Privacy Policy

1. Who we are

Commisceo Health & Wellness Services Ltd ("we", "us"), company number 16755554, is a private clinic providing medical weight management and wellbeing support for adults aged 18 and over, at Suite Seven, The Skyline Plaza, 45 Victoria Avenue, Southend-on-Sea, SS2 6BB, and by planned telephone and video consultations. We are the data controller for the personal information we hold about you. We are registered with the Information Commissioner's Office (ICO), registration number C2059553.

Data protection enquiries: Johanne Harvey, Registered Manager and Information Governance Lead. Email: admin@commisceohealthandwellness.co.uk. Telephone: 01702 742414. Post: Suite Seven, The Skyline Plaza, 45 Victoria Avenue, Southend-on-Sea, SS2 6BB.

Data Protection Officer: Johanne Harvey, Registered Manager, is our Data Protection Officer. Contact her at admin@commisceohealthandwellness.co.uk or on 01702 742414.

Caldicott Guardian: Dr Nehal Ahmad, Director and Senior General Practitioner.

2. What information we collect

Some of this is "special category" data under the UK General Data Protection Regulation (UK GDPR), which means it has extra protection. Most of it comes from you directly. We will tell you if we obtain information about you from someone else.

• Identity and contact details: name, date of birth, address, telephone, email, emergency contact, proof of identity and age.
• Your NHS GP: the name and address of your GP practice, and your NHS number if you give it to us.
• Health information: your medical history, current and past medicines, allergies, height, weight, BMI, waist measurement, blood pressure and other observations, investigation results, pregnancy and contraception information where relevant, mental health and eating history, and the notes our clinicians make about your assessments, the medicines we supply to you and your follow-up.
• Information from others: information from your GP or another healthcare provider, with your agreement, and investigation results from the laboratory we use.
• Remote consultation information: how we confirmed your identity, your location at the time of the call, and any photographs you send at our request (for example, a photograph of your weighing scale reading or of a skin reaction). We do not record telephone or video consultations.
• Payment information: records of fees paid and refunds. Card details are processed by our payment provider and are not stored by us.
• Feedback and complaints: your feedback, questionnaire responses (which can be anonymous) and any complaint and our response.
• Other information: equality information you choose to give us (for example, ethnicity or disability) so that we can meet your needs and monitor fairness; your communication preferences and any reasonable adjustments you need.
• Website information: the details you type into our contact form (name, email address, telephone number and message) and, if you create an account or book online, your account and booking details.

3. Why we use your information and our legal basis

We follow the UK GDPR and the Data Protection Act 2018.

We do not make decisions about your care using automated decision-making. Every decision about your treatment is made by a registered clinician.

• To assess you, provide treatment, prescribe medicines, follow you up and keep you safe. Lawful basis: contract with you (Article 6(1)(b)) and our legitimate interests in providing safe care (Article 6(1)(f)). Condition for health information: provision of health care by or under the responsibility of a health professional (Article 9(2)(h) and Data Protection Act 2018, Schedule 1, paragraph 2).
• To communicate with your GP and other providers involved in your care. Contract and legitimate interests; Article 9(2)(h).
• To meet our legal and regulatory duties (for example to the Care Quality Commission, the MHRA, safeguarding, duty of candour, professional regulators, and keeping records). Legal obligation (Article 6(1)(c)); Article 9(2)(h), Article 9(2)(i) public health, and Data Protection Act 2018, Schedule 1 conditions, including safeguarding of individuals at risk (paragraph 18).
• To check and improve the quality and safety of our service (clinical audit, incident review, handling complaints). Legitimate interests (Article 6(1)(f)); Article 9(2)(h).
• To take payment and manage our business. Contract; legal obligation (accounting records).
• To respond to legal claims. Legitimate interests; legal claims (Article 9(2)(f)).
• To reply to messages sent through our website. Legitimate interests (Article 6(1)(f)).
• To send you news, only if you have opted in. Consent (Article 6(1)(a)) and the Privacy and Electronic Communications Regulations. Health information is never used for marketing.

4. Who we share your information with

We share only what is necessary, securely, and with people who have a duty to keep it confidential.

Your NHS GP. When you register, we ask you to agree that we can contact your GP where clinically necessary and tell them about the treatment we provide. This helps keep you safe, because your GP may know about conditions or medicines that affect whether treatment is suitable. If you do not agree, we will explain what this means and we may not be able to prescribe.

The laboratory that processes any investigations: Synlab.

Other healthcare providers if we need to refer you, or you ask us to share information with them.

Our suppliers (data processors), who work under contract and follow our instructions: our clinical record and booking system (Semble, provided by Semble Technology Ltd), our video consultation platform (Whereby, provided through Semble), our website host (GoDaddy), our payment provider (Lloyds Bank), IT support, secure email, and confidential waste disposal. Semble stores our clinical records in the UK and Ireland. Whereby, which is based in Norway, stores account information in Ireland and does not store the content of video calls. The UK recognises the European Economic Area, including Ireland and Norway, as providing adequate protection for personal data (UK adequacy regulations). GoDaddy, and Google, which provides reCAPTCHA on our contact form, may process website, contact form and booking data in the United States. Both are certified under the UK Extension to the EU-US Data Privacy Framework, which UK adequacy regulations recognise. Where any supplier stores data outside the UK, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement.

Regulators and public bodies where the law requires it, for example the Care Quality Commission, the Medicines and Healthcare products Regulatory Agency (for example, Yellow Card reports of suspected side effects, which do not usually identify you), the General Medical Council or General Pharmaceutical Council, the police, a court or a coroner.

Safeguarding. If we are worried that you, or someone else such as a child in your household, is at risk of serious harm, we may share information with the local authority or police, without your consent where the law allows. We will usually talk to you first unless this would increase the risk.

People you nominate. We will only discuss your care with relatives, friends or anyone else if you ask us to, or if you lack capacity and the law allows it.

We never sell your information. We do not share your information with employers or insurers without your explicit consent.

5. National data opt-out

We use your information only for your care and for running and improving our service. We do not currently use or share confidential patient information for research or planning. If we ever do, we will apply the National Data Opt-out. You can find out more, or set your choice, at www.nhs.uk/your-nhs-data-matters.

6. How long we keep your information

We keep your clinical records for 8 years after your last contact with us, or 8 years after death, in line with the NHS England Records Management Code of Practice 2023, unless there is a clinical or legal reason to keep them longer. Financial records are kept for 6 years after the end of the financial year. Complaint records are kept for 10 years after closure. After this, records are securely destroyed. Full details are in our records retention schedule, available on request.

7. How we protect your information

Please do not send medical information through our website contact form. Call us instead on 01702 742414.

• Your records are held on a secure electronic clinical system (Semble) with individual logins, multi-factor authentication and an audit trail of who has viewed or changed them.
• Our staff are trained in data protection and confidentiality, and sign a confidentiality agreement.
• Paper is kept to a minimum, scanned into your record, and securely shredded.
• We use secure email for clinical information and a secure video platform (Whereby, provided through Semble) for video consultations.
• If something goes wrong with your personal data, we will investigate it, tell the ICO within 72 hours where the law requires, and tell you without undue delay if there is a high risk to you.

8. Your rights

To use any of these rights, contact the Information Governance Lead (section 1). We may ask you to confirm your identity.

• To be informed: to be told how we use your information. This notice does that.
• Of access: to ask for a copy of the information we hold about you (a "subject access request"). This is free. We will respond within one month, which may be extended by up to two further months for complex requests. We will tell you if this applies.
• To rectification: to ask us to correct information that is inaccurate. We will not delete a clinician's opinion, but we will add your comments to your record.
• To erasure: to ask us to delete your information. This right does not usually apply to health records we must keep by law, but we will consider every request.
• To restrict processing: to ask us to limit how we use your information in some circumstances.
• To object: to object to us using your information on the basis of legitimate interests. We will consider your objection carefully.
• To data portability: to receive information you gave us in a portable format, where we process it on the basis of contract or consent and by automated means.
• To withdraw consent: where we rely on consent (for example, marketing), you can withdraw it at any time.

9. Complaints about how we use your information

If you are unhappy with how we have handled your information, please contact us first so we can try to put things right. We will acknowledge a data protection complaint within 30 days and respond without undue delay. If you are still unhappy, you can complain to the Information Commissioner's Office: www.ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

10. Our website and cookies

Our website uses only essential cookies, which are needed for the site to work. We do not use analytics or advertising cookies. Online forms are encrypted. Our contact form is protected by Google reCAPTCHA, and the Google Privacy Policy and Terms of Service apply to it.

11. Changes to this notice

We review this notice at least once a year and when our arrangements change. The date of the latest version is shown below. Previous versions are available on request.

Version 1.3. Last updated: 22 October 2026