Privacy policy

1.Who we are

Baby Bumps Scan Studio Ltd trading as Your Health Studio provides private health screening, diagnostic ultrasound, blood testing and associated health-assessment services. For UK data-protection purposes, we are the data controller for the personal information described in this notice.

Privacy enquiries: info@yourhealthstudio.co.uk. You can also contact us using the contact details published on yourhealthstudio.co.uk.

2.Information we collect

Identity and contact information

This may include your name, date of birth, address, telephone number, email address, sex where clinically relevant, GP practice details and emergency-contact information where appropriate.

Health information

To provide our services we may collect special-category health information including medical history, symptoms, medications, allergies, family history, lifestyle information, blood pressure and physiological measurements, ultrasound images and findings, ECG information, lung-function results, urinalysis, body-composition information, blood-test and laboratory results, clinical observations, questionnaires, reports, recommendations and correspondence about your care.

Booking and financial information

We may process appointments, services booked, appointment history, payments, invoices, refunds and transaction records. Payment-card details may be processed directly by our payment provider rather than stored by us.

Website and technical information

When you use our website or online-booking service, we may receive information such as IP address, browser and device information, pages viewed, referral source, website interactions, cookie identifiers and analytics information.

3.Why we use your information

• arrange and manage appointments;
• provide the health service you have requested;
• review relevant clinical information and conduct investigations;
• prepare and communicate results, reports and recommendations;
• liaise with laboratories and other healthcare professionals where appropriate;
• maintain appropriate clinical records and support patient safety;
• process payments and manage accounts;
• respond to enquiries, complaints, incidents, safeguarding concerns and regulatory requirements;
• operate, secure, measure and improve our website and services;
• send marketing communications where you have chosen to receive them and where permitted by law.

4.Our lawful bases

Contract – Article 6(1)(b): where processing is necessary to provide a service you have requested or to take steps before providing that service.

Legal obligation – Article 6(1)(c): where processing is necessary to comply with applicable law.

Legitimate interests – Article 6(1)(f): for proportionate business administration, security, service improvement, fraud prevention, quality assurance and establishment or defence of legal claims, where your rights do not override those interests.

Consent – Article 6(1)(a): where we specifically ask for consent, for example for certain marketing activities. You may withdraw consent at any time.

5.Health and other special-category information

Health information receives additional protection under UK GDPR. Where applicable, we process health data under Article 9(2)(h) for the provision or management of healthcare or health assessment by, or under the responsibility of, appropriately qualified professionals subject to confidentiality obligations, together with the relevant provisions of the Data Protection Act 2018.

Where Article 9(2)(h) is not the appropriate condition for a particular activity, we will identify another valid Article 9 condition, which may include explicit consent under Article 9(2)(a) where appropriate.

Consent to undergo an examination or healthcare service is separate from the legal basis on which personal information is processed.

6.Who we may share information with

Where necessary and proportionate, information may be shared with healthcare professionals involved in your care; your GP where you request or authorise this, or where another lawful basis permits or requires disclosure; pathology and diagnostic laboratories; referral providers or specialists; Cliniko; secure IT, hosting, email and communications providers; payment providers; professional advisers, insurers or regulators; and public, emergency or safeguarding authorities where disclosure is required or justified by law.

We do not sell patient information. Service providers acting on our behalf are expected to protect information appropriately and use it only for agreed purposes.

7.Cliniko and online booking

We use Cliniko, operated by Red Guava Pty Ltd, for functions that may include online booking, appointment management, patient records, forms, communications and practice administration. Your Health Studio remains responsible for the patient information it controls, while Cliniko acts as a processor for relevant activities carried out on our behalf.

Because Cliniko is an Australian company and uses subprocessors, personal information may be processed outside the United Kingdom. Where required, appropriate international-transfer safeguards are used.

8.International transfers

Some technology suppliers may process information outside the United Kingdom. Where UK data-protection law requires safeguards, we use an appropriate transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another legally recognised safeguard.

9.How long we keep information

We retain information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable clinical, professional, insurance, regulatory and legal requirements.

Clinical records are retained in accordance with our records-retention schedule and applicable professional requirements. Financial and accounting records are kept for relevant statutory periods. Website analytics data is retained according to the settings of the relevant platform. Information that is no longer required is securely deleted, anonymised or otherwise disposed of appropriately.

10.Keeping your information secure

We use proportionate technical and organisational measures designed to protect information against unauthorised access, accidental loss, alteration, disclosure or destruction. Access to clinical information is restricted to people who require it for legitimate purposes.

11.Your rights

Subject to the circumstances and exemptions in data-protection law, you may have rights to be informed about how your data is used; obtain access to your personal information; correct inaccurate information; request deletion or restriction in certain circumstances; object to certain processing; receive certain information in a portable format; and withdraw consent where processing relies on consent.

Some rights are not absolute, particularly where clinical records must be retained for legal, professional or patient-safety reasons. To exercise a right, contact info@yourhealthstudio.co.uk.

12.Confidentiality and disclosure without consent

Patient information is treated confidentially. In exceptional circumstances, information may be disclosed without consent where required by law, where there is a serious safeguarding concern, where disclosure is necessary to protect vital interests, or where another lawful justification applies. Any disclosure will be limited to what is necessary.

13.Marketing

We only send electronic direct marketing where permitted by law. Where consent is required, you can withdraw it at any time. Choosing not to receive marketing does not affect your healthcare or your ability to use our services. We do not use clinical information for advertising targeting without an appropriate lawful basis and safeguards.

14.Website analytics and tracking

We may use Google Analytics 4, Google Tag Manager and related technologies to understand how people find and interact with our website and online-booking journey. Where storage or access technologies require consent, they are managed through our cookie-consent mechanism. See our Cookie Policy for more information.

15.Automated decision-making

We do not currently make decisions about your healthcare which have legal or similarly significant effects solely through automated decision-making. If this changes, we will update this notice and explain any additional rights that apply.

16.Changes to this policy

We may update this Privacy Policy when our services, suppliers, systems or legal obligations change. The current version and effective date will be published on our website.

17.Complaints

If you have concerns about how we use personal information, please contact info@yourhealthstudio.co.uk first so we can try to resolve them. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.