Skip to main content
IronOxCLINIC

Privacy Policy

Last updated: 11 May 2026

1. Who We Are

IronOx Clinic Ltd ("we", "us", "our") is the data controller for the personal information we collect. Our registered address is The Mews, 38 Cathedral Road, Cardiff, CF11 9LL. You can contact us about data protection matters at info@ironoxclinic.com.

2. What Data We Collect

We collect the following categories of personal data:

  • Identity data: full name, date of birth
  • Contact data: email address, phone number, postal address
  • Health data: medical history, symptoms, blood test results, GP details, current medications (provided during consultation and booking)
  • Financial data: payment card details are processed by Stripe and never stored on our systems
  • Technical data: IP address, browser type, pages visited (collected via analytics cookies, with your consent)

3. How We Use Your Data

  • To provide medical consultations, blood testing, and iron infusion therapy
  • To process appointment bookings and payments
  • To communicate with you about your appointments and clinical care
  • To send your GP a post-treatment report (where appropriate)
  • To comply with our legal and regulatory obligations as a healthcare provider
  • To improve our website and services (with anonymised analytics data, only with your consent)

4. Lawful Basis for Processing

  • Contract: processing your booking and delivering the medical services you have requested
  • Legal obligation: maintaining medical records as required by healthcare regulations
  • Legitimate interest: responding to enquiries, improving our services
  • Consent: analytics cookies and marketing communications (you can withdraw consent at any time)

Health data is processed under Article 9(2)(h) of UK GDPR — it is necessary for the provision of healthcare.

5. Who We Share Your Data With

We do not sell your personal data. We share data only with:

  • Stripe: payment processing (PCI DSS compliant)
  • Supabase: secure data storage (SOC 2 Type II certified, data hosted in EU)
  • Resend: transactional email delivery
  • Google Analytics 4 and PostHog: consented website analytics using pseudonymous journey and session identifiers; no booking reference, patient details or clinical answers are sent
  • Your GP: post-treatment clinical reports (with your consent or where clinically necessary)
  • Regulatory bodies: Healthcare Inspectorate Wales (HIW — registration HIW/02039RM), the GMC, or the ICO where required by law

6. How Long We Keep Your Data

  • Medical records: 8 years from last contact, in line with NHS records management guidance
  • Booking and contact data: 2 years from your last appointment
  • Payment records: 6 years for tax and accounting purposes
  • Analytics data: individual pseudonymous journey, session and booking-link records are retained for no more than 13 months; non-identifying aggregate statistics may be retained longer

7. Cookies

Our website uses:

  • Essential cookies: required for the website to function (e.g. cookie consent preference). These do not require consent.
  • Analytics storage: Google Analytics 4, PostHog and an IronOx first-party random journey/session identifier, used to understand how consented journeys lead to bookings and improve the service. These are only created if you click "Accept" on our cookie banner and expire or are deleted under the retention rule above.

You can change your cookie preferences at any time by clearing your browser's local storage for this site.

8. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate personal data
  • Erase your personal data (subject to legal retention requirements for medical records)
  • Restrict or object to processing
  • Data portability — receive your data in a structured, machine-readable format
  • Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email us at info@ironoxclinic.com. We will respond within 30 days.

9. Complaints

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.