Privacy Policy

1. Who We Are

Healthbase Limited, trading as The Slimming Doctor, is a company registered in England and Wales (company number 13418838). Our registered office is 71-75 Shelton Street, London, WC2H 9JQ. We provide online medical weight-management consultations and ongoing patient care, and are regulated by the Care Quality Commission (CQC).

We are the controller of your personal data and are registered with the Information Commissioner's Office (ICO) under registration number ZB131114.

If you have any questions about this policy or your data, contact us at: [email protected]

2. What Data We Collect

Depending on how you use our website and services, we collect:

• Contact details – name, email address, postal address and phone number
• Health information – including your medical history, height, weight, medications and the details of your consultations and treatment
• Your GP's details – so we can keep your GP informed about your treatment
• Identity verification data – a photo of your identity document and a photo of your face, used to confirm your identity before treatment
• Payment information – invoices and payment records. Card details are handled by our payment provider, Stripe; we do not see or store your full card number
• Enquiries – the name, email address and message you send through our website's contact form
• Website usage information – such as how you arrived at our website and, if you accept cookies, how you use it

3. How We Collect Your Data

We collect your personal data:

• When you complete our online assessment and other forms
• When you send us a message through our website's contact form, or contact us by email or phone
• During your consultations and ongoing care
• When you verify your identity through Stripe Identity
• When you pay us, through Stripe or by bank transfer
• From your GP or other healthcare professionals, where needed for your safe treatment
• Automatically when you use our website (see section 9)

4. Why We Use Your Data

We use your data to:

• Assess whether treatment is suitable for you and provide medical consultations
• Verify your identity before prescribing
• Order medication from partner pharmacies on your behalf
• Provide ongoing patient care and support, and keep your GP informed
• Take payments and keep financial records
• Reply to enquiries sent through our website
• Understand how people find and use our website, so we can improve it
• Comply with our legal and regulatory obligations

5. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract – to assess you, prescribe, arrange your medication, provide aftercare and take payment
• Provision of health care (Article 9(2)(h) UK GDPR) – our basis for processing your health information, which is handled by, or under the responsibility of, health professionals who are bound by a duty of confidentiality
• Legal obligation – to keep clinical and financial records and to meet the requirements of the CQC, the General Medical Council, the General Pharmaceutical Council and other regulators
• Legitimate interests – to respond to enquiries, keep our website and services secure, and understand how people find our website
• Consent – for sharing information with your GP and for optional cookies. Identity verification using a photo of your face relies on your explicit consent, which Stripe asks for when you start the check. You can withdraw your consent at any time
• Vital interests – in an emergency, where necessary to protect your health

6. Website Enquiries

If you contact us through our website's contact form, we use your name, email address and message only to reply to you. Your message is stored securely on our website's systems and forwarded to our patient support inbox by email. Please don't include detailed medical information in the contact form – our doctor will collect it securely if it's needed.

We also record how you found our website (for example, a search engine or one of our printed materials) and attach this to any online assessment you start. This helps us understand which of our information reaches people, and does not identify you on its own.

7. Who We Share Your Data With

We share your data only where necessary, with:

• Partner pharmacies – to dispense and deliver your prescribed medication
• Your NHS GP – to keep them informed about your treatment, with your consent
• Our service providers – who process data on our behalf (see section 8)
• Our bank – if you pay by bank transfer, the payment is processed by our UK bank, NatWest
• Regulators and authorities – where we are legally required to, for example the CQC

We never sell your data.

8. Our Service Providers and International Transfers

We use trusted service providers who process personal data only on our instructions and under contracts that protect it:

Where personal data is transferred outside the UK, we make sure it is protected: either the destination is covered by UK adequacy regulations (which include the European Economic Area and, for certified organisations, the UK–US data bridge), or we use the ICO's International Data Transfer Agreement or Addendum.

9. Cookies and Similar Technologies

We use strictly necessary storage without asking. Everything else is used only if you click "Accept" on our cookie banner.

Our website also displays a badge from the Care Quality Commission, loaded from cqc.org.uk, and uses fonts from Google Fonts. To display these, your browser sends your IP address to the CQC and Google.

You can change your choice at any time using the "Cookie settings" link at the bottom of every page.

10. How Long We Keep Your Data

• Clinical records – at least 8 years after your last treatment, in line with the Records Management Code of Practice for Health and Social Care. We review records after this period and keep them longer only where there is a clinical or legal reason to
• Financial records – 6 years, as required by tax law
• Website enquiries – 12 months after our last reply, unless you become a patient, in which case they form part of your records
• Analytics data – up to 14 months

11. Your Rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Correct inaccuracies in your data
• Request deletion of your data (subject to our legal obligations to keep clinical records)
• Object to or restrict processing of your data
• Receive your data in a portable format
• Withdraw consent at any time, where we rely on it
• Not be subject to decisions made solely by automated means – we don't make any; every prescribing decision is made by a clinician

To exercise your rights, please contact: [email protected]

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first, so please contact us before going to the ICO.

12. Data Security

We take appropriate technical and organisational measures to secure your personal data from unauthorised access, loss, or disclosure, including encryption in transit, access controls and staff confidentiality obligations.

13. Children

Our services are only for adults aged 18 and over. We do not knowingly collect data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website, with the effective date shown at the top.