Clinic Information & Client Policies

Your Wellbeing Clinic provides planned, non-emergency clinical services only. We are not equipped to respond to medical emergencies, and we do not operate an emergency or out-of-hours urgent care service.

If you or someone around you is experiencing a medical emergency, do not contact the clinic — call 999 or go to your nearest Accident and Emergency (A&E) department immediately.

A medical emergency includes, but is not limited to:

• Chest pain, pressure, or tightness — particularly if spreading to the arm, jaw, or neck
• Symptoms of a stroke — facial drooping, arm weakness, speech difficulty (remember: F.A.S.T.)
• Difficulty breathing or sudden shortness of breath
• Loss of consciousness or unresponsiveness
• Severe allergic reaction (anaphylaxis)
• Suspected overdose or poisoning
• Uncontrolled or serious bleeding
• Sudden severe headache unlike any previously experienced
• Seizures in someone without a known seizure condition
• Any situation where you believe a life may be at risk

For urgent but non-life-threatening concerns when the clinic is closed — for example, a sudden illness that cannot wait until your next available appointment — call 111 or visit 111.nhs.uk. The NHS 111 service operates 24 hours a day, 7 days a week, and will advise you on the most appropriate next steps.

If in doubt, always call 999. It is always better to call and not need emergency services than to wait and need them.

Chaperone Policy

Your Wellbeing Clinic is committed to providing care that respects your privacy, dignity, and your religious and cultural beliefs at all times.

Your right to a chaperone You are entitled to have a chaperone present during any consultation, examination, or procedure. You do not need to give a reason for asking. You are welcome to bring a person of your own choosing — such as a family member or trusted friend — to accompany you and act in this role.

Intimate examinations Intimate or sensitive examinations will only ever be carried out with your express consent. If you would prefer not to proceed without a chaperone present, we will always offer to reschedule your appointment to a time that allows you to arrange one.

Please note We are not currently able to provide a member of trained clinic staff as a chaperone on your behalf. We recognise this is important and are working to make this provision available as soon as possible. In the meantime, we would encourage any patient who feels they may need a chaperone to arrange for a person they trust to accompany them, and to let us know when booking.

If you have any questions or concerns, please speak to a member of our team or contact us at wecare@yourwellbeingclinic.co.uk.

Client Charter

Our commitment to you — and what we ask in return

Your Wellbeing Clinic is a CQC-registered integrated health and wellbeing clinic based in Calne, Wiltshire. We provide a range of private clinical services — from rapid access assessments and general health checks to specialist clinics, aesthetics, and mental wellbeing support.

This charter sets out what you can expect from us when you use our services, and what we ask of you in return. It is underpinned by our commitment to treating every client with dignity, respect, and clinical excellence.

Contacting and Visiting Us

Opening hours

The clinic operates Monday to Saturday with variable hours. Current appointment availability — including our Saturday Rapid Access clinic — is always visible when booking online. Please check our website or contact reception for the latest session times.

For the most up-to-date opening hours and appointment availability, visit:

www.yourwellbeingclinic.co.uk

How to book an appointment

Appointments can be booked in the following ways:

• Online via our booking portal at www.yourwellbeingclinic.co.uk
• By telephone — please see the website for our current contact number

When booking, please give us as much information as you can about the reason for your visit. This helps us allocate the right clinician, the right appointment length, and ensure any equipment or preparation required is in place before you arrive.

If you need to cancel or reschedule

We ask that you give us as much notice as possible if you are unable to attend. Appointments cancelled with less than 24 hours' notice, or missed without notice, may be subject to a cancellation charge. This allows us to offer the slot to another client who may need it.

Urgent and emergency care

Your Wellbeing Clinic provides planned, non-emergency clinical services only. In a medical emergency — including chest pain, stroke symptoms, difficulty breathing, loss of consciousness, or any situation where a life may be at risk — call 999 or go to your nearest A&E immediately. Do not contact the clinic.

This applies at all times, including during clinic hours.

For urgent but non-life-threatening concerns when the clinic is closed, call 111 or visit 111.nhs.uk, available 24 hours a day. For a full list of symptoms that require emergency care, please see our Emergency Care guidance on our website.

Your Care

Informed consent

We will always explain your clinical options, the benefits and risks of any proposed treatment, and any alternatives available before proceeding. No examination, investigation, or treatment will take place without your informed consent. You have the right to decline or withdraw consent at any time.

Second opinions

You are entitled to seek a second opinion about your diagnosis or proposed treatment at any time. Please speak to your clinician or contact reception — we will support you in doing so without any impact on the care we provide.

Chaperones

You are entitled to have a chaperone present during any consultation or examination. You are welcome to bring a person of your own choosing. Please let us know when booking if you would like a chaperone arranged so we can make suitable provision. Full details are set out in our Chaperone Policy, available on our website.

Clinician preferences

If you have a preference for a particular clinician, please let us know when booking. We will do our best to accommodate your request, although availability may affect how quickly you can be seen.

Children and young people

Clients aged 16 and over may book and attend appointments independently. Clients under 16 are welcome to attend with a parent or guardian. In some circumstances, a clinician may see a young person under 16 without a parent or guardian present where it is clinically appropriate and in the young person's best interests.

Fees and Payments

Your Wellbeing Clinic is a private clinic. Fees apply to all consultations, treatments, and investigations unless otherwise stated. Current pricing is available on our website and will always be confirmed to you before treatment begins. We will never proceed with chargeable treatment without your prior agreement.

Some services — such as medical reports for insurance or legal purposes — may carry an additional administrative charge. We will advise you of any such charges in advance.

We are not an NHS service. If you are registered with an NHS GP, your clinical records at Your Wellbeing Clinic are separate from your NHS records unless you have given explicit consent for information to be shared.

Your Records and Information

Confidentiality

All information you share with us is held in the strictest confidence. Your personal and clinical data will not be disclosed to any third party without your explicit consent, except in limited circumstances required by law (such as safeguarding or public health reporting obligations). Full details are set out in our Privacy Notice, available on our website.

Accessing your records

You have the right to request a copy of the personal data we hold about you at any time. To make a Subject Access Request, please contact us at wecare@yourwellbeingclinic.co.uk. We will respond within one calendar month. There is no fee for a standard request.

Transferring your records

If you wish to transfer a summary of your clinical records to your NHS GP or another provider, please let us know. We will share information with your explicit written consent. If you wish to move to a different private provider, we will facilitate the transfer of relevant clinical information as appropriate.

Accessibility and Reasonable Adjustments

We are committed to making our services accessible to everyone. The clinic has disabled parking, step-free wheelchair access through the main entrance, ground floor consultation rooms, and an accessible toilet. Full details of our accessibility provision are available on our website.

If you have a disability, communication need, or any other requirement that may affect your visit, please let us know when booking. We will do our best to make the adjustments needed to ensure your appointment is comfortable and effective. This might include longer appointment times, large-print materials, or support with communication.

Feedback and Complaints

Your feedback matters

We welcome all feedback — positive and constructive. If something has gone well, we would love to hear it. If something has not met your expectations, please tell us so that we have the opportunity to put it right.

To share feedback, please contact us at:

wecare@yourwellbeingclinic.co.uk

Making a formal complaint

If you wish to make a formal complaint, please put this in writing to the Nominated Individual, Matthew Snell, at wecare@yourwellbeingclinic.co.uk. We will acknowledge your complaint within three working days and provide a full written response within 20 working days.

If you are not satisfied with our response, you have the right to refer your complaint to:

• The Care Quality Commission (CQC): www.cqc.org.uk
• The Independent Sector Complaints Adjudication Service (ISCAS), if applicable
• The relevant professional regulatory body (e.g. the GMC for concerns about a doctor)

We are registered with and regulated by the Care Quality Commission. Our registration details are available on the CQC website at:

www.cqc.org.uk

Mutual Respect

We are committed to treating every client fairly and with respect. In return, we ask that all clients, visitors, and anyone accompanying a client treat our staff and other clients with the same courtesy.

We operate a Zero Tolerance policy in relation to violence, abuse, harassment, or discriminatory behaviour. Anyone who behaves in an unacceptable manner may be asked to leave the premises and, in serious cases, may be removed from our client list. Full details are set out in our Zero Tolerance and Respect Policy on our website.

Our CQC Registration — What It Means for You

What is the CQC?

The Care Quality Commission (CQC) is the independent regulator of health and social care services in England. Its role is to make sure that clinics, hospitals, care homes, and other healthcare providers meet national standards of safety, quality, and care. The CQC operates entirely independently of the NHS and the government — its sole purpose is to protect the interests of patients and service users.

Does every clinic need to be registered?

Yes — any provider offering regulated healthcare activities in England is required by law to be registered with the CQC. Operating without registration is a criminal offence. Registration is not automatic; it must be applied for, and the CQC will only grant it once it is satisfied that the provider meets the required standards. Not all private clinics are registered — choosing a CQC-registered provider is an important safeguard for you as a patient.

What does registration involve?

Before granting registration, the CQC carries out a substantive assessment of the service. This can include:

• Site visits to the premises
• Criminal record checks on key personnel
• Interviews with key managers
• A detailed review of how the service will be run

Only once the CQC is satisfied that the service is likely to be safe, effective, caring, responsive and well-led will registration be granted. It is a meaningful threshold, not simply an administrative step.

When was Your Wellbeing Clinic registered?

Your Wellbeing Clinic was registered with the CQC on 25 November 2025. Following registration, the CQC confirmed that it had checked the service was likely to be safe, effective, caring, responsive and well-led — the same five standards against which all regulated health services in England are assessed.

What type of service are we registered as?

The CQC has classified Your Wellbeing Clinic as an Independent Doctor service. This is a specific regulatory designation that distinguishes us from unregulated wellness centres, complementary therapy providers, or beauty clinics. It means our clinical services are formally recognised and overseen as a medical service — giving you the same regulatory protections you would expect from any regulated healthcare provider in England.

What were we assessed on?

The CQC assesses all regulated services against five key questions:

• Is it safe? — Are patients protected from harm? Are risks identified and managed?
• Is it effective? — Does care, treatment, and support achieve good outcomes?
• Is it caring? — Are patients treated with compassion, dignity, and respect?
• Is it responsive? — Are services organised around the needs of individual patients?
• Is it well-led? — Is the service well-managed, with a clear commitment to continuous improvement?

These are not tick-box questions — they inform every aspect of how the CQC evaluates a service, from the way clinical records are kept to how complaints are handled.

What services are we registered to provide?

Your Wellbeing Clinic is registered to provide the following regulated activities, covering the full range of services we offer:

• Treatment of disease, disorder or injury (RA5) — The clinical assessment and treatment services at the heart of what we do, from our Rapid Access Assessment Clinic and specialist clinics through to mental wellbeing support and pain management.
• Surgical procedures (RA7) — Procedural treatments including minor surgical interventions such as skin lesion removal, mole treatment, and ingrown toenail procedures.
• Diagnostic and screening procedures (RA8) — Investigative and screening services including health checks, mole assessment, and diagnostic testing used to identify or monitor a condition.

We are also registered to provide services to adults over 65, adults under 65, and children aged 0–18 years.

Together, these registrations mean that the full breadth of our services — from your first consultation through to treatment and follow-up — is formally regulated and inspected.

Who is responsible for our registration?

Our CQC registration is held by Your Wellbeing Clinic Ltd. The two individuals named on our registration are:

• Mr Geoffrey Charles Wood — Registered Manager
• Mr Matthew Christopher Snell — Nominated Individual

Both have been assessed by the CQC as part of the registration process, including criminal record checks and interviews.

Has the clinic been inspected yet?

As a recently registered service, our first formal follow-up inspection has not yet been scheduled. The CQC conducts follow-up inspections of new services regularly following registration. We welcome our first inspection as an opportunity to formally demonstrate the quality of care we provide — and in the meantime, the CQC's registration assessment has confirmed the service was likely to be safe, effective, caring, responsive and well-led.

What does this mean for you as a client?

When you choose Your Wellbeing Clinic, you are choosing a provider that has:

• Been assessed and registered by England's independent healthcare regulator
• Had its key personnel checked, interviewed, and approved
• Had its premises, processes, and governance reviewed before a single client was seen
• Been confirmed as likely to be safe, effective, caring, responsive and well-led
• Committed to ongoing regulatory oversight, including formal inspection

You also have the right to contact the CQC directly if you ever have concerns about the care you have received that you feel have not been adequately addressed by us.

Our registration details

• Provider: Your Wellbeing Clinic Ltd
• Service type: Independent Doctor
• Location ID: 1-25806963322
• Registration date: 25 November 2025
• Registered activities: RA5, RA7, RA8

View our CQC profile →

If you have any questions about our registration or what it means for your care, please contact us at wecare@yourwellbeingclinic.co.uk.

Introduction

Your Wellbeing Clinic Ltd is a CQC-registered integrated health and wellbeing clinic. Our clinicians and allied healthcare professionals provide a range of private healthcare services to members of the public, including primary medical care, minor injury and illness assessment, skin and mole assessment, aesthetic treatments, pain and movement services, mental wellbeing and counselling, and specialist clinics. They are supported by our administrative and management team in providing quality care for our clients.

This privacy notice explains how we use any personal information we collect about you as a patient of health care services provided by Your Wellbeing Clinic Ltd.

Why do we collect your personal information?

Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you have received within any care related organisation.  These records help to provide you with the best possible healthcare and help us to protect your safety.

We collect and hold data for the purpose of providing healthcare services to our clients and running our organisation which includes monitoring the quality of care that we provide. In carrying out this role we will collect information about you which helps us respond to your queries or secure specialist services. We will keep your information in written form and/or in digital form. The records will include both personal and special categories of data about your health and wellbeing.

What types of personal information do we collect about you?

We may collect the following types of personal information:

• Your name, address, email address, telephone number and other contact information.
• Gender, NHS Number and date of birth and sexual orientation.
• Details of family members and next of kin details.
• Health (Medical) information, including information relating to your sex life.
• Details of any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments and telephone calls.
• Results of investigations such as laboratory tests or scans.
• Biometric data.
• Genetic information.

How will we use the personal information we collect about you?

We may use your personal information in the following ways:

• To help us assess your needs and identify and provide you with the health and social care that you require
• To determine the best location to provide the care you require
• To comply with our legal and regulatory obligations
• To help us monitor and manage our services
• To support medical research

Text (SMS) messages

If you have provided your mobile telephone number, we may use this to send automatic appointment reminders, requests to complete surveys or to make you aware of services provided by the surgery that we feel will be to your benefit.

If you do not wish to receive these text messages, please let the reception team know.

Call recording

Recordings of calls made and received by Your Wellbeing Clinic Ltd may be used to support the learning and development of our staff and to improve the service we provide to our patients.

They may also be used when reviewing incidents, compliments, or complaints.

Call recordings will be managed in the same way as all other personal information processed by us and in line with current data protection legislation.

Data processors

We may use the services of a data processor to assist us with some of our data processing, but this is done under a contract with direct instruction from us that controls how they will handle patient information and ensures they treat any information in line with the General Data Protection Regulation, confidentiality, privacy law, and any other laws that apply.

How will we share your personal information?

With your permission, we may share your personal information with other health and social care professionals and members of their care teams to support your ongoing health and or social care and achieve the best possible outcome for you. This may include:

• Your GP

In order to support and provide healthcare services to you, your GP may require access to your client record. Your consent will always be sought and required prior to sharing all or any part of your client record with your GP.

• Internal Client Referrals

With your agreement, we may refer you to other services and healthcare providers for services provided at the Clinic.

• External Client Referrals

With your agreement, we may refer you to other services and healthcare providers for services not provided by the Clinic.

• Other Providers of Healthcare

With your agreement, we will share your information with other providers of healthcare services to enable them to support us in providing you with direct healthcare. This may include NHS organisations or private companies providing healthcare services for the NHS.

• Care Homes or Social Care Services

Sometimes the clinicians caring for you may need to share some of your information with others who are also supporting you outside of the practice.

• Local Authority

The local authority (council) provides health or social care services or assists us in providing direct healthcare services to you. We will share your personal information with them to enable this to take place.

• Safeguarding

We will share your personal information with the safeguarding teams of other health and social care providers where there is a need to assess and evaluate any safeguarding concerns. Your personal information will only be shared for this reason when it is required for the safety of the individuals concerned.

• Summary Care Record (SCR)

Your Summary Care Record is an electronic record of important patient information created from medical records. It contains information about medications, allergies and any bad reactions to medications in the past. It can be seen by staff in other areas of the health and care system involved in your direct care.

• Integrated Care Records (ICR)

An Integrated Care Record allows other health and care providers who are directly involved with your care to access appropriate, timely and relevant information about you to enable them to support your health and care.

• GP Connect

GP Connect is a system that allows other health and care providers access to your medical records to enable them to support your health and care when you are seen outside your normal GP surgery.

• NHS Digital

In order to comply with its legal obligations this practice may send data to NHS Digital when directed by the Secretary of State for Health under the Health and Social Care Act 2012.

This practice contributes to national clinical audits and will send the data, which are required by NHS Digital when the law allows. This may include demographic data, such as date of birth and information about your health, which is recorded in coded form. For example, the clinical code for diabetes or high blood pressure.

• National Services

There are some national services like the national Cancer Screening Programme that collect and keep information from across the NHS. This is how the NHS knows when to contact you about services like cancer screening.

• Write-Upp

We use Write-Upp to assist us in delivering healthcare services to our clients that register to use Write-Upp. When you register to use Write-Upp, you give your explicit consent (permission) for Write-Upp to collect and use your personal information for the services provided by Write-Upp.

Write-Upp may share your personal data with us if you require an appointment or repeat prescription.

The Clinic uses this software to provide an SMS service and clinician/patient video conference calls delivered using the patient and clinician’s smartphone device. This can be used when face-to-face contacts between healthcare staff and their patients are not possible.

• Care Quality Commission (CQC)

The CQC regulates health and care services to ensure that safe care is provided. The law requires that we must report certain serious events to the CQC, for example, when patient safety has been put at risk. Further information about the CQC can be found here:

http://www.cqc.org.uk/

• UK Health Security Agency (UKHSA)

The law requires us to share data for public health reasons, for example to prevent the spread of infectious diseases or other diseases which threaten the health of the population. We will report the relevant information to the local health protection team or the UK Health Security Agency (UKHSA). Further information about the UKHSA can be found here:

https://www.ukhsa.gov.uk/

How long do we keep your personal information?

We follow the NHS Records Management Code of Practice 2021 published by NHS England, which sets out the required retention periods for health records. Under this Code, patient records are generally retained for a minimum of 8 years after the conclusion of treatment, or 10 years from the date of death. At that point, all personal data we hold on you will be securely deleted.

We keep recordings of our calls for 6 years.

Data Controller

The data controller responsible for your personal information is:

Your Wellbeing Clinic Ltd, registered in England and Wales. Our Nominated Individual and primary point of contact for data protection matters is Matthew Snell, who can be contacted at matt@yourwellbeingclinic.co.uk.

As a private provider processing special category health data, we are not required by UK GDPR to appoint a formal Data Protection Officer (DPO). However, any queries relating to data protection, the handling of your personal information, or this privacy notice should be directed to the contact above.

Legal basis

We have been privately commissioned to provide private doctor surgery services and it is necessary for the performance of this task in the public interest for us to process your personal data.

We will use your special categories of personal data, such as that relating to your race, ethnic origin, and health for the purposes of providing you with health or social care or the management of health or social care systems and services. Such processing will only be carried out by a health or social work professional or by another person who owes a duty of confidentiality under legislation or a rule of law.

In some circumstances, we may process your personal information on the basis that:

• it is necessary to protect your vital interests;
• we are required to do so in order to comply with legal obligations to which we are subject;
• we are required to do so for the establishment, exercise or defence of a legal claim;

or

• you have given us your explicit consent to do so.

Your rights

You have a right to:

• ask for a copy of the information we hold about you;
• correct inaccuracies in the information we hold about you;
• withdraw any consent you have given to the use of your information at any time, without detriment to the care you receive;
• complain to the Information Commissioner’s Office (ICO) about our use of your personal information (see “How to make a complaint” below);
• in some circumstances:
  • ask us to erase information we hold about you;
  • request a copy of your personal data in an electronic format and require us to provide this information to a third party;
  • ask us to restrict the use of information we hold about you; and
  • object to the use of information we hold about you.

You can exercise these rights by contacting us as detailed below.

Cookies and website data

This privacy notice covers the personal information we collect and process in connection with the clinical services provided by Your Wellbeing Clinic Ltd. It does not cover data collected through our website independently of a clinical registration or appointment.

Our website may use cookies and similar technologies to improve your browsing experience. You may be asked to consent to non-essential cookies when you visit our website, and you can adjust your preferences at any time through your browser settings. For further detail, please see our separate Cookie Policy available on our website.

Changes to this privacy notice

We review and update this privacy notice periodically to ensure it remains accurate and compliant with applicable data protection legislation. The current version is always available on our website and is available in paper form on request at reception.

Where changes are significant, we will notify registered patients by email where we hold a current email address. This notice was last updated in March 2026.

How to contact us

If you have any questions about our privacy notice, the personal information we hold about you, or our use of your personal information, or if you have concerns or are unhappy about any of our services, please contact the Nominated Individual Matthew Snell on matt@yourwellbeingclinic.co.uk or in writing to Your Wellbeing Clinic Ltd, 13 Church Street, Calne, Wiltshire, SN11 0HU.

How to make a complaint

You also have the right to raise any concerns about how your personal data is being processed by us with the Information Commissioners Office (ICO):

The Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF

https://ico.org.uk/concerns

0303 123 1113

1. Introduction and Purpose

Your Wellbeing Clinic Ltd ("the Clinic") is a CQC-registered integrated health and wellbeing clinic. In providing clinical services, the Clinic collects, processes, and stores personal data — including special category health data — about patients, staff, and other individuals.

This policy establishes the Clinic's commitment to protecting all personal data in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018 (DPA 2018)
• NHS Records Management Code of Practice 2021
• CQC Fundamental Standards, in particular Regulation 17 (Good Governance)
• Common law duty of confidentiality

The Data Protection Act 1998, which this policy previously referenced, was repealed and replaced by the above legislation. All references to the DPA 1998 in previous versions of this policy are superseded.

This policy applies to all staff, contractors, volunteers, and third parties who process personal data on behalf of the Clinic.

1. Scope

This policy covers all personal data processed by the Clinic, including:

• Patient clinical and demographic records
• Staff employment records
• Contractor and supplier information
• Data processed via third-party systems (including Write-Upp)
• Paper records, digital records, images, and audio/video recordings

This policy should be read alongside the Clinic's Privacy Notice and Cookie Policy, both of which are published on the Clinic website.

1. Data Controller and Accountability

Your Wellbeing Clinic Ltd is the data controller for all personal data it processes. The Nominated Individual, Matthew Snell, holds primary responsibility for data protection compliance within the Clinic.

As a private provider processing special category health data, the Clinic is not required by UK GDPR to appoint a formal Data Protection Officer (DPO). However, all data protection queries, complaints, and Subject Access Requests should be directed to the Nominated Individual in the first instance.

The Nominated Individual is responsible for:

• Maintaining this policy and ensuring it is reviewed annually
• Ensuring staff receive appropriate data protection training
• Overseeing the response to data breaches and Subject Access Requests
• Maintaining the Record of Processing Activities (ROPA)
• Ensuring data processor contracts are in place and current

1. Data Protection Principles

Under UK GDPR, the Clinic is committed to ensuring that all personal data is:

• Processed lawfully, fairly and transparently
• Collected for specified, explicit and legitimate purposes, and not further processed in a manner incompatible with those purposes
• Adequate, relevant and limited to what is necessary (data minimisation)
• Accurate and, where necessary, kept up to date
• Retained no longer than necessary for the purpose for which it was collected
• Processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage

The Clinic also upholds the principle of accountability — we can demonstrate compliance with these principles and will maintain records to do so.

1. Lawful Basis for Processing

The Clinic processes personal data on the following lawful bases:

• Article 6(1)(b) — processing necessary for the performance of a contract (provision of clinical services)
• Article 6(1)(c) — processing necessary to comply with a legal obligation
• Article 6(1)(e) — processing necessary for the performance of a task carried out in the public interest
• Article 6(1)(a) — consent (where specifically required, such as for marketing communications)

For special category health data, the Clinic additionally relies on:

• Article 9(2)(h) — processing necessary for the provision of health or social care or treatment

The lawful basis for each processing activity is documented in the Clinic's Record of Processing Activities (ROPA).

1. Confidentiality

The Clinic recognises the right of every patient to have their information kept secure and private. All staff are bound by a duty of confidentiality, both under their contracts of employment and under the common law.

Staff access

Access to patient records is restricted to clinical and administrative staff on a need-to-know basis. Access rights are reviewed when a member of staff changes role or leaves the Clinic. The Registered Manager is responsible for maintaining accurate and current access rights within clinical systems.

Disclosure to third parties

Patient information will not be disclosed to third parties without the patient's explicit consent, except where:

• Disclosure is required by law (e.g. court order, statutory notification of infectious disease)
• Disclosure is necessary to protect the vital interests of the patient or another person
• Disclosure is necessary for safeguarding purposes
• Disclosure is to another healthcare provider directly involved in the patient's care

Where information is shared with a patient's GP, explicit consent will always be sought prior to sharing.

Children and young people

Medical information may be shared with parents or guardians of children, but this must take account of the young person's right to privacy. Where a child under 16 is assessed as Gillick competent — that is, they have sufficient maturity and understanding to make decisions about their own healthcare — they have the same right to confidentiality as an adult, and information should not be disclosed to parents or guardians without their consent. In all cases, the child's best interests take precedence.

Telephone and electronic enquiries

The Clinic will not disclose personal information over the telephone or by electronic means unless the identity of the requesting person can be satisfactorily verified. Where identity cannot be confirmed, information will not be released and the patient will be invited to attend in person or submit a written request.

Reports and third-party requests

Requests for reports (e.g. for insurance, legal, or employment purposes) will not be processed until the patient's written consent has been obtained. Patients have the right to see any such report before it is released. Results and other confidential information will be released only to the patient and not to family members or relatives unless the patient's explicit written consent is held on record.

1. Data Security

Physical security

Paper records containing personal data must be stored in locked filing cabinets or secure rooms when not in use. Personal data must never be left unattended in public areas. Sensitive documents must be disposed of by cross-cut shredding.

Digital security

All clinical and administrative computer systems are protected by password authentication. Passwords must be sufficiently complex, must not be shared between users, and must be changed promptly if there is any suspicion of compromise. Screens must be locked when a workstation is left unattended.

Patient data held in clinical systems (including Write-Upp) is accessed via secure, encrypted connections. The Clinic's Wi-Fi network used for clinical systems must be password-protected and separate from any guest network.

Device security

Any portable device (laptop, tablet, smartphone) used to access patient data must be password or PIN protected and, where technically possible, encrypted. Devices must not be left unattended in public places. Loss or theft of any device containing personal data must be reported immediately to the Nominated Individual and treated as a potential data breach (see Section 9).

Where staff use personal devices for Clinic business (BYOD), they must ensure those devices meet the same security standards as Clinic-owned devices. Remote access to clinical systems via personal devices is only permitted where approved by the Nominated Individual.

Remote and home working

Staff working remotely must access clinical systems via secure connections only. Patient data must not be saved to personal cloud storage services, personal email accounts, or unsecured locations. Printed records must not be taken off-site unless specifically authorised.

Email

Patient identifiable information must not be sent by unencrypted email. Where clinical correspondence must be sent electronically, it should be sent via a secure messaging platform or the patient's information should be referenced by an identifier rather than included in full. Patient consent should be obtained before sending any clinical information by email.

1. Data Retention

The Clinic retains personal data only for as long as is necessary for the purpose for which it was collected, in accordance with the NHS Records Management Code of Practice 2021. The following minimum retention periods apply:

At the end of the applicable retention period, records will be securely destroyed — paper records by cross-cut shredding, and digital records by secure deletion or media destruction. Destruction will be documented in a destruction log held by the Nominated Individual.

1. Data Breach Identification and Response

A personal data breach is any incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. Examples include:

• Loss or theft of a device containing patient data
• Sending patient information to the wrong recipient
• Unauthorised access to clinical systems
• Ransomware or other cyber attack affecting personal data
• Paper records left in a public area or disposed of insecurely

Reporting internally

Any member of staff who suspects or discovers a data breach must report it to the Nominated Individual immediately — and in any event within 24 hours of discovery. No member of staff should attempt to investigate or resolve a potential breach independently before reporting it.

Assessment

The Nominated Individual will assess the breach to determine its scope, the type of data involved, the likely impact on affected individuals, and whether notification to the ICO or to affected individuals is required.

Reporting to the ICO

Under UK GDPR Article 33, a breach that is likely to result in a risk to the rights and freedoms of individuals must be reported to the Information Commissioner's Office (ICO) within 72 hours of the Clinic becoming aware of it. Where this deadline cannot be met, a partial report will be submitted with the reason for delay. The ICO can be notified at:

ico.org.uk/for-organisations/report-a-breach

Where a breach is unlikely to result in a risk to individuals' rights and freedoms, it does not need to be reported to the ICO but must still be documented internally.

Notifying affected individuals

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, the Clinic will notify those individuals without undue delay, explaining the nature of the breach, its likely consequences, and the steps being taken to address it.

Breach log

All breaches — whether or not reportable to the ICO — will be recorded in the Clinic's Data Breach Log, maintained by the Nominated Individual. The log will record: the date of the breach, the nature of the data involved, the number of individuals affected, the cause, actions taken, and outcome.

1. Subject Access Requests (SARs)

Under UK GDPR Article 15, individuals have the right to request a copy of the personal data the Clinic holds about them, along with supplementary information about how it is used. This is known as a Subject Access Request (SAR).

How to make a SAR

SARs can be made verbally or in writing, including by email to matt@yourwellbeingclinic.co.uk. The Clinic may ask the individual to provide sufficient information to verify their identity before releasing any data. We will not charge a fee for responding to a SAR in normal circumstances.

Response timescale

The Clinic will respond to a SAR within one calendar month of receipt. Where a SAR is complex or numerous, the response period may be extended by a further two months, in which case the individual will be notified within the first month with an explanation.

Exemptions

Certain information may be withheld from a SAR response where an exemption under the DPA 2018 applies — for example, where disclosure would be likely to cause serious harm to the physical or mental health of the individual or another person, or where the information relates to a third party who has not consented to disclosure. Any withholding will be documented and the individual informed of their right to complain to the ICO.

1. Third Parties and Data Processors

A data processor is any third party that processes personal data on the Clinic's behalf and under its instruction. The Clinic uses the following key data processors:

• Write-Upp — clinical records management, appointment booking, and SMS messaging
• Any other third-party system processing patient or staff personal data

Before engaging any data processor, the Nominated Individual must ensure that:

• A written Data Processing Agreement (DPA) is in place that meets UK GDPR Article 28 requirements
• The processor provides sufficient guarantees about its security and compliance measures
• The processor does not sub-process data without prior written authorisation from the Clinic

The Clinic maintains a register of all data processors. Processor contracts are reviewed at least annually or whenever a new processor is engaged.

Where a processor is located outside the UK, the Clinic will ensure that an appropriate transfer mechanism is in place (e.g. UK International Data Transfer Agreement, adequacy decision, or binding corporate rules).

1. Staff Training and Awareness

All staff who handle personal data must complete data protection training before accessing patient records and at least annually thereafter. Training must cover:

• The principles of UK GDPR and the DPA 2018
• The Clinic's confidentiality obligations
• How to identify and report a data breach
• Safe handling, storage, and disposal of personal data
• Acceptable use of IT systems and devices

Training completion is recorded by the Nominated Individual. New starters must complete training as part of their induction. Refresher training will be triggered by significant changes to legislation, this policy, or the Clinic's systems.

All staff must sign a confidentiality agreement as part of their contract of employment. Volunteers and contractors with access to personal data must also sign an appropriate confidentiality undertaking before commencing work.

1. Access Controls

Access to personal data is granted on a role-specific, need-to-know basis. The Registered Manager is responsible for maintaining current user accounts and access permissions within clinical systems.

• New starters will be granted access appropriate to their role only
• Access will be reviewed whenever a member of staff changes role
• Access will be revoked promptly — and in any event on the day of departure — when a member of staff leaves the Clinic
• Shared or generic login credentials must not be used for systems holding personal data
• All access to clinical systems is logged and may be audited

1. Significant Event Reporting

The Clinic operates a no-blame culture for the reporting of data security incidents and near misses. Staff are encouraged to report any situation that has, or could have, resulted in a breach of data security — including near misses where no actual breach occurred.

Significant events relating to data security will be reviewed by the Nominated Individual and, where appropriate, discussed at the next clinical governance meeting. Learning from events will be used to update procedures, training, and technical controls as required.

This process complements — and does not replace — the formal data breach reporting procedure in Section 9.

1. Data Backup and Business Continuity

The Clinic's clinical system provider (Write-Upp) is responsible for maintaining backups of data held within that system. The Nominated Individual will confirm with Write-Upp annually that adequate backup and recovery arrangements are in place and that they have been tested.

Where the Clinic holds personal data outside of the clinical system (e.g. in local files or spreadsheets), backups of that data must be taken regularly to a secure, encrypted location. The frequency and method of backup will be documented by the Nominated Individual.

In the event of a system failure or loss of access to data, the Nominated Individual will coordinate the recovery process and communicate with affected staff and patients as necessary.

1. Patient Rights

Under UK GDPR, patients have the following rights in relation to their personal data:

• The right to be informed about how their data is used (met by the Clinic's Privacy Notice)
• The right of access to their personal data (Subject Access Request — see Section 10)
• The right to rectification of inaccurate data
• The right to erasure ('right to be forgotten') in certain circumstances
• The right to restrict processing in certain circumstances
• The right to data portability (receive data in a structured, machine-readable format)
• The right to object to processing
• The right to withdraw consent at any time, without detriment to the care received
• The right to lodge a complaint with the ICO

Patients wishing to exercise any of these rights should contact the Nominated Individual at matt@yourwellbeingclinic.co.uk. The Clinic will respond within one calendar month.

Patients have the right to request to see their records and, if they choose, to have any inaccuracies corrected. Please help us keep your records current by informing the Clinic of any changes to your contact details or circumstances.

1. Complaints

If a patient or member of staff believes the Clinic has not complied with its data protection obligations, they should first raise the matter with the Nominated Individual. We will investigate and respond within 20 working days.

Individuals also have the right to raise concerns directly with the Information Commissioner's Office (ICO):

ico.org.uk/concerns  |  0303 123 1113

The Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

1. Policy Review

This policy will be reviewed at least annually by the Nominated Individual, or sooner if required by:

• Changes to UK GDPR, the DPA 2018, or related guidance from the ICO
• Changes to the Clinic's services, systems, or data processing activities
• A significant data breach or near miss
• CQC inspection findings or recommendations

Reviewed versions will be approved by both the Nominated Individual and the Registered Manager, documented in the Revision History (Section A), and communicated to all staff.

Accessibility at Your Wellbeing Clinic

We want every patient to feel welcome and comfortable visiting us. Below is a summary of our current accessibility provision, along with how to let us know if you need any additional support.

Parking Two designated disabled parking bays are available at the rear of the clinic in the public car park. Two hours' free parking is currently available; a ticket is required from the machine on arrival.

Building access The clinic is housed in a listed building. Wheelchair access is available via the main entrance, and all consultation rooms are located on the ground floor — there are no stairs between the entrance and any clinical area.

Accessible toilet An accessible toilet with handrails and support aids is available on the ground floor. Please be aware that due to our listed building status we are unable to alter the size of this room, and some wheelchair users may require assistance. Please let us know in advance if this is likely to affect you and we will ensure a member of staff is available to help.

Hearing and communication If you are deaf or have a hearing impairment, please let us know when booking your appointment. We can add an alert to your record so that staff are aware and can make appropriate arrangements, such as ensuring good face-to-face visibility or arranging a British Sign Language (BSL) interpreter if required with sufficient notice.

Other adjustments We are committed to making reasonable adjustments for all patients. If there is anything else we can do to make your visit more comfortable — including longer appointment times, large-print materials, or any other support — please let us know as early as possible before your appointment and we will do our best to accommodate you.

Contact us To discuss any accessibility requirements, please contact our reception team at wecare@yourwellbeingclinic.co.uk or speak to us when booking your appointment.

1. Purpose

This policy sets out the commitment of Your Wellbeing Clinic Ltd ("the Clinic") to equality and diversity in both the services it provides to patients and in its employment practices. It applies to all staff, contractors, volunteers, and any third parties acting on behalf of the Clinic.

The Clinic is a CQC-registered integrated health and wellbeing clinic. We believe that everyone deserves to be treated with dignity, fairness, and respect — regardless of who they are. This policy exists to give that commitment a clear, accountable structure.

1. Legal Framework

This policy has been written in accordance with the following legislation and guidance:

• Equality Act 2010
• Human Rights Act 1998
• Care Act 2014
• CQC Fundamental Standards — in particular Regulation 9 (Person-centred Care), Regulation 10 (Dignity and Respect), and Regulation 17 (Good Governance)
• Equality and Human Rights Commission (EHRC) Codes of Practice
• NHS Accessible Information Standard (adopted as best practice)

Note: Previous versions of this policy referenced the Data Protection Act 1998 and EU legislation in the context of information governance. That content has been removed from this policy as it is not relevant to equality and diversity obligations. Data protection matters are covered in the Clinic's Data Security & Protection Policy (DSP-POL-001).

1. Protected Characteristics

Under the Equality Act 2010, it is unlawful to discriminate against any person on the basis of a protected characteristic. The Clinic is committed to ensuring that no patient, member of staff, job applicant, contractor, or visitor is treated less favourably on the basis of any of the following nine protected characteristics:

The Equality Act 2010 also recognises that a person may experience discrimination on the basis of a combination of two protected characteristics (known as combined or intersectional discrimination). The Clinic's commitment to equal treatment extends to these circumstances.

1. Types of Discrimination

The Clinic will not engage in, condone, or tolerate any of the following forms of discrimination:

• Direct discrimination — treating someone less favourably because of a protected characteristic
• Indirect discrimination — applying a provision, criterion, or practice that puts people with a protected characteristic at a particular disadvantage
• Harassment — unwanted conduct related to a protected characteristic that violates a person's dignity or creates an intimidating, hostile, degrading, humiliating, or offensive environment
• Victimisation — treating someone less favourably because they have made, or intend to make, a complaint or allegation relating to discrimination
• Discrimination arising from disability — treating a person unfavourably because of something arising from their disability, where the treatment cannot be justified
• Failure to make reasonable adjustments — failing to take steps to remove barriers facing disabled patients or staff

1. Equality in Service Delivery

The Clinic is committed to providing equitable, person-centred care to all patients. This means:

• Every patient will be treated with dignity and respect, regardless of any protected characteristic
• Clinical decisions will be based solely on clinical need and patient preference
• We will not refuse to treat, or provide a lesser standard of care to, any patient on the basis of a protected characteristic
• We will communicate with patients in a way that meets their individual needs — including providing information in accessible formats on request
• We will respect the religious, cultural, and personal values of each patient in the delivery of care
• We will seek patient feedback and use it to improve the inclusivity of our services

The Clinic's Privacy Notice and website contain specific information on accessibility provisions (including disabled access and chaperone arrangements). These are reviewed alongside this policy.

1. Reasonable Adjustments

Under the Equality Act 2010, the Clinic has a proactive duty to make reasonable adjustments to remove or reduce disadvantages faced by disabled patients and staff. This duty is anticipatory — it applies before a specific need is identified, not only in response to a request.

For patients

Examples of reasonable adjustments the Clinic may make for patients include:

• Longer appointment times for patients who need more time
• Ground floor appointments for patients with mobility difficulties
• Large-print or audio versions of patient information
• Arranging a British Sign Language (BSL) interpreter with sufficient notice
• Allowing a carer or support worker to accompany a patient
• Adjusting the physical environment where possible within listed building constraints

Patients who require a reasonable adjustment should notify the Clinic as early as possible — ideally when booking their appointment. Requests will be handled sensitively and recorded on the patient's record where appropriate.

For staff

The Clinic will consider reasonable adjustments for disabled members of staff or job applicants, including adjustments to working hours, duties, equipment, or the physical environment. Requests should be made to the Nominated Individual and will be considered promptly and fairly.

1. Employment Practices

Recruitment and selection

The Clinic is committed to fair and transparent recruitment. All applicants will be assessed against objective, job-related criteria only — regardless of any protected characteristic. The Clinic will consider whether reasonable adjustments are required at any stage of the recruitment process to ensure that disabled applicants are not disadvantaged.

Job advertisements will be worded to encourage applications from a diverse range of candidates. Shortlisting, interviewing, and selection decisions will be documented and, where practicable, conducted by more than one person.

Training and development

All staff have equal access to training and development opportunities. Training records and development plans will be reviewed annually to ensure that access is equitable across the team. Staff are encouraged to raise any concerns about access to development opportunities with the Nominated Individual.

Terms and conditions

All employment policies and procedures — including those covering pay, leave, disciplinary, grievance, and performance — will be applied consistently and without discrimination. The Clinic does not operate different terms and conditions for staff based on any protected characteristic.

Staff responsibilities

Every member of staff is personally responsible for:

• Treating colleagues, patients, and visitors with dignity and respect at all times
• Challenging discriminatory behaviour, language, or attitudes when they encounter it
• Reporting any concerns about equality, discrimination, or harassment to the Nominated Individual
• Completing equality and diversity training as required

1. Zero Tolerance

The Clinic is committed to maintaining a safe, respectful environment for patients, staff, and visitors. Violent, abusive, discriminatory, or harassing behaviour will not be tolerated — from any person, in any context.

Behaviour covered

This includes but is not limited to:

• Physical violence or threats of violence
• Verbal abuse, intimidation, or threatening behaviour
• Bullying or harassment of any description
• Discriminatory language or conduct directed at staff, patients, or visitors on the basis of any protected characteristic

Response

Any member of staff who experiences or witnesses violent or abusive behaviour should:

• Remove themselves from the situation if it is safe to do so
• Report the incident to the Nominated Individual or Registered Manager immediately
• Document the incident in writing as soon as practicable

All reported incidents will be investigated promptly. Where the behaviour involves a patient, the Clinic reserves the right to discharge that patient from its list, with appropriate notice given in writing and with any immediate clinical needs met. Where behaviour constitutes a criminal offence, the matter may be referred to the police.

Staff will not be disadvantaged or penalised for reporting incidents in good faith.

1. Responsibility and Accountability

Overall responsibility for equality and diversity compliance within the Clinic rests with the Nominated Individual, Matthew Snell. Day-to-day responsibility is shared by all staff in line with Section 7 above.

Specific responsibilities of the Nominated Individual include:

• Maintaining and reviewing this policy annually
• Ensuring all staff receive equality and diversity training
• Investigating complaints of discrimination or harassment
• Monitoring service delivery and employment data for equality outcomes
• Liaising with the CQC and other regulatory bodies on equality matters as required

1. Monitoring and Review

The Clinic will monitor the effectiveness of this policy through:

• Annual review of any complaints, grievances, or incidents with an equality dimension
• Staff feedback gathered through appraisals and any staff surveys
• Patient feedback and complaints monitoring
• Periodic review of workforce data to identify any equality concerns

This policy will be reviewed at least annually by the Nominated Individual, or sooner in response to changes in legislation, CQC guidance, or significant incidents. Updated versions will be approved by both the Nominated Individual and the Registered Manager and communicated to all staff.

1. Complaints and Concerns

Any patient, member of staff, or visitor who believes they have been discriminated against, harassed, or treated unfairly on the basis of a protected characteristic should raise their concern with the Nominated Individual in the first instance:

Matthew Snell — Nominated Individual

matt@yourwellbeingclinic.co.uk

All complaints will be acknowledged promptly, investigated thoroughly, and responded to in writing within 20 working days. The complainant will not be disadvantaged as a result of raising a concern.

If a complainant is not satisfied with the Clinic's response, they may refer the matter to:

• The Equality and Human Rights Commission (EHRC): www.equalityhumanrights.com
• The Care Quality Commission (CQC): www.cqc.org.uk
• The Employment Tribunal (for employment-related matters)

Zero Tolerance and Respect Policy

Your Wellbeing Clinic is committed to providing a safe, respectful environment for all patients, visitors, and staff. We ask everyone who uses or visits the clinic to treat others — patients and staff alike — with courtesy and respect.

We understand that illness, anxiety, and frustration can affect how people feel and behave, and we will always try to approach difficult situations with patience and understanding. However, there are behaviours we cannot accept, and this statement sets out clearly what those are and how we will respond.

Unacceptable behaviour

The following behaviours are unacceptable and will not be tolerated at the clinic, on the telephone, or online:

• Physical violence or threats of violence towards staff, patients, or visitors
• Verbal abuse, intimidation, or threatening behaviour of any kind
• Racist, sexist, or otherwise discriminatory language or conduct
• Sexual harassment
• Persistent, unreasonable demands that cause distress to staff
• Deliberate damage to clinic property
• Obtaining drugs or clinical services fraudulently or by deception

Consequences

Where unacceptable behaviour occurs, the clinic reserves the right to:

• Ask the individual to leave the premises
• Remove a patient from the clinic's list, with written notice given and any immediate clinical need met
• Report the matter to the police where behaviour constitutes, or may constitute, a criminal offence

Staff have the right to disengage from any interaction — in person, by telephone, or online — where behaviour becomes abusive or threatening. They will never be expected to tolerate abuse as part of their role.

Online and social media

We welcome all feedback, positive or negative — it helps us improve. If you have a concern or complaint, we encourage you to contact us directly so we can address it properly and promptly.

However, comments posted online that are derogatory, offensive, or defamatory towards the clinic or any of our staff will be treated as a potential breakdown in the clinic-patient relationship and may result in a patient being removed from the clinic list. Such comments can also cause real distress to the individuals named, and may discourage other patients from seeking care they need.

If something has gone wrong, please give us the chance to put it right first. You can reach us at wecare@yourwellbeingclinic.co.uk — we read and respond to all messages.

Our commitment to staff

Your Wellbeing Clinic is equally committed to ensuring that staff treat patients, visitors, and each other with dignity and respect at all times. Any member of staff who behaves in a manner that falls below this standard will be subject to the clinic's disciplinary procedures. Patients who witness behaviour by a member of staff that concerns them are encouraged to raise it with us directly.