1. About this Privacy Notice

Ravenstone Wellness Ltd ("we", "us" or "our") respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains how we collect, use, store and protect your personal information when you use our bone health screening and assessment services, contact us, make an appointment, receive services from us, or otherwise interact with our business, including through our website.

Some of the information we process is special category personal data under UK data protection law. That includes information about your health and your bone assessment results, and it also includes information about your ethnicity, which the scanner records because it affects how a result is interpreted. We apply additional safeguards to all of it, and both are described in full below.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

2. Who we are

Ravenstone Wellness Ltd is a company registered in England and Wales under company number 15817367, with its registered address at 140 Lee Lane, Bolton, England, BL6 7AF.

You can contact us by email at [email protected] or by telephone on +44 7900 168997.

For the purposes of data protection law, Ravenstone Wellness Ltd is the data controller of the personal information described in this notice. That means we decide what information is collected, why, and how long it is kept.

Our Data Protection Lead is Jayne Denton, Director. You can contact them by email at [email protected], by telephone on+44 7900 168997, or by post at our registered address above.

3. What information we collect

Depending on the services you use, we may collect and process the following.

Personal and contact information. Your name, date of birth, postal address, the town or postcode you give us when you ask to hear about screening days in your area, telephone number, email address, your sex or gender where relevant to the assessment, your appointment details, and information used to identify you.

Health and assessment information. Where necessary to provide our services, we may process your bone assessment results, including bone mineral density, T-score, Z-score and fragility or fracture risk outputs produced by the scanner. We may also process your height and weight, information you give us before or during your appointment such as bone health history, previous fractures, a diagnosis of osteoporosis or osteopenia, steroid use, relevant surgical history, menopause status and family history of bone conditions. We may process information from any bone-related blood testing arranged through us, information about previous assessments where you provide it, your assessment reports, observations or comments recorded by the person carrying out the assessment, and information relevant to interpreting or communicating your results.

If you join a PRIME programme, we also process the answers you give in our Health & Lifestyle questionnaire, including your medical history, medication, nutrition, sleep, activity and goals; notes from your movement assessment and programme reviews; your check-ins; and the results of any health or nutritional tests you choose to share with us, such as vitamin D or omega fatty acid profiles.

Ethnicity. The REMS scanner records your ethnicity and prints it on every page of every report, because reference ranges for bone density differ between population groups and a result cannot be interpreted correctly without it. Ethnicity is special category personal data in its own right, separate from health data. We collect it only to produce and interpret your assessment, it is held in the same restricted place as your report, and it is never used for marketing, profiling or any other purpose.

Administrative and financial information. Your booking and appointment records, payment and transaction records such as the amount, date and status of a payment, invoices and receipts, correspondence with you, records of your marketing preferences and consents including what you consented to and the date, time and source of it, and records of complaints or enquiries.

We never see or hold your full card details. Card payments are taken by our payment provider, Stripe, and the card number does not pass through our website, our booking system or our client records.

Technical and website information. When you use our website we may collect your IP address, browser and device type, the pages you viewed, how you reached the site, and similar usage information. Most of this is collected only where you have consented to analytics cookies. Section 10 and our Cookie Policy explain this in full.

4. How we collect your information

We may obtain personal information directly from you when you enquire, book an appointment or use our services; when you complete an enquiry form, a bone health questionnaire, a scorecard or a consent form on our website; when you join a list to be told about screening days in your area; from an organisation arranging screening on your behalf, for example an employer or an event host; from a healthcare professional or referring organisation where appropriate and lawful; through our online booking system; through correspondence, telephone calls and messages with us; and from the service providers listed in section 8 acting on our behalf.

Where we receive information about you from another organisation, we will use it only where there is a lawful basis to do so.

5. How we use your information

We may use your personal information to arrange and administer appointments and send confirmations and reminders; to provide bone health screening and assessment services; to carry out and record your assessment; to produce your results and make them available to you securely; to arrange and interpret bone-related blood testing where you have asked for it; to offer and hold a conversation about your results; to invite you to a reassessment at the interval appropriate for you; to deliver PRIME programmes, including your exercise programme, check-ins and reviews; to respond to your questions and requests; to process payments and maintain financial records; to maintain accurate service records; to deal with complaints and enquiries; to send you marketing where you have asked to receive it; to understand how our website is used where you have consented to analytics cookies; to comply with legal, regulatory and professional requirements; to protect the security of our systems and premises; to investigate and manage data protection or security incidents; and to establish, exercise or defend legal claims.

We will not use your health information or your ethnicity for any unrelated purpose. In particular, we do not use health information or ethnicity to target marketing, and we do not sell or rent your information to anyone.

6. Our lawful basis for processing

Under the UK GDPR we must have a lawful basis for processing personal information. Depending on the circumstances we rely on one or more of the following.

Answering an enquiry and arranging an appointment. Our basis is contract, or steps taken at your request before entering a contract.

Carrying out your bone health assessment, producing and delivering your results, and holding your clinical record. Our basis is contract. Because this involves health information and ethnicity, we also rely on Article 9(2)(h) of the UK GDPR, the provision of health care, together with the condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Your assessment is carried out by or under the responsibility of an HCPC-registered diagnostic radiographer, who owes you a duty of confidentiality.

PRIME programmes, our Health & Lifestyle questionnaire, and any test results you share with us. Our basis is contract. For the health information involved, we rely on your explicit consent under Article 9(2)(a) of the UK GDPR, which we ask for when you complete the questionnaire or join a programme. You can withdraw that consent at any time, but we will then be unable to continue your programme, and we may still need to keep the records we already hold for the periods in section 12.

Taking payment and keeping financial records. Our basis is contract, and legal obligation for tax and accounting records.

Sending you marketing by email or text. Our basis is consent. We never use health information or ethnicity to decide what marketing to send you.

Analytics cookies on our website. Our basis is consent.

Keeping records to defend a claim, and meeting regulatory and professional obligations. Our basis is legal obligation, and our legitimate interests in protecting our position. Where health information is involved we rely on Article 9(2)(f), legal claims.

Protecting someone in an emergency. Our basis is vital interests, and Article 9(2)(c) where health information is involved.

7. Your results and your clinical record

Your assessment results are confidential.

We hold your report and your clinical record in a restricted, encrypted area of our own secure storage, separate from our general business files and separate from the customer record that holds your name, contact details and appointments. Access is limited to the people who carry out or interpret assessments.

Your results are made available to you by a secure link tied to the email address you give us. Only that address can open the report, and the link can be withdrawn by us at any time if it is ever sent in error. We do not put results, scores or clinical findings in the body of an email or a text message.

We read your email address back to you at your appointment and ask you to confirm it, because that address is what controls access to your results.

We will only provide your results to another person or organisation where there is an appropriate lawful basis to do so. For example, where appropriate and authorised, we may provide information to your GP, consultant or another healthcare professional involved in your care; to a referring healthcare professional; to an organisation that arranged or paid for your assessment; to an employer or occupational health provider where applicable and lawful; or to another person you have authorised to receive the information.

Where an assessment is arranged by an organisation, we will explain before the appointment what information will be provided to that organisation and for what purpose. An organisation that pays for an assessment does not automatically receive your result.

8. Who we share your information with

We use a small number of carefully chosen service providers to run our website, our booking and our records. They act on our documented instructions, they are bound by written contracts that meet Article 28 of the UK GDPR, and they may not use your information for their own purposes.

Chrysós Systems, in the United Kingdom, builds and runs our website, booking and customer records on our behalf. It is our processor and does not hold your assessment report or your results.

HighLevel LLC and LeadConnector LLC, in the United States, provide the platform behind our website, enquiry forms, online booking and calendars, customer records, appointment and payment records, and the sending of our emails and text messages.

Google LLC and Google Ireland Limited, in the United States and Ireland, provide our email, video calls through Google Meet, and the secure storage in which your report and clinical record are held. Files and email content are stored in the European Union. Google also provides our website analytics and Search Console where you have consented to analytics cookies, and our Google Business Profile.

Stripe Payments UK Ltd and Stripe, Inc., in the United Kingdom, European Union and United States, take card payments and deposits. Stripe receives your card details directly and we never see or store them.

TrueCoach, in the United States, provides the app we use to deliver PRIME exercise programmes, check-ins and messages about your programme.

WhatsApp Ireland Limited, in Ireland, provides WhatsApp, which some clients choose to use to message us. WhatsApp messages are end-to-end encrypted.

Zinzino AB, in Sweden, and London Blood Tests, in the United Kingdom, supply the health and nutritional tests you can choose to buy. When you order a test, that company collects and analyses your sample and is responsible for your results under its own privacy notice. If you share your results with us, we hold them as part of your record.

Echolight S.p.A., in Italy, supplies the REMS scanner and its software. Your scan is produced on our own equipment at the point of assessment. Where Echolight provides technical support that could involve access to a record, it does so under a written agreement with us.

GoDaddy, in the United States, holds our domain name registration and DNS records. It does not hold customer or health information.

We may also share personal information, where necessary and lawful, with healthcare professionals and referring organisations as described in section 7; organisations arranging or funding an assessment as described in section 7; our accountant, insurers, professional advisers and auditors; regulators and public authorities including the Information Commissioner's Office; and law enforcement authorities where we are legally required to do so.

We only share the information that is reasonably necessary for the relevant purpose. We do not sell your information and we do not share it for anyone else's marketing.

This list is kept current. If we add or change a service provider that handles your personal information, we will update this notice.

9. Marketing

We only send marketing communications where we have a lawful basis to do so, and where the law requires consent we will ask for it before we send anything.

Marketing consent is asked for separately from anything you have to agree to in order to receive an assessment. Declining marketing will never affect the service you receive, and it is not a condition of booking.

You can opt out at any time by using the unsubscribe link in any marketing email, by replying STOP to a marketing text, or by contacting us. An opt-out is applied across all of our systems, is permanent, and cannot be undone by a later import or upload.

If you join a list to hear about screening days in your area, we use the town or postcode you give us only to decide which dates to tell you about.

10. Cookies and website technologies

Our website uses cookies and similar technologies to operate the site, keep it secure, remember your preferences and, where you consent, understand how visitors use it.

Cookies that are not strictly necessary are not placed on your device until you consent to them. You can accept or reject them when you first visit, and you can change your choice at any time using the cookie settings link in the footer of every page.

Full details of every cookie we use, what it does and how long it lasts are in our Cookie Policy.

11. How we protect your information

We take appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. These include encryption of information in transit and at rest; named individual accounts with no shared logins; two-step verification on every account that can reach personal information; access granted only to those who need it for their role and reviewed at least once a year; your assessment report and clinical record held in a separate, restricted store that cannot be shared outside our organisation by default; full disk encryption and automatic screen locking on every device used to access your information; regular security updates and endpoint protection; secure, encrypted backups held separately from live systems; written confidentiality obligations and data protection training for anyone with access; physical security of our premises and equipment; and secure disposal of paper and electronic records.

Access to health information, assessment results and ethnicity is restricted to people who have a legitimate need to access it, and that access is logged.

12. How long we keep your information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, and to meet our legal, regulatory, professional and contractual obligations.

Assessment reports, clinical records and ethnicity are kept for 8 years, measured from your last appointment.

Customer and appointment records are kept for 7 years, measured from your last appointment or last contact.

Marketing contacts and consents are kept for 24 months, measured from when consent was given or from your last engagement.

Financial records, invoices and receipts are kept for six years plus the current year, measured from the end of the accounting period.

Complaints and incident records are kept for six years from the closure of the matter.

Records of an unsubscribe or opt-out are kept indefinitely. We keep a permanent suppression record of anyone who has opted out, so that we do not contact them again by mistake. It holds nothing beyond the email address or telephone number and the date.

Our retention periods take account of applicable legislation, regulatory and professional requirements, the sensitivity of the information, our insurers' requirements, and the need to establish or defend legal claims. When information is no longer required we securely delete, destroy or anonymise it. Our full retention schedule is available on request from our Data Protection Lead.

13. International transfers

Some of the service providers listed in section 8 are based outside the United Kingdom, and some of your information is therefore processed outside the UK. Where that happens, we ensure a lawful transfer mechanism is in place. The position for each provider is set out below.

Transfers to HighLevel LLC and LeadConnector LLC in the United States are covered by the UK Extension to the EU–US Data Privacy Framework, to which both are certified.

Transfers to Google LLC in the United States are covered by the UK Extension to the EU–US Data Privacy Framework. We have also set the storage region for our files and email to the European Union, so the content of your report and your clinical record is stored and processed at rest in the EU.

Google Ireland Limited is in Ireland, and the European Economic Area is covered by the United Kingdom's adequacy regulations.

Transfers to Stripe, Inc. in the United States are covered by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, and by Stripe's own certification under the EU–US Data Privacy Framework.

Echolight S.p.A. is in Italy, which is covered by the United Kingdom's adequacy regulations.

Transfers to TrueCoach in the United States are covered by the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or otherwise by the UK International Data Transfer Addendum to the European Commission's standard contractual clauses.

WhatsApp Ireland Limited is in Ireland, and the European Economic Area is covered by the United Kingdom's adequacy regulations.

Transfers to GoDaddy in the United States are covered by standard contractual clauses with the UK Addendum. No customer or health information is held there.

Setting our storage region to the European Union covers the content of stored files and email, including backups. It does not cover system logs, cached content and technical metadata, which may still be processed in the United States. No United Kingdom-only option is available from these providers. We keep this position under review and will update this notice if it changes.

14. Your data protection rights

Subject to certain legal conditions and exemptions, you have the right to be informed about how your information is used; to request access to the personal information we hold about you, including a copy of your assessment report; to request correction of inaccurate or incomplete information; to request deletion of your personal information; to request restriction of processing; to object to certain processing, including any processing we carry out on the basis of legitimate interests; to object to direct marketing at any time, which is an absolute right; to request transfer of your information to another organisation where the right to data portability applies; and to withdraw consent at any time where we rely on consent.

These rights are not absolute. In particular, we may be required to keep your clinical record even if you ask us to delete it, because professional, insurance and legal obligations can require us to retain it for a set period. If that applies we will tell you, explain why, and restrict what the record is used for.

Withdrawing consent does not affect anything we did lawfully before you withdrew it.

15. How to exercise your rights

To exercise your rights, or to ask a question about how we handle your information, contact our Data Protection Lead, Jayne Denton, Director, by email at [email protected], by telephone on +44 7900 168997, or by post at Ravenstone Wellness Ltd, 140 Lee Lane, Bolton, England, BL6 7AF.

We may need to verify your identity before responding, particularly where a request concerns health information. We will normally respond within one month. If a request is complex we may extend that by up to two further months, and we will tell you within the first month if we need to.

There is no charge for making a request.

16. Complaints

If you have concerns about how we have handled your personal information, please contact us first so that we can look into it.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator. You can reach them at www.ico.org.uk, on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Complaining to us first is not a condition of complaining to the ICO, and you can go straight to them if you prefer.

17. Data breaches

If we become aware of a personal data breach we will investigate it promptly and take steps to contain and remedy it. Where the law requires it, we will notify the Information Commissioner's Office within 72 hours, and we will tell affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.

18. Changes to this Privacy Notice

We may update this notice from time to time to reflect changes in our services, our technology, the law, or how we process personal information. The version published on our website is always the current one, and the date at the top of this notice shows when it was last updated. Where a change is significant we will tell you directly.

19. Contact us

If you have any questions about this notice or about how we handle your personal information, contact Ravenstone Wellness Ltd at 140 Lee Lane, Bolton, England, BL6 7AF, by email at [email protected], or by telephone on +44 7900 168997.

Our Data Protection Lead is Jayne Denton, contactable at [email protected].