Privacy Policy

01Who we are

This policy explains how Advanced Wellness Ltd (company number 17100614), trading as vFlow, collects, uses and protects your personal data when you visit our website, book a treatment, or receive care from us in person, including at partner gym and sports centre locations.

We are the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) as a data controller; our registration number is available on request.

02What we collect

We collect different information depending on how you interact with us:

• Contact and account details: name, email, phone number, date of birth (to confirm you're 18 or over), and address if needed for invoicing.
• Booking and transaction data: appointment history, treatments received, and payment confirmation. We do not store full card details ourselves — payments are handled by a third-party payment processor.
• Health information: medical history, current medications, allergies, and your answers during clinical screening. This is special category data under UK GDPR and we handle it with extra care, as set out below.
• Website and device data: IP address, browser type, and how you use our site, collected via cookies and similar technologies. See our Cookie Policy for detail.
• Usage analytics: we measure how our site is used so we can improve it. This includes a cookieless tool that never identifies you, and — only if you accept cookies — Google Analytics, which uses cookies and processes aggregate, IP-anonymised usage data on our behalf. Google may process this outside the UK under approved safeguards. You can decline analytics cookies at any time, and we never send your health information to any analytics provider.
• Communications: anything you send us by email, form, or phone, including complaints or feedback.

03How we use it

• To assess your suitability for treatment and provide safe, appropriate clinical care.
• To manage bookings, send appointment reminders, and process payment.
• To keep clinical records as required by professional and regulatory standards.
• To respond to questions, complaints, or requests you send us.
• To meet our legal and regulatory obligations, including reporting to the Care Quality Commission or MHRA where required.
• To send you marketing communications, but only where you've opted in, and you can withdraw that consent at any time.
• To understand how our website is used, so we can improve it.

04Our legal basis for using your data

For ordinary contact and booking data, we rely on contract (we need it to provide the service you've asked for) and legitimate interests (running our business responsibly).

For health data, UK GDPR requires an additional, stricter basis. We rely on Article 9(2)(h) — processing necessary for the provision of health care by, or under the responsibility of, a registered healthcare professional — and, where appropriate, your explicit consent, obtained as part of your clinical screening and consent-to-treatment process.

For marketing, we rely on your consent, which you give separately and can withdraw at any time without affecting your ability to book treatment.

For regulatory reporting and record-keeping, we rely on our legal obligations as a healthcare provider.

05Who we share it with

We don't sell your data, and we don't share it for anyone else's marketing purposes. We do share it, on a need-to-know basis, with:

• The prescribers and clinicians involved in your care, including at the specific location where you're treated.
• IT, booking, and cloud storage providers who process data on our behalf, under contracts that require them to protect it (our data processors).
• Our payment processor, to take payment securely.
• Regulators and authorities where we're legally required to report — for example, the Care Quality Commission, MHRA, or in response to a valid legal request.
• Our insurers and professional advisers, if needed to investigate or respond to a complaint or claim.

06International transfers

Some of the tools we use to run the business (for example, cloud hosting or booking software) may store data outside the UK. Where that happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision, so your data stays protected to UK standards wherever it's processed.

07How long we keep it

We keep clinical and health records for as long as our clinical governance policy and professional indemnity requirements dictate, typically several years after your last treatment with us, in line with standard private healthcare record-keeping practice.

Booking and transaction records are kept for as long as needed for accounting and tax purposes, generally six years. Marketing consent is kept until you withdraw it. Website analytics data is retained for a limited period, as set out in our Cookie Policy.

08Keeping it secure

We use appropriate technical and organisational measures to protect your data, including access controls, encryption where appropriate, and staff training on confidentiality. Only people who need access to your information to do their job can see it.

09Cookies

Our website uses cookies and similar technologies to help it function and to understand how it's used. Full detail, including how to manage your preferences, is in our Cookie Policy.

10Your rights

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you, and get a copy of it.
• Ask us to correct anything that's inaccurate or incomplete.
• Ask us to delete your data, though this may be limited where we have a legal or clinical governance reason to keep clinical records for a set period.
• Ask us to restrict how we use your data, or object to certain uses.
• Ask for your data in a portable format, where technically possible.
• Withdraw consent at any time, where consent is our basis for processing.

To exercise any of these rights, contact us using the details below. If you're unhappy with how we've handled your data, you also have the right to complain to the Information Commissioner's Office (ICO):

11Under-18s

Our treatments are for adults aged 18 and over only. We don't knowingly collect personal data from anyone under 18 through our booking systems, and we ask that under-18s don't submit their own details through our website.

12Changes to this policy

We may update this policy from time to time, for example if our services or legal obligations change. We’ll post the updated version here with a new "last updated" date, and let you know directly if a change materially affects how we use your data.

13Contact & complaints

For any question about this policy or your data, contact us at hello@vflowhealth.co.uk.