Last Updated: 16 June 2026
Welcome to the Thriving Clinics Limited Privacy Notice. We respect your privacy and are committed to protecting your personal data. This privacy notice informs you about how we look after your personal data when you visit our website, use our central booking and marketing platforms, or interact with our services.
Thriving Clinics operates under a "hub-and-spoke" franchise model. This means that Thriving Clinics Limited acts as the central administrative and technological "Hub," while your primary medical care is delivered by independently owned and operated clinical branches ("Spokes").
Because of our hub-and-spoke model, the responsibility for your data is divided:
Important Note on Health Inferences: While Thriving Clinics Limited (the Hub) does not hold your full clinical medical records, the basic scheduling information we process (e.g., knowing you booked a "weight loss clinic" or a "GP appointment") allows us to infer information about your health. Therefore, we treat this booking data with the highest level of security as Special Category Data under UK data protection law.
Depending on how you interact with our website and services, we may collect, use, store, and transfer the following kinds of personal data:
We use different methods to collect data from and about you, including through:
Under the UK GDPR, we must have a lawful basis to process your data. Where we process health-related scheduling data, we also invoke a specific condition for Special Category Data.
| Purpose/Activity | Type of Data | Lawful Basis (Article 6) | Special Category Condition (Article 9) |
|---|---|---|---|
| To process your appointment booking and transfer details to your local clinical branch. | Demographic, Identity, Contact, Scheduling | Performance of a Contract (to facilitate the service you requested). | Article 9(2)(h): Management of health or social care systems and services. |
| To send marketing communications, newsletters, and promotional updates. | Contact, Marketing | Consent (Explicit website opt-in. You may withdraw this at any time). | Not applicable (No health data used for marketing). |
| To process financial transactions, invoicing, and maintain business records. | Financial, Identity | Legal Obligation (Required for statutory UK tax and HMRC compliance). | Not applicable. |
To provide our central administrative services, we share your data with strictly vetted third-party service providers and partners within our infrastructure:
We protect your data by restricting where it is stored or ensuring robust legal safeguards are in place:
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
| Data Type | Retention Period | Legal/Standard Rationale |
|---|---|---|
| Scheduling & Booking Data | 6 years from the date of the appointment. | Retained for administrative continuity, booking disputes, and operational audits. (Note: Your primary medical records are kept significantly longer by your local clinical branch). |
| Financial & Transaction Data | 6 Years from the end of the financial year in which the transaction occurred. | Statutory requirement under UK tax law for HMRC compliance. |
| Marketing Preferences | Until Consent is Withdrawn (or after 24 months of total inactivity). | Kept as long as you wish to hear from us. You can unsubscribe instantly via any email link. |
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. Access to your personal data is limited to those employees, contractors, and other third parties who have a business need to know.
Under UK data protection laws, you have rights in relation to your personal data, including the right to:
To exercise rights regarding data held by the Central Hub, please contact us below. To exercise rights regarding your clinical medical records, please contact your local Clinical Branch directly.
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.