Privacy & GDPR Policy

THRYVE (“we”, “us”, “our”) is committed to protecting your privacy and handling your personal data with care, integrity, and transparency. This Privacy Policy explains how we collect, use, store, and protect your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to all patients, clients, website users, and professional contacts.

1. Who We Are

THRYVE is a skin and wellbeing clinic providing medical, aesthetic, and holistic services within a regulated healthcare environment.

Data Controller:
Sophie Riddell, THRYVE Medical LTD
66 Eastgate street, Cowbridge, CF71 7AB
Email: welcome@thryveclinic.co.uk
Telephone: 07540883054

Data Protection Contact:
For any questions regarding this policy or how your data is used, please contact our Data Protection Lead using the details above.

2. What Personal Data We Collect

We may collect and process the following categories of personal data:

• Personal Identifiers: Name, date of birth, address, email address, telephone number, emergency contact details.
• Health & Medical Information (Special Category Data): Medical history, clinical records, treatment notes, photographs (for clinical monitoring), prescription details, GP details.
• Technical & Usage Data: IP address, browser type, website interaction data (via cookies).
• Financial Data: Payment records (we do not store full card details; these are processed via secure third-party payment providers).
• Marketing Preferences: Your consent to receive newsletters or offers.

3. How We Use Your Data

We use your personal data to:

• Provide safe, effective medical and aesthetic treatments.
• Maintain accurate clinical records in line with regulatory requirements (HIW, GPhC, NMC, GMC).
• Communicate with you regarding appointments, aftercare, and follow-ups.
• Process payments and bookings.
• Respond to enquiries and professional correspondence.
• Send relevant health updates or newsletters (only with your explicit consent).

4. Legal Basis for Processing

We process your data under the following legal bases:

• Contractual Necessity: To fulfill our service agreement with you (e.g., booking an appointment).
• Legal Obligation: To comply with healthcare regulations (e.g., retaining medical records).
• Vital Interests: In medical emergencies where you cannot give consent.
• Explicit Consent: For marketing communications or specific photo usage.
• Provision of Health or Social Care (Article 9 UK GDPR): For processing special category health data.

5. Sharing Your Data

We do not sell your data. We may share it with:

• Healthcare Professionals: Your GP or other specialists (only with your consent or if clinically necessary).
• Regulatory Bodies: HIW, CQC, or professional regulators if required by law.
• Service Providers: Secure practice management software, booking systems, or diagnostic labs (e.g., Randox, Darcy Healthcare) – all subject to strict data processing agreements.

6. Data Retention

We retain medical records in accordance with the Records Management Code of Practice for Health and Social Care and insurance requirements (typically 7–10 years post-treatment, or until age 25 for minors).

7. Your Rights

Under the UK GDPR, you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate information.
• Erasure: Request deletion (subject to medical record retention laws).
• Restriction: Limit how we use your data.
• Objection: Object to processing for marketing.
• Portability: Receive your data in a portable format.

To exercise these rights, please contact us at welcome@thryveclinic.co.uk.

8. Security

We implement robust technical and organisational measures to secure your data, including encrypted digital records, secure premises, and staff confidentiality training.

9. Complaints

If you have concerns about how we handle your data, you can contact the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Tel: 0303 123 1113