Privacy Policy

Ph7even is a private health and aesthetics clinic based at Gable House, Malmesbury, Wiltshire. We provide private blood testing, live blood analysis, advanced aesthetic treatments, and wellness injections.

For the purposes of data protection law, Ph7even is the data controller of your personal information. If you have any questions about how we handle your data, please contact us at [email protected].

We may collect and process the following personal information:

• **Contact details** — name, email address, phone number, and postal address • **Health information** — details you provide when booking appointments or undergoing treatments, including medical history and test results • **Payment information** — billing details processed securely via Stripe (we do not store card details) • **Website usage data** — IP address, browser type, pages visited, and time spent on our site (via analytics tools) • **Communications** — records of emails, enquiries, and any correspondence with us

We use your personal information to:

• Provide and manage the health and aesthetic services you have requested • Process payments and send booking confirmations • Communicate with you about your appointments, results, and aftercare • Send relevant health and wellness information where you have consented • Comply with our legal and regulatory obligations as a healthcare provider • Improve our website and services

We process your personal data on the following legal bases:

• **Contract** — to fulfil the services you have booked with us • **Legitimate interests** — to manage our business, respond to enquiries, and improve our services • **Legal obligation** — to comply with healthcare regulations and record-keeping requirements • **Consent** — for marketing communications and any processing beyond what is strictly necessary

Health information is classified as special category data under UK GDPR and is treated with the highest level of care. We process health data only where necessary to provide your treatment, and we maintain strict confidentiality in line with our professional obligations as a healthcare provider.

Your health records are stored securely and are only accessible to authorised clinical staff involved in your care.

We do not sell your personal data. We may share your information with:

• **Third-party laboratories** — where blood samples are sent for analysis as part of your testing service • **Payment processors** — Stripe, for secure payment processing • **IT and software providers** — who support the operation of our systems, under strict data processing agreements • **Regulatory bodies** — where we are legally required to disclose information

All third parties are required to handle your data securely and in accordance with applicable data protection law.

We retain your personal data for as long as necessary to provide our services and comply with our legal obligations. Healthcare records are typically retained for a minimum of 8 years in line with NHS and professional guidance. After this period, data is securely deleted or anonymised.

Under UK GDPR, you have the following rights:

• **Access** — request a copy of the personal data we hold about you • **Rectification** — ask us to correct inaccurate or incomplete data • **Erasure** — request deletion of your data where there is no lawful reason to retain it • **Restriction** — ask us to limit how we use your data • **Portability** — receive your data in a structured, machine-readable format • **Objection** — object to processing based on legitimate interests or for direct marketing

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

Our website uses cookies to improve your browsing experience and analyse site traffic. You can control cookie preferences through the cookie banner displayed on your first visit, or via your browser settings. Essential cookies required for the site to function cannot be disabled.

We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect your information against unauthorised access, loss, or disclosure. Payment data is processed via Stripe's PCI-DSS compliant infrastructure and is never stored on our servers.

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.

If you have any questions or concerns about how we handle your personal data, please contact us:

**Ph7even** Gable House, Malmesbury, Wiltshire Email: [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.