1. Information We Collect
Given the nature of our wellness concierge services, we handle sensitive personal data, including health and wellness information, with the utmost care.
Identity and Contact Data
Full name, title, date of birth, gender, nationality, passport or identification details, postal address, email, telephone numbers and emergency contact information.
Health and Wellness Data
Medical history, current conditions, symptoms, diagnoses, treatment records, prescriptions, diagnostic results, consultation notes, referral letters, discharge summaries and other health-related information shared in connection with our services.
Financial and Payment Data
Billing address, payment method details, insurance policy information and transaction records related to our services and Partner Providers.
Travel and Logistics Data
Travel itineraries, visa details, accommodation preferences, dietary requirements, accessibility needs and companion or family details relevant to care coordination.
Technical and Usage Data
IP address, browser, operating system, device information, visited pages, visit duration, referral sources and analytical data collected through cookies and similar technologies.
For technical and usage data, see our Cookie Policy.
2. How We Collect Your Data
Direct interactions: When you contact the concierge team by telephone, email, website form or in person; register for services; or provide information during delivery.
Third parties: From Partner Providers, referring physicians, authorised representatives and insurers, with your consent where required.
Automated technologies: Through cookies, server logs and similar technologies when you use our website.
3. Lawful Basis for Processing
Contract performance: Processing needed to coordinate appointments and referrals, manage wellness plans and process payments.
Explicit consent: We rely on explicit consent for special category health data. You may withdraw it, although this may affect service delivery.
Legitimate interests: Improving services, maintaining security, preventing fraud and internal administration where your rights do not override those interests.
Legal obligation: Processing required to meet legal or regulatory obligations.
4. How We Use Your Personal Data
- Deliver wellness concierge and coordination services, including partner introductions, consultations, diagnostics, treatment planning and care management.
- Share relevant information with Partner Providers as necessary, with your knowledge and consent.
- Coordinate travel, accommodation and logistics for treatment in the UK or internationally.
- Process payments, manage invoicing and liaise with insurers.
- Communicate about care, appointments and service updates.
- Maintain records and improve service quality.
- Meet legal, regulatory and professional obligations.
5. Sharing Your Data with Third Parties
On a strict need-to-know basis, we may share data with partner clinics, hospitals and specialists; referring healthcare professionals; authorised insurance providers; travel and accommodation providers; professional advisers; and regulatory or legal authorities.
Relevant health information is shared to facilitate consultations, diagnostics, treatment and follow-up care with your explicit consent. Travel providers receive only limited details needed for arrangements.
6. International Data Transfers
We may transfer personal and health data outside the UK to coordinate overseas treatment, remote consultations or international partner arrangements.
Where no UK adequacy decision applies, safeguards include the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, appropriate organisational security measures and, where appropriate, your explicit consent. You may request details from our Data Protection Officer.
7. Data Security
Our safeguards include encryption in transit and at rest, strict role-based access, regular security assessments, staff training, secure disposal and incident response procedures aligned with UK GDPR notification requirements.
8. Data Retention
Medical coordination records: At least eight years after the last service engagement, or longer where clinically appropriate.
Financial and billing records: Seven years to meet HMRC requirements.
Website usage data: Up to 26 months.
Data no longer required is securely deleted or anonymised.
9. Your Rights Under UK GDPR
You may request access, rectification, erasure, restriction, data portability or object to processing. You may withdraw consent without affecting earlier lawful processing.
Contact our Data Protection Officer to exercise these rights. We respond within one month. No fee applies, except that a reasonable fee may be charged for unfounded or excessive requests.
10. Special Provisions for Medical Data
- Medical data is stored separately with enhanced access controls and encryption.
- Access is limited to authorised personnel on a strict need-to-know basis.
- Sharing with Partner Providers is documented and auditable.
- We follow a Caldicott-aligned approach, sharing only what is necessary.
- Processors handling medical data are subject to Article 28-compliant agreements.
11. Cookies
We use cookies and similar technologies to improve browsing and analyse usage. Read our Cookie Policy for details.
12. Complaints
You may complain to the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; 0303 123 1113; ico.org.uk.
13. Changes to This Privacy Policy
We may update this policy as practices, laws or guidance change. Updates will appear here with a revised date, and significant changes may be notified directly.
Data Protection Officer
Dr Galyna Ltd t/as Dr Galyna's Wellness Hub
Email: support@thewellnesshubglobal.com
Website: www.thewellnesshubglobal.com