Legal

Privacy Policy

Last updated: August 2026 - This policy explains how we collect, use and protect your personal data.

Important: We handle sensitive health data. Your medical information is special category data under UK GDPR Article 9 and is treated with the highest level of care and protection. We will never sell your data.

1. Who We Are

Pop Up Docs Ltd is the data controller for your personal data, registered in England and Wales (Company No: 13147400). Contact us about data protection at hello@batterseaweightlossclinic.co.uk.

2. What Data We Collect

Identity data: name, date of birth, sex at birth, ethnicity
Contact data: email address, phone number, delivery address
Health data: medical history, current medications, blood test results, weight, BMI, body composition data, questionnaire responses - all special category data under UK GDPR Article 9
Financial data: payment information processed securely via Stripe - we do not store card details
Account data: email address and password (if you create a patient account) - passwords are encrypted and never stored in plain text
Technical data: IP address, browser type, pages visited, session data via cookies

3. How We Use Your Data

To provide clinical services and maintain your medical record
To review your medical questionnaire and issue prescriptions
To communicate with you about appointments, results and your treatment
To process payment via Stripe
To fulfil delivery of medication via Medirex Pharmacy
To comply with our legal and regulatory obligations including CQC, GPhC and GMC requirements
To improve our services using anonymised, aggregated data only

4. Legal Basis for Processing

We process your health data under UK GDPR Article 9(2)(h) - for the purposes of preventive or occupational medicine, medical diagnosis, and the provision of health or social care. We process other personal data under contract performance (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)).

5. Data Processors

We use the following third party services to support our operations. All are bound by data processing agreements and GDPR-compliant:

Supabase - patient account and questionnaire data storage (EU servers, Paris)
Stripe - payment processing (does not store card details on our systems)
Semble - appointment booking and practice management
Medirex Pharmacy - medication dispensing and delivery

6. Data Retention

Medical records and questionnaire responses: minimum 8 years from last treatment, in line with NHS and medical defence body guidance
Financial records: 7 years in line with HMRC requirements
Marketing preferences and account data: until you request deletion, subject to our legal retention obligations

7. Your Rights

Under UK GDPR you have the right to:

Access your personal data (Subject Access Request)
Correct inaccurate data
Request deletion (right to erasure) - subject to our legal retention obligations for medical records
Restrict processing in certain circumstances
Object to processing based on legitimate interests
Data portability

To exercise any of these rights, contact us at hello@batterseaweightlossclinic.co.uk. We will respond within 30 days. If you are unhappy with our response, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We use cookies for essential site functionality, analytics and payment processing. Please see our Cookie Policy for full details.

9. Security

We use industry-standard security measures including SSL/TLS encryption, encrypted password storage, and row-level security on our database. Health data is stored on EU-based servers (Supabase, Paris). We conduct regular security reviews and limit access to patient data to clinicians directly involved in your care.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email. The date at the top of this page shows when it was last updated.