Privacy Notice

Created By: Muhammad Arslan Akhtar

Last Updated: 01/09/2026

“EveryClinic”, “we”, “our”, “us” is a UK-based digital healthcare technology company that operates an online healthcare platform designed to help patients discover, search for, and book healthcare services provided by independent clinics and healthcare providers.

The EveryClinic platform enables patients to search for healthcare services and specialists, view information about available clinics and services, create and manage accounts, make appointments, communicate with EveryClinic, and make payments for bookings through our authorised payment provider. The platform also supports healthcare clinics and providers by enabling them to list and manage their services, receive bookings, and manage information required for the operation of the platform.

EveryClinic acts as a Data Controller in relation to the personal data that it processes for the operation and administration of the EveryClinic platform, including account information, booking information, payment-related information, communications, website and platform usage information, and other information collected in connection with the services we provide.

EveryClinic does not collect, store or maintain patients' clinical records, consultation notes, diagnoses, treatment histories, medication records or other clinical health information. Information relating to the healthcare service, specialty or appointment selected by an individual may indicate or allow an inference about an individual's healthcare needs. Where clinical or health information is required for the provision of healthcare, this is provided directly to the selected Clinic or healthcare provider, which is responsible for its own processing as an independent Data Controller.

The Clinic or healthcare provider with whom a patient books an appointment remains responsible for the personal and health data it processes for the purposes of providing healthcare and delivering clinical care. Such Clinic or healthcare provider may therefore act as a separate Data Controller and may have its own privacy notice. Patients should refer to the relevant Clinic's privacy notice for information about how their clinical records, consultation information, treatment history, and other healthcare information are processed.

EveryClinic is committed to protecting the confidentiality, integrity, and security of personal data and to complying with applicable UK data protection and privacy legislation, including:

• UK General Data Protection Regulation (UK GDPR);
• Data Protection Act 2018;
• applicable requirements and guidance issued by the Information Commissioner's Office (ICO); and
• other applicable legal and regulatory requirements relating to the protection and processing of personal data.

This Privacy Notice explains how EveryClinic collects, uses, stores, protects, and shares personal data when individuals use the EveryClinic website, application, and related services. It also explains the circumstances in which information may be shared with healthcare providers, payment providers such as Stripe, technology and cloud service providers, and other third parties where necessary to operate the platform, provide the requested services, comply with legal obligations, or protect the rights and security of EveryClinic and its users.

This Privacy Notice applies specifically to personal data processed by EveryClinic Ltd in connection with the EveryClinic platform. It does not replace or override the privacy notice of a Clinic or healthcare provider in relation to personal or health information that the Clinic processes for the purpose of providing healthcare.

The following terms and abbreviations are used throughout this Privacy Notice:

EveryClinic Ltd (“EveryClinic”, “we”, “our”, or “us”) is a company incorporated in the United Kingdom that operates the EveryClinic digital healthcare platform. EveryClinic provides an online platform through which individuals can discover healthcare services and healthcare providers, access information about available services, create and manage accounts, make and manage appointments, communicate with healthcare providers and EveryClinic, and make payments for services where applicable.

EveryClinic works with clinics, healthcare professionals, and other healthcare providers that offer their services through the EveryClinic platform. EveryClinic provides the technology and platform infrastructure that facilitates interactions between users and healthcare providers but does not itself provide medical diagnosis, treatment, or other clinical care unless expressly stated otherwise.

For the purposes of data protection legislation, EveryClinic Ltd acts as a Data Controller in respect of the personal data that it processes in connection with the operation and provision of the EveryClinic platform and its services. This means that EveryClinic determines the purposes for which, and the manner in which, such personal data is processed and is responsible for ensuring that such processing complies with applicable data protection legislation.

Healthcare providers using the EveryClinic platform may separately determine the purposes and means of processing personal and health information for the provision of healthcare services. Where a healthcare provider acts as an independent Data Controller, its processing activities may be governed by its own privacy notice and data protection responsibilities.

Our Contact Details

EveryClinic Ltd is the organisation responsible for the processing of personal data described in this Privacy Notice.

Company: EveryClinic LtdCountry: United Kingdom

Address: 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United KingdomContact: support@everyclinic.co.uk

We respect your privacy and are committed to collecting and processing personal data that is necessary to operate the EveryClinic platform, provide and administer our services, facilitate bookings between patients and healthcare providers, communicate with you, process payments, maintain the security of our platform, and comply with our legal and regulatory obligations.

The information we collect depends on how you use the EveryClinic platform and whether you use the platform as a patient, Clinic, healthcare provider, or other authorised user.

When you create an account, search for healthcare services, make a booking, or otherwise use the EveryClinic platform, we may collect the following information:

Account details, including:

• Full name;
• Date of birth;
• Gender;
• Email address;
• Phone number; and
• Password.

Your password is stored securely and is not stored in plain text.

Booking details, including:

• Appointment date and time;
• Clinic or healthcare provider selected;
• Healthcare service selected; and
• Booking reference and booking status.

Payment-related data: When you make a booking requiring payment, payment is processed through our authorised payment provider, Stripe. Stripe processes the payment-card details required to complete the transaction. EveryClinic does not store full payment-card numbers or other payment-card details. EveryClinic may retain the payment amount and the Stripe PaymentIntent ID where necessary to administer and reconcile the relevant transaction.

When a Clinic or healthcare provider registers with or uses the EveryClinic platform, we may collect information relating to the Clinic and individuals associated with the Clinic.

This may include:

• Business details;
• Registration details;
• Insurance information;
• Practitioner details; and
• Booking and attendance records required to calculate and administer commission.

Where information relates to an identifiable individual, such as a healthcare professional, practitioner, clinic owner, administrator, or other representative of a Clinic, that information may constitute personal data under the UK GDPR and will be processed in accordance with this Privacy Notice.

When you make a booking, EveryClinic shares the information necessary to administer the booking with the selected Clinic or healthcare provider. This may include your name, date of birth, gender, email address, telephone number, appointment date and time, service booked and booking reference

The Clinic or healthcare provider acts as an independent Data Controller for the information it receives and for any subsequent healthcare or clinical processing it undertakes.

To facilitate and administer payments, including recording payment amount and payment intent information, while payment-card details are processed by Stripe.

EveryClinic does not ordinarily collect or store patients' clinical records, consultation notes, diagnoses, treatment histories, medication records or other detailed clinical health information. However, information such as the healthcare service, specialty or appointment selected may in some circumstances reveal or allow an inference about an individual's health. Where such information constitutes Special Category Data under Article 9 of the UK GDPR, EveryClinic will identify and document the applicable Article 9 condition in addition to the relevant Article 6 lawful basis. Where detailed clinical information is required for healthcare provision, it is provided directly to the selected Clinic or healthcare provider.

EveryClinic does not collect, store or maintain patients' clinical records, consultation notes, diagnoses, treatment histories, medication records or other clinical healthcare records.

Information relating to the healthcare service or appointment selected by an individual may nevertheless indicate or allow an inference about the type of healthcare service they are seeking. Such information is processed by EveryClinic only for the purposes necessary to operate and administer the platform.

Where a patient provides clinical or health information directly to a Clinic or healthcare provider, that information is processed by the Clinic or healthcare provider as an independent Data Controller and is subject to its own privacy and confidentiality arrangements.

We aim to collect only the personal data that is necessary for the purposes described in this Privacy Notice. We process personal data only where we have an appropriate lawful basis under applicable data protection legislation.

We apply appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, misuse, or disclosure.

Our technical and organisational security measures include appropriate access controls, authentication, encryption, monitoring, secure deletion and incident-response arrangements. The detailed internal security requirements supporting these measures are maintained in the EveryClinic Master Security Controls Document.

We use the personal data we collect to operate and provide the EveryClinic platform, facilitate healthcare bookings, communicate with users and healthcare providers, process payments, maintain platform security, and comply with our legal obligations.

We may use your personal data to:

• Create and manage your account and provide access to the EveryClinic platform.
• Facilitate and manage appointments, including sharing necessary booking information with the relevant Clinic or healthcare provider.
• Process payments, refunds and commissions through our authorised payment service providers.
• Communicate with you about your account, bookings, payments, enquiries, support requests, and other services.
• Improve and maintain the Platform, including analysing searches, usage and technical information.
• Maintain security and prevent fraud, misuse or unauthorised access to the Platform.
• Manage our relationship with Clinics and healthcare providers, including verifying relevant business, registration, insurance and practitioner information.
• Manage reviews, feedback and complaints submitted through the Platform.
• Comply with legal and regulatory obligations and establish, exercise or defend our legal rights.

Where information processed by EveryClinic constitutes Special Category Data, including health-related information, we will process it only where an appropriate lawful basis under Article 6 and an applicable condition under Article 9 of the UK GDPR apply.

We will not use your personal data for purposes that are incompatible with those described in this Privacy Notice unless permitted by applicable data protection law.

EveryClinic processes personal data only where there is a lawful basis under Article 6 of the UK GDPR. Depending on the purpose of processing, we may rely on one or more of the following lawful bases:

• Performance of a contract: Where processing is necessary to provide our services, manage your account, facilitate bookings, or process payments.
• Legitimate interests: Where processing is necessary for our legitimate business interests, such as maintaining and improving the Platform, ensuring security, preventing fraud, and managing our business, provided that these interests do not override your rights and freedoms.
• Legal obligation: Where processing is necessary for us to comply with a legal or regulatory obligation.
• Consent: Where we have obtained your consent to process your personal data for a specific purpose. You may withdraw your consent at any time where consent is the lawful basis relied upon.
• Vital interests: Where processing is necessary to protect an individual's vital interests in circumstances permitted by applicable law. This basis is not expected to be routinely relied upon by EveryClinic.

Special Category Data

Where we process Special Category Data, including information concerning health, we will also ensure that an appropriate condition under Article 9 of the UK GDPR applies in addition to an Article 6 lawful basis.

We will only process such information where it is necessary and permitted under applicable data protection legislation.

EveryClinic retains personal data only for as long as is necessary to fulfil the purposes for which it was collected and processed, to comply with applicable legal, regulatory and accounting requirements, to maintain appropriate business and operational records, to resolve disputes, to prevent and investigate fraud or misuse, and to establish, exercise or defend legal claims.

EveryClinic applies the UK GDPR storage limitation principle. We do not retain personal data indefinitely or for longer than is necessary for the relevant processing purpose. Retention periods are determined having regard to the nature and sensitivity of the information, the purpose for which it is processed, applicable legal and regulatory requirements, the potential impact on individuals, and EveryClinic's legitimate operational and legal requirements.

Our standard retention periods are set out below. Where a specific legal, regulatory or other lawful requirement requires information to be retained for a longer or shorter period, that requirement will take precedence. Where personal data is no longer required, it will be securely deleted or irreversibly anonymised, subject to any lawful requirement to retain it.

• Active account information: retained for as long as the account remains active and the information is necessary to provide and administer the EveryClinic service.
• Closed account information: retained for up to 6 years following account closure where necessary for contractual, legal, regulatory, fraud-prevention, dispute-resolution or other documented purposes. Only information that remains necessary for those purposes will be retained.
• Booking and appointment records: retained for up to 6 years from the date of the relevant booking where necessary for booking administration, commission and financial administration, dispute resolution, fraud prevention, contractual or legal claims, regulatory requirements, or maintaining an appropriate audit trail.
• Payment and transaction records: retained for up to 6 years from the relevant transaction where necessary for payment administration, refunds, chargebacks, commissions, accounting, tax, financial reporting, dispute resolution, fraud prevention or legal claims. EveryClinic does not store full payment card numbers.
• Marketing consent records: retained for as long as necessary to demonstrate and manage an individual's marketing preferences and compliance with applicable data protection and electronic marketing requirements. Where appropriate, records may be retained for a defined period following withdrawal or expiry of consent to demonstrate compliance or resolve potential complaints or disputes.
• Marketing suppression and opt-out information: minimal information may be retained for as long as necessary to respect an individual's marketing preferences and prevent unwanted marketing communications.
• Support and complaint records: retained for up to 6 years following closure of the relevant matter where necessary to manage the matter, demonstrate how it was handled, resolve disputes, comply with legal or regulatory requirements, or establish, exercise or defend legal claims.
• Reviews and user-generated content: reviews may remain available for the duration of the relevant Clinic's listing or until removed in accordance with applicable moderation or content-management processes. Associated personal data will be retained only for as long as necessary for the relevant purpose, subject to applicable legal, regulatory or dispute-resolution requirements.
• Clinic verification and compliance records: retained for up to 6 years following termination of the relevant Clinic Agreement where necessary to demonstrate verification and compliance activities, manage contractual or legal matters, prevent fraud, resolve disputes, or comply with applicable requirements.
• Analytics and usage data: generally retained for up to 14 months where necessary for platform operation, performance analysis, service improvement, security or other documented purposes, after which it will be deleted or anonymised unless continued retention is necessary.
• Security and access logs: generally retained for up to 12 months for security monitoring, incident investigation, fraud prevention, audit and compliance purposes. A longer period may apply where necessary in connection with an identified security incident, investigation, legal claim or regulatory matter.
• Encrypted backups: information deleted from live systems may remain in encrypted backups for a limited rolling period of up to 35 days before being permanently overwritten. Backup copies are subject to appropriate security and access controls and are not used for routine processing.

EveryClinic operates as a digital healthcare booking platform and does not ordinarily receive or retain patients' full clinical records, consultation notes or treatment histories.

Where a patient books an appointment with a Clinic or healthcare provider, the relevant Clinic or healthcare provider may process and retain clinical and health information for the purposes of providing healthcare. Where that Clinic or healthcare provider acts as an independent Data Controller, it is responsible for determining and applying the retention periods applicable to the clinical and healthcare records that it holds.

Healthcare providers may be subject to specific healthcare-record retention requirements, professional obligations and information-governance requirements, including applicable NHS England records-management requirements where relevant. Patients should refer to the relevant healthcare provider's privacy notice for information about the retention of their clinical records.

EveryClinic periodically reviews the personal data it holds to determine whether it remains necessary for the purpose for which it was collected or for another lawful and documented purpose.

Where personal data is no longer required, EveryClinic will securely delete it or irreversibly anonymise it, subject to any applicable legal, regulatory, contractual or other lawful requirement to retain it.

Where personal data is relevant to an ongoing complaint, investigation, legal claim, regulatory matter, audit or other lawful preservation requirement, deletion may be suspended until the matter has been resolved or the information is no longer required.

Where appropriate, automated systems may be used to identify information approaching the end of its applicable retention period and support deletion or anonymisation.

Individuals may request the deletion of their personal data where they have a right to erasure under applicable data protection legislation.

The right to erasure is not absolute. EveryClinic may retain information where there is a lawful basis or legal requirement to do so, including where retention is necessary to comply with a legal obligation, establish, exercise or defend legal claims, prevent fraud, resolve disputes, or maintain appropriate records.

Where a deletion request is accepted, EveryClinic will delete or anonymise the information that is no longer required, while retaining only the minimum information necessary where a lawful retention requirement applies.

Some of our service providers may process personal data outside the UK. Where a restricted international transfer takes place, EveryClinic will use an appropriate lawful transfer mechanism and safeguards in accordance with applicable UK data protection law. Further information is available in our International Data Transfer Policy.

EveryClinic takes the security of personal data seriously and maintains appropriate technical and organisational measures to prevent, detect, and respond to personal data breaches. These measures are supported by the EveryClinic Master Security Controls Document, which sets out the detailed internal security requirements, responsibilities and evidence expectations applicable to the EveryClinic platform.

In the event of a personal data breach, we will assess the nature and severity of the breach and take appropriate steps to contain, investigate, and remediate it. Where required by the UK GDPR, EveryClinic will notify the Information Commissioner's Office (ICO) of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a personal data breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also notify the relevant individuals without undue delay, where required by applicable data protection law.

Where a breach involves information shared with or processed by a Clinic or one of our third-party service providers, we will work with the relevant organisation to investigate and manage the incident and fulfil any applicable notification and cooperation obligations.

We will maintain appropriate records of personal data breaches and the actions taken in response, as required by applicable data protection legislation.

We may update this Privacy Notice from time to time to reflect changes to our services, data processing activities, legal or regulatory requirements, or our privacy and security practices.

Where we make changes, we will update the “Last Updated” date at the beginning of this Privacy Notice. Where appropriate, we may also notify you of significant changes through the EveryClinic Platform, by email, or through other suitable means.

We encourage you to review this Privacy Notice periodically to remain informed about how we collect, use, store, and protect your personal data.

Any changes will become effective when the updated Privacy Notice is published, unless a different effective date is stated.

If you have any questions about this Privacy Notice, how we process your personal information, or wish to exercise your data protection rights, please contact us:Data Protection Officer: Lakhbir DhillonEmail: dataprotection@everyclinic.com

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.

Information Commissioner's Office (ICO)Website: https://ico.org.uk