18-21 Wellington Way, Waterlooville, UK
Signed in as:
filler@godaddy.com
Introduction
Santo The Wellness Collective Limited (“we”, “us”, “the Centre”) is committed to protecting your privacy, safeguarding your personal information, and being transparent about how we collect, use, store, share, and retain your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the ICO Data Sharing Code of Practice, and relevant healthcare and safeguarding legislation.
This Privacy Policy explains what personal data we collect, how and why we use it, the lawful bases we rely upon, how information may be shared, how long we retain data, your rights, and how to contact us.
Who We Are
Santo The Wellness Collective Limited
We are registered with the Information Commissioner’s Office (ICO) awaiting registration number.
The Centre works with independently ICO-registered Clinical Practitioners.
Joint Data Controller Relationship
To provide assessments, therapy, coaching, and related healthcare services, the Centre and each Clinical Practitioner act as Joint Data Controllers. Both parties make decisions about how personal data is used and processed, and you may exercise your data protection rights against either the Centre or your Practitioner.
What Personal Data We Collect
We may collect and process the following categories of personal data:
Personal identification data (such as name, date of birth, address, email address, and telephone number)
Special category data, including health, mental health, psychological, behavioural, neurodevelopmental, and wellbeing information
Technical data, including IP addresses, browser type, device information, and website usage logs
Financial and transaction data relating to payments and bookings
Information provided by GPs, psychiatrists, therapists, employers, universities, occupational health providers, insurers, or other professionals where consent has been provided
How We Collect Personal Data
We may collect personal data through:
Enquiry forms and intake forms
Emails, telephone calls, and video consultations
Appointment bookings and service registrations
Assessment questionnaires and submitted reports
Communications with other professionals where authorised by you
Website usage and cookies
Lawful Bases for Processing (Article 6 UK GDPR)
We process personal data under one or more of the following lawful bases:
Performance of a contract
Compliance with a legal obligation
Legitimate interests
Vital interests
Consent (used where specifically required, including marketing communications, testimonials, photography, or optional external information sharing)
Lawful Bases for Processing Special Category Data (Article 9 UK GDPR)
Where we process health or other special category data, we rely on:
Article 9(2)(h) – provision of health or social care or treatment
Article 9(2)(g) – substantial public interest, including safeguarding obligations
Article 9(2)(a) – explicit consent where required
How We Use Personal Data
We use personal data to:
Deliver assessments, therapy, coaching, and related services
Plan and manage appointments and sessions
Maintain clinical records
Communicate with you regarding services and appointments
Process payments and administer accounts
Improve and develop our services
Ensure safety, safeguarding, and risk management
Undertake anonymised clinical supervision and professional development
Internal Information Sharing
Your information may be shared internally with:
Clinical Directors
Practice Managers
Administrative and Finance teams
Coordinators
Your allocated Clinical Practitioner
Clinical notes are generally maintained by the Practitioner, while administrative and booking data are maintained by the Centre.
External Information Sharing
We may share your information externally:
With your consent, including with GPs, psychiatrists, therapists, universities, employers, occupational health providers, insurers, or other professionals involved in your care
Without consent only where legally permitted or required, including:
Safeguarding concerns
Serious risk of harm to yourself or others
Court orders
Regulatory or legal obligations
Clinical Supervision
Clinical Practitioners may discuss anonymised information within professional supervision to ensure safe, ethical, and effective practice.
No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
Information from Other Providers
With your consent, we may request or receive information from healthcare providers, employers, universities, occupational health services, or other professionals relevant to your care. This information is stored securely and may be accessible to you upon request, subject to applicable legal exemptions.
Retention Periods
We retain personal data only for as long as necessary for legal, clinical, regulatory, and operational purposes.
Adult clinical records are generally retained for a minimum of 7 years after the conclusion of treatment or services, in line with healthcare guidance and professional requirements
Some Practitioners may retain records for longer where required by their professional or insurance obligations
Enquiry data is typically retained for up to 12 months
Financial and accounting records are retained for 7 years in accordance with HMRC requirements
Security of Your Data
We implement appropriate technical and organisational measures to protect personal data, including:
Use of an ICO-Compliant Clinical database system.
In addition;
Encrypted cloud storage
Access controls and role-based permissions
Strong password policies and multi-factor authentication where applicable
Secure email systems
Locked physical storage
Confidentiality agreements for staff and practitioners
Some service providers we use may store or process data outside the UK or EEA. Where this occurs, we ensure appropriate safeguards are in place, including the use of approved Standard Contractual Clauses or adequacy regulations.
Your Rights
Under UK GDPR, you have the right to:
Be informed about how your data is used
Access your personal data
Request rectification of inaccurate information
Request erasure of data in certain circumstances
Restrict processing
Object to processing
Data portability
Withdraw consent where processing is based on consent
Lodge a complaint with the Information Commissioner’s Office (ICO)
Exercising Your Rights
To exercise your rights or make a data protection enquiry, please contact:
enquiries@santo-wellness.co.uk
Requests relating to clinical records or notes may also be directed to your Clinical Practitioner.
Data Breaches
Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office and affected individuals in accordance with applicable legal requirements.
Cookies and Website Usage
Please refer to our Website Terms & Conditions and Cookies Policy for information about how we use cookies and website analytics technologies.
Photos, Videos, Testimonials, and Marketing
Photographs, videos, testimonials, and marketing communications will only be used with your explicit consent. Consent may be withdrawn at any time.
Complaints
If you are unhappy with how we handle your personal data, you may contact the Information Commissioner’s Office: