The Bespoke Clinic Privacy Policy
Last updated: 15th September 2026
The Bespoke Clinic is committed to protecting your privacy and ensuring that any personal data we collect is handled in a safe, transparent, and legally compliant way. This policy explains what personal information we collect, how we use it, and your rights in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
The Bespoke Clinic (“we”, “us”, or “our”) is a private healthcare and wellbeing clinic based at 51 Osborne Road, Jesmond, Newcastle upon Tyne, NE2 2AH. Our website address is: https://thebespokeclinic.uk
The Bespoke Clinic is the data controller for the personal information we hold about you. This means we decide how and why your data is used, and we remain responsible for it, including when it is stored on systems provided by third parties.
For all data protection matters, you can contact us at: hello@thebespokeclinic.uk
2. What Data We Collect
We collect and process the following types of personal data:
- Full name and date of birth
- Contact information (email address, phone number, address)
- Medical history, symptoms, treatment notes, and other health-related data
- Appointment and consultation records
- Payment or billing information (if applicable)
- Any communication sent to us via email, contact forms, or during consultations
We may also collect anonymised data from our website for analytics purposes.
3. How We Collect Your Data
We collect your data directly when:
- You book an appointment or consultation
- You fill in a contact form or questionnaire on our website
- You provide medical history before or during your appointment
- You communicate with us via phone, email, or in person
Appointment bookings, patient records and related information are managed using Carebit, our secure practice management system.
4. How We Use Your Data
We use your personal data to:
- Provide you with healthcare, wellbeing, and aesthetic services
- Review your medical history and assess treatment suitability
- Schedule appointments and manage your bookings via Carebit
- Send appointment reminders, forms and follow-ups
- Take payment for appointments and treatments
- Respond to enquiries or customer service requests
- Comply with medical, legal, or regulatory obligations
We will never sell or trade your personal data.
5. Sharing Your Data
We may share your personal and medical data with the following, only when necessary:
- Carebit Health Ltd, our practice management platform, used for bookings, patient records, clinical notes, forms, communications and payments. Carebit acts as a data processor on our behalf and only uses your data in line with our instructions. You can read more about how Carebit handles your data in their Privacy Policy.
- Third-party laboratory providers for processing tests or diagnostic results, with your consent
- Pharmacies and prescribing services, where needed to issue or fulfil a prescription
- Regulatory authorities or professional bodies, where legally required
All third-party processors are UK GDPR-compliant and contractually bound to safeguard your data.
6. Where Your Data Is Stored
Your records are stored in secure UK data centres. If any of our providers need to process data outside the UK, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the International Data Transfer Agreement, so your data receives the same level of protection.
7. Lawful Basis for Processing
We process your personal data under one or more of the following lawful bases:
- To fulfil a contractual obligation (e.g. providing treatment or appointments)
- To comply with a legal obligation (e.g. medical record retention)
- Our legitimate interest in managing and improving our services
- Your consent, where we ask for it (e.g. sharing results with a third party)
Because health information is a special category of data, we also rely on the following condition: it is necessary for the purposes of medical diagnosis and the provision of health care or treatment (UK GDPR Article 9(2)(h)), carried out by or under the responsibility of a registered health professional.
8. How Long We Keep Your Data
We retain your personal data only for as long as necessary to:
- Provide our services to you
- Fulfil legal, regulatory, and medical record-keeping obligations
For medical records, we typically retain data for a minimum of 8 years following your last appointment, in line with healthcare guidance.
9. Your Rights Under UK GDPR
You have the right to:
- Access a copy of your personal data
- Request corrections to any inaccurate information
- Request the erasure of your data (in some circumstances)
- Object to processing or restrict how we use your data
- Withdraw your consent at any time (if we rely on it)
- Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk
To exercise any of these rights, contact us at hello@thebespokeclinic.uk
10. How We Protect Your Data
We store your data securely on encrypted systems and restrict access to authorised personnel only. We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, or misuse.
11. Website & Cookies
We collect anonymised data via cookies to improve the functionality of our website and monitor traffic. For full details, please visit our Cookie Policy.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The latest version will always be available on our website, with the effective date shown at the top.
In September 2026 we moved our practice management system from Semble to Carebit. This policy has been updated to reflect that change.
Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please email us at: hello@thebespokeclinic.uk
