1. About this Privacy Policy

Emerald Health Clinic Limited, trading as Emerald Health, is committed to protecting your privacy and handling your personal information lawfully, fairly, securely and transparently.

This Privacy Policy explains how we collect, use, store and share personal information when you:

• visit or use our website;
• contact or make an enquiry with us;
• register with Emerald Health;
• complete an eligibility or health questionnaire;
• book or attend a consultation;
• receive treatment or prescriptions through our service;
• communicate with our clinical or Patient Experience teams; or
• otherwise use our healthcare services.

We process personal information in accordance with applicable UK data protection and confidentiality requirements, including the:

• UK General Data Protection Regulation (UK GDPR);
• Data Protection Act 2018;
• Data (Use and Access) Act 2025;
• Privacy and Electronic Communications Regulations 2003 (PECR);
• Common Law Duty of Confidentiality; and
• Caldicott Principles.

2. Who We Are

Emerald Health Clinic Limited is the Data Controller responsible for the personal information described in this Privacy Policy.

Legal provider: Emerald Health Clinic LimitedTrading name: Emerald HealthCompany registration number: 13045720Registered office: 71–75 Shelton Street, London, England, WC2H 9JQTelephone: 01727 647979General enquiries: info@emeraldhealthclinic.co.ukPatient support: support@emeraldhealthclinic.co.ukData Protection: dataprotection@emeraldhealthclinic.co.uk

Emerald Health Clinic Limited is registered with the Care Quality Commission to provide the regulated activity of Treatment of Disease, Disorder or Injury.

For questions, requests or complaints relating specifically to your personal information, please contact our Data Protection team using the dedicated email address above.

3. Personal Information We Collect

The information we collect will depend on your relationship with Emerald Health and the services you use.

Identity and contact information

This may include:

• your name;
• date of birth;
• home address;
• email address;
• telephone number;
• NHS number where available;
• proof of identity;
• photographic identification; and
• information required to verify your identity and address.

Health and clinical information

Health information is classed as special category personal data and receives additional protection under data protection law.

We may process information including:

• medical history and diagnoses;
• symptoms and health conditions;
• GP and other healthcare records;
• current and previous medicines and treatments;
• allergies and adverse reactions;
• mental health information where clinically relevant;
• alcohol, smoking or substance-use information where clinically relevant;
• consultation and clinical assessment notes;
• treatment plans;
• clinical risk assessments;
• safeguarding information;
• consent and capacity information;
• prescription information;
• medication supplied to you;
• adverse effects and treatment outcomes;
• communications between you and our clinical team;
• correspondence with your GP, pharmacy or other healthcare professionals; and
• information required to assess your suitability for treatment.

We will only collect information that is relevant and necessary for providing safe and appropriate care or meeting our legal and regulatory responsibilities.

Communications

We may keep records of:

• emails;
• telephone calls and call information;
• messages;
• contact forms;
• complaints and feedback; and
• other communications with our team.

Where calls are recorded, you will be informed where required and recordings will be handled in accordance with our retention and information governance arrangements.

Financial information

Where payments are required, we may process information relating to:

• payments;
• transactions;
• refunds; and
• billing.

Payment card information may be processed directly by our secure payment service providers rather than being stored by Emerald Health.

Website and technical information

When you use our website we may collect:

• IP address;
• browser and device information;
• approximate location derived from technical information;
• pages viewed;
• website interactions;
• cookie information; and
• website performance and analytics information.

Further information is available through our Cookie Policy and cookie preference settings.

4. How We Obtain Your Information

We may obtain personal information:

• directly from you;
• through our website or patient registration process;
• through eligibility and health questionnaires;
• during consultations and follow-up appointments;
• through telephone, video, email or messaging communications;
• from your GP;
• from NHS records or services where lawful and appropriate;
• from hospitals, specialists or other healthcare professionals involved in your care;
• from pharmacies involved in dispensing your prescriptions;
• from someone legally authorised to act on your behalf; and
• from other sources where necessary for patient safety, safeguarding or legal and regulatory compliance.

Where information is obtained from another healthcare provider, we will only use information that is relevant to your care or our responsibilities.

5. Why We Use Your Information

We use personal information to:

• respond to enquiries;
• verify your identity;
• determine whether our service may be appropriate for you;
• obtain and review relevant medical information;
• arrange appointments and consultations;
• provide healthcare and clinical assessments;
• make prescribing and treatment decisions;
• issue and manage prescriptions;
• coordinate dispensing with pharmacies;
• monitor the safety and effectiveness of treatment;
• provide follow-up care;
• communicate with your GP and other healthcare professionals where appropriate;
• manage medicines safety and pharmacovigilance;
• identify and manage clinical risks;
• manage safeguarding concerns;
• investigate incidents, complaints and concerns;
• conduct clinical audit and quality improvement;
• meet our CQC and other regulatory responsibilities;
• maintain appropriate clinical records;
• prevent fraud, misuse or diversion;
• administer payments and accounts;
• maintain the security of our systems;
• improve our website and services; and
• send marketing communications where permitted.

6. Our Lawful Bases for Processing

We must have a lawful reason for processing personal information.

Depending on the circumstances, our lawful bases under Article 6 of the UK GDPR may include:

• Contract – where processing is necessary to provide services you have requested or to take steps before providing those services.
• Legal obligation – where we must process information to comply with legal, professional or regulatory requirements.
• Legitimate interests – where processing is necessary for the legitimate operation, administration, security and improvement of our healthcare service and those interests do not override your rights and freedoms.
• Vital interests – in limited circumstances where processing is necessary to protect someone’s life.
• Consent – where we specifically ask for your consent, for example for certain marketing activities.

Because health information is special category data, we must also meet an additional condition under Article 9 of the UK GDPR.

Our principal condition for processing health information is:

Article 9(2)(h) – processing necessary for medical diagnosis, the provision of health or social care or treatment, or the management of healthcare services.

Other Article 9 conditions may apply in limited circumstances, including where information is needed to protect vital interests, establish or defend legal claims, or meet substantial public-interest requirements provided for by law.

We do not normally rely on data-protection consent as the lawful basis for processing information necessary for your direct clinical care. Consent to examination or treatment is a separate clinical requirement.

7. Sharing Your Information

We only share personal information where there is an appropriate and lawful reason to do so.

Depending on your care and circumstances, information may be shared with:

• doctors, prescribing clinicians and other healthcare professionals involved in your care;
• your NHS GP;
• NHS healthcare providers and specialists involved in your care;
• dispensing pharmacies;
• other healthcare organisations where necessary for continuity or safety of care;
• providers of our electronic patient record and clinical systems;
• secure communication, telephony and video consultation providers;
• IT, hosting, cybersecurity and cloud service providers;
• payment-processing providers;
• professional advisers and insurers;
• companies providing services to Emerald Health under appropriate contractual and confidentiality arrangements;
• other companies within our corporate group where necessary and lawful;
• the Care Quality Commission;
• professional regulators;
• the Information Commissioner’s Office;
• medicines regulators and pharmacovigilance organisations where appropriate;
• safeguarding authorities, emergency services or other relevant agencies where necessary to protect a person from serious harm; and
• courts, law-enforcement agencies or other public authorities where disclosure is legally required.

We expect organisations processing information on our behalf to protect it appropriately and only use it for agreed purposes.

Your GP and other healthcare professionals

Safe prescribing requires appropriate communication and access to relevant medical information.

Where appropriate, we may communicate information about your assessment, treatment or prescribed medicines to your GP or other healthcare professionals involved in your care for purposes including:

• continuity of care;
• medicines safety;
• avoiding harmful interactions or duplicate prescribing;
• updating relevant medical records;
• safeguarding; and
• managing clinical risk.

We will always handle this information in accordance with our confidentiality and data-protection responsibilities.

8. Clinical Records and Confidentiality

Your clinical record forms part of your healthcare record and must be accurate, complete and appropriately protected.

Access to clinical information is restricted to people who require access for legitimate clinical, operational, governance, regulatory or legal purposes.

All staff and clinicians working with Emerald Health are required to comply with confidentiality, data protection and information security requirements.

We may use appropriately anonymised or aggregated information for audit, service evaluation, quality improvement and statistical purposes where individuals cannot reasonably be identified.

9. Clinical Audit and Governance

As a regulated healthcare provider, Emerald Health undertakes clinical audit, quality assurance and governance activities to monitor the safety and quality of our services.

This may involve authorised members of our clinical governance team reviewing relevant patient records.

Access is limited to information reasonably required for the purpose of the audit or review, and confidentiality must be maintained throughout.

10. Marketing Communications

We may provide you with information about Emerald Health services where we are legally permitted to do so.

Where consent is required for marketing by email, text or similar electronic communication, we will obtain it separately. Agreeing to receive marketing is not a condition of receiving healthcare from us.

You can withdraw your marketing consent or unsubscribe at any time.

Stopping marketing communications will not prevent us from sending essential communications relating to your appointments, care, prescriptions, patient safety or administration of your account.

11. Cookies and Website Analytics

Our website may use cookies and similar technologies for purposes including:

• ensuring the website operates correctly;
• maintaining security;
• remembering preferences;
• improving website functionality; and
• understanding how visitors use our website.

Where consent is legally required for a cookie or similar technology, it will not be used unless you have made the relevant choice through our cookie preference settings.

Further information is provided in our Cookie Policy.

12. International Transfers

Some of the organisations providing technology or other services to Emerald Health may process information outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate legal safeguard is in place where required.

This may include:

• transfer to a country recognised as providing an adequate level of protection;
• use of an approved UK International Data Transfer Agreement;
• use of the UK Addendum to approved contractual clauses; or
• another safeguard permitted by UK data protection law.

13. How Long We Keep Your Information

We do not keep personal information for longer than necessary.

Medical and clinical records

Emerald Health retains adult patient medical and clinical records for a minimum of 8 years following the conclusion of treatment or the patient’s last clinical contact, whichever is later.

Records may be retained for longer where this is necessary because of:

• an ongoing complaint, investigation or legal claim;
• safeguarding requirements;
• regulatory or professional requirements;
• ongoing treatment or continuity-of-care considerations; or
• another lawful reason requiring a longer retention period.

Other records, including financial information, complaints, governance records, audit records and communications, are retained for periods appropriate to their purpose and in accordance with our Records Retention Schedule and applicable legal and regulatory requirements.

When information is no longer required, it will be securely deleted, destroyed or anonymised.

14. Keeping Your Information Secure

Emerald Health uses appropriate technical and organisational measures to protect personal information against:

• unauthorised access;
• accidental loss;
• inappropriate alteration;
• disclosure;
• destruction; and
• misuse.

These measures may include:

• controlled user access;
• password and authentication controls;
• encrypted systems and communications;
• role-based access;
• staff confidentiality requirements;
• information governance training;
• secure systems and suppliers;
• monitoring and audit controls; and
• incident and data-breach management procedures.

No electronic system can guarantee absolute security, but we regularly review our arrangements and take proportionate steps to protect the information entrusted to us.

15. Automated Decision-Making

We may use digital questionnaires, eligibility tools or system processes to help gather information and support our administrative or clinical processes.

We do not rely solely on automated processing to make clinical prescribing decisions about you.

Clinical decisions relating to your suitability for treatment and prescribing are made with meaningful involvement from appropriately qualified healthcare professionals.

16. Your Data Protection Rights

Depending on the circumstances, you may have the right to:

• Access personal information we hold about you;
• Rectify inaccurate or incomplete information;
• Request erasure of information in certain circumstances;
• Restrict processing in certain circumstances;
• Object to certain types of processing;
• Data portability where the legal requirements are met;
• Withdraw consent where processing is based on consent; and
• challenge certain decisions made solely through automated processing where applicable.

These rights are not absolute.

For example, we may be required to retain parts of your clinical record even where you ask for information to be deleted because healthcare providers have legal, professional and patient-safety obligations to maintain appropriate records.

To exercise a data-protection right, contact:

Data Protection: dataprotection@emeraldhealthclinic.co.uk

Please mark your request “Data Protection Request”.

We may ask you to provide information to confirm your identity before releasing or changing personal information.

17. Data Protection Complaints

If you have concerns about how Emerald Health has collected, used, stored, disclosed or otherwise handled your personal information, you can raise a data-protection complaint with us.

Please contact:

Data Protection: dataprotection@emeraldhealthclinic.co.ukTelephone: 01727 647979

Please mark correspondence “Data Protection Complaint”.

We will acknowledge a data-protection complaint within 30 days and will take appropriate steps to investigate it. We will keep you appropriately informed and provide an outcome without undue delay.

This process is separate from our clinical and general patient complaints procedure, although a complaint may involve both clinical and data-protection matters.

You also have the right to raise concerns with the UK data-protection regulator:

Information Commissioner’s Office (ICO)Wycliffe HouseWater LaneWilmslowCheshireSK9 5AF

Website: www.ico.org.uk

You do not have to contact us before approaching the ICO, although the ICO may ask whether you have raised your concern with us first.

18. Children and Young People

Emerald Health’s clinical services are intended for adults aged 18 and over.

We do not knowingly provide our standard clinical service to, or collect health information for treatment purposes from, children under 18 through the website.

If information relating to a child or young person is provided to us for another legitimate reason, it will be handled in accordance with applicable data-protection and safeguarding requirements.

19. Third-Party Websites

Our website may contain links to websites or services operated by other organisations.

Emerald Health is not responsible for the privacy practices of third-party websites. We recommend reviewing their privacy information before providing personal information to them.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes in technology;
• regulatory or legal developments; or
• changes to the way we process personal information.

The latest version will be published on our website together with the date it came into effect.

Where a change is significant, we will take reasonable steps to bring it to the attention of affected individuals where appropriate.

21. Contact Us

For questions about this Privacy Policy or how Emerald Health uses your personal information:

Emerald Health Clinic Limited71–75 Shelton StreetLondonWC2H 9JQ

Telephone: 01727 647979General enquiries: info@emeraldhealthclinic.co.ukPatient support: support@emeraldhealthclinic.co.ukData Protection: dataprotection@emeraldhealthclinic.co.uk