PRIVACY POLICY

Who we are

Purific Health & Wellbeing Ltd ("Purific", "we", "us", "our") is a clinical musculoskeletal (MSK) rehabilitation practice.

Registered in England and Wales, company number 16699782.

Registered office: 61 Bridge Street, Kington, HR5 3DJ.

We are registered with the Information Commissioner's Office (ICO) as a data controller, registration reference ZC130797

Data protection contact: executrix@purifichealth.com / 07386 106677

1 Who we are, Who this policy covers, What personal data we collect
2  Why we use your data and our lawful basis
3  Who we share your data with
4  International transfers
5  How long we keep your data
6  Your rights
7 Children
8  Keeping your data secure
9  Changes to this policy
10 Contact Us

Who this policy covers

This policy applies to: 1:1 and RISE programme clients, SOVEREIGN clients, masterclass and workshop attendees, members of our Rooted Pain Recovery community on Skool and anyone who enquires with us or visits our website.

What personal data we collect

Identity and contact data: name, email, phone number, address
Health data (special category data): medical history, current symptoms, MSK assessment findings, treatment and progress notes and, where you consent, photographs or video of movement or posture taken for clinical assessment purposes
Booking and scheduling data, via Setmore
Payment data, processed by Stripe and, if you choose to pay over time, by Klarna. We do not store full card details ourselves.
Community data, via Skool (posts, messages, progress shared in the group)
Communications, by email, phone or WhatsApp Business
Website usage data and cookies: Our website is hosted on Wix. Our website, Setmore booking page and workshop registration page may use cookies or similar technologies to support functionality, understand website usage and, where applicable, measure marketing performance. Wix currently shows Facebook Pixel as a connected marketing integration. We have not confirmed whether Google Analytics, Google Ads conversion tracking or Google Tag Manager is installed. Cookies and tracking technologies may collect information such as device details, browsing activity, IP address and interactions with our website. Where consent is legally required, we will seek your consent before placing or using non-essential cookies and tracking technologies. You can manage your preferences through the available cookie settings.

Why we use your data and our lawful basis

Purpose

Lawful basis

Clinical assessment and treatment

Contract (Article 6(1)(b) UK GDPR), where necessary to provide the agreed service, together with an applicable Article 9 condition for health data. Depending on the circumstances, this may be explicit consent (Article 9(2)(a)) or health and social care (Article 9(2)(h)), where the relevant legal requirements are met.

Retaining clinical records after treatment ends

Legitimate interests (Article 6(1)(f) UK GDPR), where appropriate, together with an applicable Article 9 condition. Article 9(2)(f) may apply where retaining health data is necessary for the establishment, exercise or defence of legal claims.

Managing bookings and payments

Contract (Article 6(1)(b) UK GDPR). Legal obligation (Article 6(1)(c)) may also apply to records required for accounting or tax purposes.

Responding to enquiries

Legitimate interests (Article 6(1)(f) UK GDPR) or taking steps at the individual's request before entering into a contract (Article 6(1)(b)), depending on the enquiry.

Contract (Article 6(1)(b) UK GDPR), where necessary to provide the membership. Where members share health information, an applicable Article 9 condition is required. This may include explicit consent (Article 9(2)(a)), where valid consent is obtained and relied upon for that purpose.

Running the Rooted Pain Recovery community, including enabling members to share their experiences, progress and healing journeys to encourage and support others with similar experiences

Sending marketing communications, including offers and newsletters

Consent where required under applicable electronic marketing rules. Recipients can unsubscribe at any time.

Consent for non-essential cookies and tracking technologies where required by law. Facebook Pixel is marked as connected in Wix; its configuration must respect applicable consent requirements.

Website cookies and marketing tracking technologies

Accounting and legal obligations

Legal obligation (Article 6(1)(c) UK GDPR), where processing is necessary to comply with applicable legal requirements.

Your health information. Health data is special category data and has extra protection in law. We ask for your explicit consent in a separate written statement before your first assessment. You can withdraw that consent at any time by contacting us. If you do, we will not be able to continue assessing or treating you, and we will keep the records already made for the period in section 7 in case of a legal claim.

Who we share your data with

• Wix (hosts our website)

• Setmore (booking and scheduling)

• Skool (community platform, based in the US)

• WhatsApp Business / Meta (messaging, based in the US)

• Stripe (payment processing)

• Klarna (only if you choose to pay with Klarna, which carries out its own checks under its own privacy notice)

• Our accountant, who sees financial records that include client names•Purific staff, who see only what they need to do their job and are bound by confidentialityWe never sell your personal data.

International transfers

Some of the third-party providers we use may store, access or process personal data outside the United Kingdom, including in the United States. These providers include Wix, Setmore, Skool, Meta (including Facebook Pixel) and WhatsApp Business.

The providers’ published documentation describes the following arrangements for international data transfers:

Wix: Where an adequacy decision does not apply, Wix states that it relies on Standard Contractual Clauses (SCCs), together with additional technical, contractual and organisational safeguards.
Setmore: Setmore is based in the United States and provides a Data Processing Addendum (DPA) for customers subject to applicable data protection laws. The transfer safeguards applicable to our account are determined by the relevant DPA and terms.
Skool: Skool states that personal data may be processed in the United States and that it maintains appropriate safeguards for international transfers, including SCCs where applicable.
Meta (Facebook Pixel): Meta’s applicable business tools terms provide for recognised international transfer mechanisms, which may include the UK International Data Transfer Addendum or other applicable safeguards.
WhatsApp Business: WhatsApp’s published transfer terms provide for recognised transfer mechanisms, including the UK Addendum to the SCCs or other applicable safeguards, depending on the contracting entity and the transfer involved.

Purific Health & Wellbeing will take appropriate steps to ensure that international transfers of personal data comply with applicable UK data protection law. The transfer mechanism used will depend on the provider, the relevant service and the circumstances of the transfer.

You may contact us using the details provided in this Privacy Policy if you would like further information about the safeguards used for international transfers of your personal data.

How long we keep your data

Clinical records: retained for 7 years after the end of your treatment

Booking and payment records: as required by HMRC, typically 6 years

Marketing data: until you unsubscribe or ask us to stop

Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you

Have inaccurate data corrected

Ask us to delete your data (subject to our record-keeping obligations)

Restrict or object to certain processing

Receive your data in a portable format

Withdraw consent at any time, without affecting processing already carried out

To exercise any of these, contact executrix@purifichealth.com. You can also complain to the ICO at ico.org.uk if you are unhappy with how we have handled your data.

Children

Our services are for adults aged 18 and over. We do not knowingly collect data from children.

Keeping your data secure

We take appropriate technical and organisational steps to protect your data. Clinical notes are kept on paper in a locked filing drawer, and only Purific staff who need them have access. Information held electronically, such as bookings, payments and emails, is held in password-protected accounts with the providers named in section 5.

Changes to this policy

We may update this policy from time to time. The latest version will always be available on our website.