Privacy Policy | Ph. Health Studios Derby
Privacy policy

Your information, looked after.

What we collect, why we need it, and the choices you have. Last updated 15 October 2026.
At a glance
We never sell your dataWe do not sell or rent your personal information to anyone.
Who we share with ›
Marketing only if you say yesWe only send health tips and offers if you opt in, and you can stop them any time.
Sign-ups and marketing ›
Health details stay confidentialClinical information is kept in a secure records system, not on general website forms.
Keeping it secure ›
You stay in controlAsk to see, correct or delete your information, or object to how we use it.
Your rights ›
This notice explains how Ph. Health Studios (“Ph.”, “we”, “us” or “our”) collects and uses your personal information, and the rights you have over it. It sits alongside the professional and clinical confidentiality duties we already owe you.

1Who we are

Ph. Health Studios is the data controller for personal information collected through this website and in the course of delivering our services.
Registered nameZSPharm Ltd
Trading asPh. Health Studios
AddressThe Old Surgery, 5 Tufnell Gardens, Derby, DE22 4DY

2What this notice covers

This notice applies when you:
  • browse or use our website;
  • submit an enquiry, application or sign-up through an online form;
  • book an appointment through our online booking system; or
  • contact us by email, phone or other channels.

3What we collect

Identity and contact detailsName, date of birth, address, email and telephone number.
Appointment and service detailsAppointment type, booking details, correspondence and notes about your enquiry.
Health informationLimited clinical information you choose to give us, such as relevant conditions, medicines or symptoms. This is special category data and is given extra protection.
Technical and usage dataIP address, device and browser type, time zone, and how you use our website, including through cookies and similar technologies.
We aim to collect as little health information as possible through general website forms. Detailed clinical information is normally collected in our secure clinical record system or during your consultation.

4Where it comes from

  • Directly from you, for example through forms, bookings, emails and calls.
  • From the technical systems that run this website, such as analytics tools and security logs.
  • Where relevant, from other healthcare professionals or services, with your knowledge or where we are legally permitted or required to receive it.

5Booking and clinical records

When you book online, your booking is handled by Acuity Scheduling, the booking platform built into our website. Your clinical records are kept in WriteUpp, a secure clinical records platform.
Both process your information on our instructions as our data processors. We remain responsible for how your information is used, and we have written data processing agreements in place.

6Article sign-ups and marketing

Some of our articles ask you to sign up to keep reading. When you do, we collect your first name, your email address, the article you signed up from, and whether you would like to hear from us. These details are stored in Jotform, which runs our online forms as our data processor.
We use your name and email to give you access to our articles. We only send you health tips and offers by email if you tick the box to say yes. Every email includes a way to unsubscribe, or you can email us at any time to stop.
Your browser also remembers that you have signed up, so other articles open straight away on that device. This is stored only on your device, and clearing your browser data removes it.

7Our lawful bases

We process personal information under the UK General Data Protection Regulation and the Data Protection Act 2018 on these bases:
Article 6(1)(b)Contract
  • Registering you as a patient or client
  • Arranging and managing appointments
  • Providing the care and services you ask for
Article 6(1)(c)Legal obligation
  • Keeping accurate medical and business records
  • Meeting healthcare, tax, accounting and regulatory requirements
Article 6(1)(f)Legitimate interests
  • Answering general enquiries
  • Giving you access to our articles
  • Running, improving and securing our website and services
  • Establishing or defending legal claims
Article 6(1)(a)Consent
  • Marketing emails or texts, where required
  • Non-essential cookies, where required
Where we rely on legitimate interests, we balance them against your rights and expectations and limit what we use. You can withdraw consent at any time (see section 14).
For health information, we rely on Article 9(2)(h), which covers medical diagnosis and the provision of health care or treatment, and, in limited emergencies where you cannot give consent, Article 9(2)(c) to protect your vital interests, together with the relevant provisions of the Data Protection Act 2018.

8Why we use it

  • To provide consultations, assessments, prescriptions and follow-up.
  • To manage bookings, changes, cancellations and reminders.
  • To respond to enquiries and communicate with you about our services.
  • To keep accurate clinical and business records.
  • To run, maintain and secure our website and IT systems.
  • To meet our professional, legal and regulatory requirements.
  • Where you have opted in, to send you information about our services or events.

9Who we share it with

We do not sell or rent your personal information to anyone.
Where necessary and lawful, we may share it with:
  • Our service providers, acting as data processors under contract, including Acuity Scheduling (booking), WriteUpp (clinical records), Jotform (online forms), Squarespace (website hosting), and our email, SMS, IT support, analytics, security, payment and document storage providers.
  • Other healthcare professionals, such as your NHS GP or a specialist, where this is necessary for your care, with your knowledge, or where we are legally required to.
  • Regulators, insurers, professional bodies, law enforcement or courts, where we are legally required to, where it is necessary to establish, exercise or defend legal claims, or to address safeguarding concerns or a serious risk of harm.
Everyone we share with must keep your information secure and use it only on our written instructions and for the purposes we have set.

10Transfers outside the UK

Some of our service providers may store or process information outside the UK. When this happens, we make sure it is properly protected, for example by using countries the UK recognises as providing adequate protection, or UK-approved standard contractual clauses or equivalent safeguards. Details are available on request.

11How long we keep it

We keep personal information only for as long as we need it to care for you and manage our relationship with you, to meet legal, regulatory, tax and accounting requirements, and to establish or defend legal claims.
Clinical records are kept in line with healthcare record-keeping guidance and legal limitation periods. Enquiries and sign-ups made through the website are kept for a shorter time and deleted or anonymised when no longer needed.

12Keeping it secure

We use appropriate technical and organisational measures to protect your information, including:
  • role-based access controls and secure sign-in;
  • secure clinical systems and encrypted transmission where appropriate;
  • regular backups and security monitoring;
  • confidentiality and data protection training; and
  • procedures for responding to suspected data breaches.
If a breach is likely to put your rights and freedoms at risk, we will act in line with the law, including telling you and, where required, the Information Commissioner’s Office (ICO).

13Cookies and your device

Our website may use cookies and similar technologies to make the site work, remember your preferences, and collect combined statistics about how the site is used.
Where the law requires it, we will ask for your choices when you first visit and record them. You can also set your browser to refuse cookies, although some parts of the site may not work properly if you do.

14Your rights

Subject to some conditions and exemptions in law, you have the right to:
AccessFind out whether we hold your information and get a copy.
CorrectionHave inaccurate or incomplete information put right.
DeletionAsk us to delete it where we no longer have a lawful reason to keep it.
RestrictionAsk us to limit how we use it in certain circumstances.
ObjectionObject to use based on legitimate interests, and to marketing at any time.
PortabilityReceive certain information in a common format, or have it sent to another organisation.
Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did with your consent before you withdrew it.
To use any of these rights, email hello@phderby.com. We may need to confirm your identity before we respond.

15Complaints

If you are unhappy with how we have handled your information, please contact us first so we can try to put it right.
You also have the right to complain to the UK’s data protection regulator:
Information Commissioner’s Office (ICO)ico.org.uk · Helpline 0303 123 1113

16Changes to this notice

We may update this notice to reflect changes in the law, our services or how we handle information. Any update will be published on this page with a new “last updated” date.
Last updated 15 October 2026
Book an appointment