Last updated: 27 October 2026
1. Who is responsible?
Purnell Health and Wellness Ltd is the data controller for clinic enquiries and the information it decides to process. Registered in England and Wales, company number 17356586. Registered office: 74 High Street, Northallerton, North Yorkshire, DL7 8EG. Clinic: 3 Market Row, Barkers Arcade, Northallerton, DL7 8LN.
Contact Harry Lewis-Purnell about privacy at hello@purnellhealth.co.uk, or write to the registered office marked “Private and Confidential — Privacy”.
2. What this notice covers
This notice covers the public website, general enquiries and links to our Jane online booking page. This website does not store patient records. Bookings, intake forms and clinical records are handled separately in the clinic's Jane account.
For information about your clinical records, their retention or how booking information is used, please read the clinic's patient privacy information in the intake process or contact us using the details above.
3. Information we collect
- Enquiries: your email address, name if supplied, message and related correspondence when you contact us. Please do not send detailed medical records by ordinary email.
- Technical information: IP address, browser/device details, request time and requested URL may be processed by hosting, delivery and security services to deliver and protect the site.
- Privacy preferences: the optional categories you allow, the policy version and time of your choice are stored in your browser for up to 180 days.
- Exercise videos: no video provider is contacted until you permit external media and press play. At that point YouTube/Google receives technical information under its own privacy terms.
The body-map selections, exercise filters and search terms stay in the current page's memory. They are not saved by the application, placed in the URL, sent to the clinic or sent to analytics. The site has no public medical-history form.
4. Purposes and lawful bases
For ordinary general enquiries and site security, the usual basis is legitimate interests (UK GDPR Article 6(1)(f)): responding to people who contact the clinic and operating a secure, useful website. You may object to processing based on legitimate interests. Where a specific legal duty requires processing, Article 6(1)(c) applies. Optional analytics and media use your consent where required, and refusal does not prevent access to the main site.
Health information has additional protection. The public site does not ask you to submit health information. If it is needed to assess or provide healthcare, an appropriate Article 6 basis and a special-category condition must both apply. For a regulated healthcare professional providing care under confidentiality obligations, Article 9(2)(h), together with the Data Protection Act 2018 Schedule 1, Part 1, paragraph 2, may apply. This is distinct from your consent to examination or treatment. We do not treat an unsolicited email as permission for marketing or unrelated use of health information.
5. Providers and sharing
Information may be handled by necessary email, website hosting/delivery, security and professional service providers. The site is hosted through Sites and delivered using Cloudflare infrastructure. Clinic email uses Google Workspace. Information is not sold. Information may be disclosed where lawfully required, for safeguarding or to establish, exercise or defend legal claims, subject to the relevant confidentiality and data-protection requirements.
Online booking is provided through our Jane booking page. Following a booking link takes you to the clinic's separate Jane account, where the relevant privacy information and service terms are available. Rehab My Patient is planned for prescribed exercise programmes. Public video demonstrations are not a patient-data integration. Private programme links are sent through the prescribing service, not published in this library.
Email and hosting providers may process information internationally depending on the service and configuration. Provider-specific processing locations, contractual terms and any UK adequacy or other transfer safeguards need to be confirmed in the clinic's provider records. Contact us for current information; this notice does not claim a particular international-transfer arrangement has been verified.
6. Retention
- General enquiries: the existing clinic policy is to review and normally delete them within 12 months of the last contact, unless a legal or professional reason justifies longer retention.
- Privacy choices: retained in this browser for up to 180 days or until you clear site storage. A new choice replaces the old one.
- Security/hosting records: provider-specific retention remains subject to the applicable provider configuration and the clinic's review; no unverified fixed period is stated here.
- Patient records in Jane: these are covered by the clinic's patient privacy information supplied through the intake process. Contact us if you need a copy or have questions about retention.
7. Planned premises camera
A reception and entrance camera is planned for security and safety. The published arrangement is video only, with audio disabled, and no treatment-room or toilet monitoring. Signage must be displayed before activation. When active, footage will normally be retained for 14 days unless a relevant clip is preserved for a documented incident, claim or legal requirement. This is a planned arrangement, not confirmation that recording is active.
8. Cookies, media and analytics
Google Analytics is not currently connected. No Google Analytics tag is loaded by this version of the website. No advertising pixels, remarketing tags or user-ID feature are used. External videos remain optional. See the Cookie Policy or .
9. Security and your choices
The site is intended to be accessed over HTTPS. Public educational resources do not require an account, and the application does not store patient records. Please avoid putting sensitive information in ordinary email or public social-media messages. No online service can guarantee complete security.
External links take you to separate services whose notices and settings apply. You can read the main information without enabling videos or optional analytics.
10. Your rights
Depending on the circumstances, you can request access, correction, erasure, restriction, portability, or object to processing. Rights are not absolute; professional or legal duties may require certain records to be retained. You can withdraw optional consent at any time without affecting the lawfulness of earlier processing. We do not make solely automated decisions about your care through this site.
Email hello@purnellhealth.co.uk to make a request. We may need proportionate information to verify your identity. We will explain any relevant limitations and respond within the applicable legal time limit.
You may complain to the Information Commissioner's Office ↗. You do not have to contact us first, although we welcome the opportunity to address a concern.