your care or run the clinic can access it, and they are bound by confidentiality.

10. Cookies and Website Data

Our website uses cookies, which are small files stored on your device. Some cookies are essential to make the website work and cannot be switched off. Others, such as analytics cookies that tell us how visitors use the website, are only used if you accept them.

When you first visit the website, a cookie banner lets you accept or decline optional cookies. You can change your choice at any time using the cookie settings link on the website, or by clearing cookies in your browser.

Our website is hosted by Squarespace. Some pages show embedded videos and use web fonts provided by other companies, which may receive basic technical information such as your IP address when the content loads.

11. Your Rights

You have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct information that is inaccurate or incomplete
• ask us to delete your information, although we may need to keep clinical records for the period described above
• ask us to restrict how we use your information
• object to us using your information, including for marketing
• ask for your information to be transferred to another provider, where this applies
• withdraw your consent at any time, where we rely on consent

To use any of these rights, please contact us using the details in section 1. We will respond within one month. There is usually no charge.

12. Complaints

If you are unhappy with how we have handled your information, please contact us first so we can try to put things right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection. You can contact the ICO at ico.org.uk or on 0303 123 1113.

13. Changes to This Policy

We may update this privacy policy from time to time, for example if we introduce new services or the law changes. The latest version will always be on this page, with the date it took effect shown at the top.