Legal
Privacy policy
This policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights.
Last updated: 1 October 2026
About this policy
Thrivefully Health Ltd respects your privacy.
It applies when you:
- visit our website, www.thrivefully.co.uk;
- book or use any of our services;
- use any Thrivefully app or online portal;
- contact us by email, phone or social media; or
- receive emails from us.
Please read it alongside our Terms and Conditions.
Who we are
Thrivefully Health Ltd is the data controller for your personal information. This means we decide how and why it is used.
- Company: Thrivefully Health Ltd, registered in England and Wales (company number 17510083)
- Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ
- Privacy contact: support@thrivefully.co.uk
⚑ ICO registration number — Thrivefully Health Ltd must be registered with the ICO because it handles health data. Add the registration number here.
Clinical governance. Clinical care is delivered under the CQC-registered governance of The Wellbeing Doctors (Lynch Health Enterprises Ltd). CQC rating: Good. The Wellbeing Doctors may access your clinical records for clinical governance, audit and regulatory purposes.
⚑ Confirm whether The Wellbeing Doctors is a joint controller of clinical records, and put it in writing.
The information we collect
The information we collect depends on how you use our services. It may include:
| Type | Examples |
|---|---|
| Contact details | Name, postal address, email address, phone number, emergency contact |
| Personal details | Date of birth, sex, gender |
| Health information | Medical history, current medication (including weight-loss medication and who prescribes it), symptoms and side effects, weight, height, body composition, blood pressure, blood test results, lifestyle, diet, sleep, stress and mental wellbeing, consultation notes and care plans |
| GP details | Your GP's name and practice address, so we can write to them with your consent |
| Payment and booking details | Appointments, programmes bought, payment records. Card details are handled by our payment provider; we do not store full card numbers. |
| Communications | Emails, messages, feedback and complaints you send us |
| Technical information | IP address, browser and device type, pages visited, and cookie data. See section 10. |
| Marketing preferences | Whether you want to receive our newsletters and offers |
Health information is "special category data" under UK GDPR. We give it extra protection, as explained in section 5.
How we collect it
From you. When you fill in forms on our site, complete a health questionnaire, book or attend a consultation, take a home blood test, email us or speak to us.
From the laboratory. When you return a home blood test kit, the laboratory sends your results to us.
From other healthcare professionals. With your consent, we may receive information from your GP or prescriber, such as your medication history or recent test results.
Automatically. When you use our website, we collect technical information through cookies and similar technologies, as explained in section 10.
If you give us information about someone else, such as an emergency contact, please make sure they are happy for you to do so.
You do not have to give us your information. If you don't, we may not be able to provide our services safely.
How we use your information and our legal basis
UK GDPR says we must have a legal basis for each way we use your information.
| What we use it for | Legal basis |
|---|---|
| Providing your care: consultations, blood tests, monitoring, reviews and care plans | Performing our contract with you. For health information, providing health care (UK GDPR Article 9(2)(h)). |
| Writing to your GP or prescriber about your care | Your consent. Where there is a serious risk to your health, providing health care. |
| Managing bookings, payments and your account | Performing our contract with you |
| Sending service messages, such as appointment reminders, results and changes to our terms | Performing our contract with you |
| Clinical governance, audit and keeping medical records | Legal obligation. For health information, providing health care and public health (Article 9(2)(h) and (i)). |
| Handling complaints and legal claims | Legitimate interests and legal obligation. For health information, legal claims (Article 9(2)(f)). |
| Improving our services, using anonymised or summary data | Legitimate interests |
| Keeping our website and systems secure, and preventing fraud | Legitimate interests |
| Sending newsletters and offers | Your consent. You can withdraw it at any time. |
We do not use your health information for marketing. We do not sell your information. We do not use automated decision-making that has legal or similarly significant effects on you.
Where we rely on your consent, you can withdraw it at any time by emailing support@thrivefully.co.uk. This does not affect anything we did before you withdrew it.
Who we share your information with
We only share your information where we need to, and only as much as is needed. We may share it with:
- The Wellbeing Doctors (Lynch Health Enterprises Ltd), for clinical governance, audit and CQC regulatory purposes;
- the laboratory that processes your blood test, [laboratory name];
- your GP or prescriber, with your consent, or where there is a serious risk to your health;
- service providers who help us run our business, under contracts that require them to keep your information safe and use it only on our instructions. These include payment processing [provider], booking and scheduling [provider], email [provider], website hosting [provider] and video consultations [provider];
- professional advisers, such as lawyers, accountants and insurers, where needed;
- regulators and authorities, such as the CQC, the GMC or the police, where the law requires it or to protect someone from serious harm; and
- a buyer or successor, if Thrivefully Health Ltd is sold or merged. Your information would stay protected under this policy.
We never share your information with other companies for their own marketing.
⚑ Fill in the names of the laboratory, payment provider, booking system, email provider, hosting provider and video consultation tool.
International transfers
We aim to store your information in the UK or the European Economic Area. Some of our service providers may process information outside the UK. Where they do, we make sure it is protected by a UK adequacy decision or by approved safeguards such as the UK International Data Transfer Agreement.
⚑ Confirm which providers, if any, transfer data outside the UK.
How long we keep your information
We keep your information only as long as we need it:
| Information | How long we keep it |
|---|---|
| Medical records, including consultation notes and blood test results | 8 years after your last contact with us, in line with the NHS Records Management Code of Practice |
| Payment and financial records | 6 years after the end of the financial year they relate to, as required by HMRC |
| Complaints | [10] years after the complaint is closed |
| Marketing preferences | Until you unsubscribe, then a suppression record so we don't contact you again |
| Website enquiries that did not lead to a booking | [2] years |
After that, we securely delete or anonymise it.
How we protect your information
We use technical and organisational measures to protect your information. These include encryption, access controls so only authorised staff and clinicians can see health records, secure systems and staff training on confidentiality. No system is completely secure, but we work to keep risks low. If there is a data breach that puts your rights at risk, we will tell you and the ICO as the law requires.
Cookies
Our website uses cookies, which are small files stored on your device. Some are essential to make the site work. Others help us understand how the site is used. We only use non-essential cookies, such as analytics, if you agree to them through our cookie banner. You can change your choice at any time, or block cookies in your browser settings.
See our Cookie Policy.
⚑ Confirm which cookies the site uses.
Marketing
We will only send you newsletters and offers if you have agreed to receive them. Every marketing email has an unsubscribe link, or you can email support@thrivefully.co.uk. We will still send you service messages about your care, bookings and account, as these are part of our service.
Your rights
Under UK data protection law, you have the right to:
- access your information and get a copy of it;
- correct information that is wrong or incomplete;
- delete your information, although we may need to keep medical records for the periods in section 8;
- restrict how we use your information;
- object to us using your information based on legitimate interests or for marketing;
- data portability, meaning you can get information you gave us in a format you can move to another provider; and
- withdraw consent at any time, where we rely on it.
To use any of these rights, email support@thrivefully.co.uk with the subject "Data request". We may ask you to prove your identity. We will respond within one month, free of charge in most cases. If your request is complex, we may extend this by up to two more months and will tell you why.
Age
Our services are for adults aged 18 and over. We do not knowingly collect information from anyone under 18.
Links to other websites
Our site may link to other websites. We are not responsible for how they handle your information. Please read their privacy policies.
Complaints
If you are unhappy with how we have handled your information, please contact us first at support@thrivefully.co.uk so we can try to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:
- Website: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If we make important changes, we will tell you by email or with a notice on our site.
Contact us
If you have any questions about this policy or your information, please contact us:
- Email: support@thrivefully.co.uk
- Post: Thrivefully Health Ltd, 71–75 Shelton Street, Covent Garden, London WC2H 9JQ
- Website: www.thrivefully.co.uk