Privacy Policy – Riverbanks Wellness

Introduction

Riverbanks Wellness is committed to protecting and respecting your privacy.

This Privacy Policy reflects our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data Use and Access Act 2025 (DUAA). We also comply with clinical confidentiality guidance from the General Medical Council (GMC).

This policy explains:

• How we collect, use, and store your personal data
• How we share and protect your data
• Your rights under UK data protection law

By providing your data or using our services, you consent to the practices outlined below.

Data Controller & Senior Responsible Individual

Data Controller
Riverbanks Wellness
Lower Harpenden Road
East Hyde
Bedfordshire
LU2 9QS

Senior Responsible Individual (SRI)
Ravi Jain
Email: reception@riverbanksclinic.co.uk

What Personal Data Do We Collect?

We collect information that identifies you, including special category data related to your health. This may include:

• Name, address, phone number, and email
• Next of kin details
• Referral, treatment, and appointment information
• Health records, treatment notes, medications
• Complaints and feedback
• Survey and marketing responses
• Payment transaction data (excluding card details)
• Information from insurers, partners, and referring providers

If you provide someone else’s data (e.g., next of kin), ensure they are aware of this policy.

How We Collect Your Data

We may collect data when you:

• Visit our website
• Enquire about services
• Register as a patient or client
• Contact us by phone, email, or social media
• Complete a form or survey
• Make a payment or book a service

How We Use Your Data

We use your data to:

• Deliver healthcare services
• Manage appointments and billing
• Communicate about your care
• Respond to legal or regulatory requests
• Monitor treatment quality
• Send marketing (with your consent)

Automated Decision-Making

We do not currently make automated decisions about your care or access to services. If this changes, we will inform you and offer the right to request human involvement, in line with DUAA 2025.

Lawful Basis for Processing

We process your personal data on the following lawful bases:

• Consent
• Contractual obligation
• Legal obligation
• Legitimate interests
• Provision of healthcare services (for special category data)

How We Protect Your Data

We keep your data secure by:

• Using encrypted digital systems
• Applying strict access controls
• Training staff on data protection
• Ensuring third-party processors comply with UK GDPR

Who We Share Your Data With

We may share your data with:

• Your GP or referring clinician (unless you object)
• Healthcare providers involved in your treatment
• Medical regulators (e.g., GMC, CQC) when required
• Insurers (if they are funding your care)
• The NHS (if relevant)
• Referred practitioners or specialists
• Approved IT or marketing providers under confidentiality agreements

As smart data sharing evolves under DUAA 2025, we will ensure your data is only shared securely and with your consent where required.

Marketing Communications

If you’ve opted in, we may contact you by:

• Email
• SMS
• Phone
• Post

You can opt out at any time by emailing reception@riverbanksclinic.co.uk or writing to:

Marketing Department
Riverbanks Wellness
Lower Harpenden Road
East Hyde
Bedfordshire
LU2 9QS

Please allow 30 days for processing.

Your Rights Under UK GDPR & DUAA 2025

You have the right to:

• Access – Request a copy of your personal data
• Correction – Fix any inaccuracies
• Deletion – Request deletion in certain circumstances
• Restriction – Limit how your data is used
• Objection – Object to processing based on legitimate interests
• Portability – Request data in a machine-readable format

Under DUAA 2025, we may decline requests that are manifestly unfounded, excessive, or vexatious. If this applies, we’ll inform you in writing.

To exercise your rights, contact:
Ravi Jain
reception@riverbanksclinic.co.uk

If you are not satisfied with our response, you may contact the Information Commissioner’s Office (ICO):
Telephone: 0303 123 1113
Website: www.ico.org.uk

International Data Transfers

If your data is processed outside the UK, we ensure it is protected through:

• UK adequacy decisions
• Standard Contractual Clauses (SCCs)
• Equivalent international safeguards

Updates to This Privacy Policy

We may update this policy as the law changes. The most recent version will always be available on our website.

Last updated: July 2025