Privacy Policy

1. Who we are

Keltoi Ltd, trading as Keltoi Wellness and referred to in this policy as “Keltoi”, “we”, “our” or “us”, is responsible for the personal information we collect and use in operating our website and providing our services.

We act as a data controller for this information. This means we determine why and how it is processed.

Our services are intended for adults aged 18 and over in the United Kingdom. Individual services may have additional geographical or clinical eligibility requirements.

This policy explains how we handle information when you visit our website, complete an eligibility check, arrange a consultation, receive care or patient support, make a payment, or contact us.

Contact details

• Email: clinic@keltoi.co.uk
• Telephone: 028 9433 6992
• Website: www.keltoi.co.uk

Please direct privacy enquiries and requests to exercise your data protection rights to clinic@keltoi.co.uk, marked “Privacy enquiry”.

Independent clinicians, pharmacies and referral providers may also act as separate data controllers for information they use in delivering their own services. Their privacy notices explain their responsibilities.

2. Information we collect

Depending on your interaction with us, we may collect the following information.

Personal and contact information

Your name, date of birth, address, delivery address, email address, telephone number and other details needed to identify and contact you.

Health and clinical information

Your height, weight, BMI, medical history, symptoms, diagnoses, allergies, current and previous medication, relevant lifestyle information, treatment goals, assessment answers, consultation notes, test results, prescription details and correspondence relating to your care.

This may include photographs or other evidence requested to support a clinical assessment or verify your weight.

Identity verification information

Identification documents, photographs or selfies, and information about the outcome of identity checks.

Payment and transaction information

Payments, refunds, purchases, invoices and relevant transaction references. Payment card details are handled by our payment provider. Keltoi does not store full payment card details.

Communications

Emails, contact form submissions, telephone notes, patient support enquiries, feedback and complaints.

Website and device information

IP address, browser and device information, website interactions, referral sources and cookie preferences, where collected through the operation of our website or permitted analytics tools.

3. Where we obtain information

We obtain information directly from you when you complete forms, provide documents, speak with us or use our services.

Where necessary and lawful, we may also receive information from:

• Clinicians involved in your assessment or treatment.
• Pharmacies dispensing your medication.
• Your GP or another healthcare provider.
• Laboratories or diagnostic providers involved in your care.
• Identity verification and payment providers.
• Someone you have authorised to communicate on your behalf.

We obtain and share confidential healthcare information only where there is an appropriate legal basis and the relevant confidentiality requirements are met.

4. Why we use your information and our legal grounds

We use personal information only where we have a lawful basis under the UK GDPR.

Providing the services you request

We use information to process your enquiry, arrange an assessment or consultation, manage payments, provide patient support and coordinate your care.

Our lawful basis is taking steps at your request before entering into a contract, or performing our contract with you, under Article 6(1)(b).

Health information also requires an additional legal condition, explained in section 5.

Safe administration and operation of our services

We use information to verify identity, prevent misuse, secure our systems, resolve administrative problems and manage service quality.

Where appropriate, we rely on legitimate interests under Article 6(1)(f). These interests include protecting patients, preventing fraud and operating a reliable healthcare service.

We consider whether these interests are outweighed by your rights and freedoms. Legitimate interests alone do not permit us to process special category health or biometric information.

Legal obligations

We process information where necessary to meet applicable legal requirements, including accounting obligations, lawful regulatory requests and requirements relating to data protection.

Our lawful basis is Article 6(1)(c). We apply this basis only where a relevant legal obligation exists.

Consent

We rely on Article 6(1)(a) where we ask for consent, including for marketing or cookies where consent is required.

You can withdraw consent at any time by contacting us or using the relevant unsubscribe or privacy controls. Withdrawal does not affect the lawfulness of processing carried out before you withdrew consent.

Complaints and legal claims

We may use relevant information to investigate complaints and establish, exercise or defend legal claims.

Depending on the circumstances, this is based on our legitimate interests or an applicable legal obligation. Where health information is necessary for legal claims, we may also rely on Article 9(2)(f).

5. Health information and confidentiality

Information about your physical or mental health is special category personal data and receives additional protection under UK GDPR.

For medical assessment, treatment and the management of healthcare services, we rely on Article 9(2)(h), together with the applicable requirements of the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2.

This condition applies where the information is processed by, or under the responsibility of, a healthcare professional or another person subject to an appropriate duty of confidentiality.

Where a separate activity does not meet these requirements, we must identify another valid special category condition before processing the information. Where that condition is explicit consent, we will ask for it separately and explain the purpose.

Consent to medical treatment is separate from the lawful basis for processing personal information.

Your health information is treated as confidential. We restrict its use and disclosure to what is necessary for your care, authorised administration or another lawful purpose.

6. How we protect your information and meet our responsibilities

Our approach to privacy and confidential health information is governed by:

• The UK General Data Protection Regulation.
• The Data Protection Act 2018.
• The Privacy and Electronic Communications Regulations, where applicable.
• Relevant amendments to these laws, including provisions of the Data (Use and Access) Act 2025 as they take effect.
• Applicable duties of confidentiality and professional obligations relating to patient information.

To meet these responsibilities, our data handling arrangements require:

• Collection of only the information needed for a specified, lawful purpose.
• Access limited to authorised people who need the information for their role.
• Appropriate confidentiality obligations for those handling patient information.
• Appropriate technical safeguards, including access controls, password protection, encryption and secure storage.
• Written data protection terms with suppliers processing information on our behalf.
• Assessment of privacy risks when introducing or changing systems, including a data protection impact assessment where required.
• Retention and secure disposal arrangements appropriate to the type of information.
• Procedures for responding to privacy requests, complaints and suspected security incidents.

No electronic system is entirely risk free. If a personal data breach occurs, we will assess it and take appropriate action. Where legally required, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to create a high risk to affected individuals, we will also notify them without undue delay.

7. Who we share information with

We share only information reasonably necessary for the relevant purpose.

Recipients may include:

• Healthcare professionals: for assessment, treatment, prescribing, follow-up and clinical oversight.
• Pharmacies: for dispensing, prescription queries and medication delivery.
• Your GP or other care providers: where appropriate for safe care and permitted by confidentiality and data protection requirements.
• Referral providers and laboratories: where needed for a service you request.
• Technology suppliers: for patient records, appointments, forms, identity verification, website hosting, secure communications and technical support.
• Payment providers: to process payments and refunds.
• Delivery providers: to arrange delivery, using the information necessary for that purpose.
• Professional advisers: where necessary for accounting, insurance, legal advice or claims.
• Regulators, courts and public authorities: where disclosure is required or otherwise permitted by law.

Suppliers acting as our data processors must handle information under appropriate contractual terms and our instructions. Organisations acting as independent controllers are responsible for their own lawful processing.

We do not sell your personal information.

8. Patient records, identity checks and payments

Pabau

We use Pabau to support patient administration, appointments, records, forms and communications. Access to patient information is restricted according to authorised responsibilities.

Persona and identity verification

We use Persona to support identity verification. This may involve an identification document, a selfie and verification results.

Where an identity check involves biometric processing to identify you uniquely, additional special category protections apply. The verification process must explain the processing and applicable legal grounds before it takes place. Where explicit consent is relied upon, this must be requested separately.

If you have concerns about an identity check or cannot complete it, contact us so that we can discuss the available options.

Identity documents and verification records may have different retention periods from clinical records. Deletion of information from an identity verification system does not necessarily delete a verification outcome or evidence that must lawfully remain in your patient record.

Payments

We use payment providers, including Stripe where applicable, to process transactions securely. We receive information necessary to confirm and administer your payment, rather than your full payment card details.

9. International transfers

Some technology providers or their service providers may process information outside the United Kingdom, including through overseas support access.

Where a restricted international transfer takes place, we must ensure an appropriate transfer mechanism is in place. Depending on the circumstances, this may include:

• UK adequacy regulations covering the destination or recipient.
• The UK International Data Transfer Agreement.
• The UK Addendum to the European Commission’s Standard Contractual Clauses.

Where required, we assess the risks associated with the transfer and apply additional safeguards.

You can contact clinic@keltoi.co.uk for details of transfers relevant to your information and to request information about, or a copy of, the applicable safeguards, subject to appropriate redactions.

10. How long we retain information

We retain personal information for as long as necessary for its purpose, taking account of clinical needs, applicable law, professional guidance and the handling of complaints or claims.

Different records may have different retention periods.

• Clinical and treatment records: retention is determined by the type of care, the need to preserve an accurate medical history, applicable professional guidance and relevant legal or claims requirements. An eight-year period following the end of treatment or last relevant contact may apply to some adult healthcare records, but this is not a universal maximum.
• Financial and transaction records: generally retained for six years from the end of the relevant accounting period, or longer where required by applicable accounting or tax rules.
• Eligibility checks and incomplete applications: retained according to whether care followed, whether a clinical decision was recorded and whether the information is needed to resolve an enquiry, complaint or patient safety issue.
• Identity documents and verification information: retained only for the period justified by verification, fraud prevention, clinical record requirements and any applicable legal obligations.
• Enquiries and complaints: retained for the time needed to respond and maintain an appropriate record of the issue and its resolution.
• Marketing preferences: retained while relevant, including a minimal record of an objection or unsubscribe request so that it continues to be respected.
• Technical records and cookies: retained according to their security or operational purpose and the settings of the relevant system.

Information may be retained longer where needed for an ongoing investigation, complaint or legal claim. When it is no longer required, we arrange secure deletion or anonymisation.

You can ask us for information about the retention period or criteria applying to a particular record.

11. Cookies, analytics and advertising technologies

Our website may use cookies and similar technologies to support essential functions, understand website use and measure performance.

Where consent is required, optional analytics and advertising technologies must not operate until you have consented. You can withdraw that consent through the website’s available cookie controls or contact us for assistance.

Browser settings can also block or delete cookies, although this may affect website functionality.

Information about the technologies in use, their purposes and their duration should be provided through the website’s cookie information and preference controls.

Health information requires additional protection. Consent to ordinary website cookies does not, by itself, authorise the disclosure of clinical information to advertising platforms.

12. Service messages and marketing

We may contact you about your assessment, appointments, payments, identity checks, treatment, delivery or other matters necessary to provide your requested service.

These communications are separate from promotional marketing.

We send electronic marketing only where permitted by applicable law, obtaining consent where required. You can stop marketing messages at any time using the unsubscribe option or by contacting clinic@keltoi.co.uk.

Declining marketing does not affect your access to care.

13. Eligibility screening and clinical decisions

Online forms may use your answers, such as age, height, weight and medical history, to calculate information such as BMI and indicate whether a service may be suitable.

An initial eligibility result is not a diagnosis or a guarantee of treatment. Prescribing decisions require clinical assessment by an appropriately qualified clinician.

If you believe an online result or identity check is incorrect, contact us to request a review by a member of the team.

Where a process involves a solely automated decision with legal or similarly significant effects, we will provide the additional information and safeguards required by applicable law.

14. Information needed to provide care

We need certain identity, contact, health and payment information to assess you safely and provide the service you request.

If you do not provide necessary information, we may be unable to complete verification, arrange treatment, process a prescription or deliver medication. We will explain where this affects your care.

Optional information and marketing consent are not conditions of receiving treatment.

15. Your data protection rights

Depending on the circumstances, you have the right to:

• Obtain access to your personal information and a copy of it.
• Ask us to correct inaccurate information or complete incomplete information.
• Request deletion where there is no continuing lawful reason to retain it.
• Request restrictions on how we use your information.
• Receive certain information in a portable format.
• Withdraw consent where processing relies on consent.
• Request applicable safeguards in relation to significant automated decisions.

These rights are subject to legal conditions and exemptions. For example, a request to delete information does not always require deletion of clinical records that must be retained for a lawful purpose.

Your right to object

You can object at any time to the use of your personal information for direct marketing. We will stop using it for that purpose.

You may also object to processing based on legitimate interests for reasons relating to your circumstances. We will consider your objection and explain whether there is a lawful reason for processing to continue.

How to make a request

Email clinic@keltoi.co.uk or telephone 028 9433 6992.

We normally respond within one month, subject to the timing rules and permitted extensions under applicable law. If more time is lawfully needed, we will explain why.

We may request proportionate information to verify your identity. Requests are normally free of charge.

16. Privacy complaints

If you are concerned about how we handle your information, please contact clinic@keltoi.co.uk with the subject “Privacy complaint”.

We will investigate and explain our response and any action taken.

You also have the right to complain to the Information Commissioner’s Office. You do not need our permission to do so.

Information Commissioner’s Office

• Website: ico.org.uk
• Complaints: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

17. Changes to this policy

We may update this policy to reflect changes to our services, systems or legal responsibilities.

The current version will be published on our website with its revision date. Where a change materially affects how we use your information, we will provide additional notice where required.