Ocean Bloom Women's Health Website Privacy Policy
Last Updated: October 2026
Data Controller: Ocean Bloom LTD (Company No: XXXXXX)
Introduction & Who We AreOcean Bloom LTD ("we", "our", or "us") is committed to protecting and respecting your privacy.
This Privacy Policy explains how we collect, use, store, and protect your personal and health data when you visit our website, join our priority waitlist, or engage with our private medical and menopause clinic services.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Ocean Bloom LTD acts as the data controller.
2. The Information We Collect
Depending on how you interact with us, we may collect and process the following categories of data:
Identity & Contact Data: Full name, title, date of birth, home address, email address, and telephone number.
Special Category Health Data: Medical history, symptom trackers, hormone profiles, blood test results, prescription history, and clinical notes gathered during medical consultations and intake assessments.
Technical & Usage Data: IP address, browser type, device information, and how you navigate our website (collected via cookies and analytics).
Communication Records: Records of emails, text messages, WhatsApp business communications, or phone calls between you and our clinical or administrative team.
3. How We Use Your Data & Lawful Bases
Under UK GDPR, we must have a valid lawful basis to process your information. For health data (classified as "Special Category Data"), strict conditions apply:Provision of Healthcare (Legal Obligation & Vital Interests): To provide safe, evidence-based medical consultations, manage menopause and women's health treatments, and coordinate prescriptions and diagnostic testing.Explicit Consent: When you voluntarily submit your details to our priority waitlist or opt-in to receive clinic updates, marketing, or educational resources.Legitimate Interests: To run our administrative operations efficiently, secure our IT systems, and respond to general inquiries.
4. How We Store and Protect Your Data
We treat patient data with the highest level of security.All data is stored on encrypted, GDPR-compliant cloud servers and secure Practice Management Software (PMS). Access to clinical records is strictly restricted to authorized medical practitioners and administrative personnel bound by professional confidentiality obligations.We do not store patient health data or messages on unsecured personal devices.
5. Sharing Your Information
We will never sell or rent your data. We may share your information only under strict legal frameworks with:
Regulatory Authorities: The Care Quality Commission (CQC) or the General Medical Council (GMC) strictly when required for regulatory compliance and clinical audit.
IT & Software Providers: Compliant cloud hosting, email, and practice management platform providers who assist in running our digital infrastructure under strict data processing agreements.
6. Your Data Protection Rights
Under UK data protection law, you have rights including:
The right to access: You can request copies of your personal data and medical records.
The right to rectification: You can ask us to correct inaccurate or incomplete data.
The right to erasure: You can request the deletion of your data, subject to legal and CQC medical record retention obligations (which require us to keep clinical records for specified periods).
The right to restrict or object to processing.
To exercise any of these rights, please contact our Data Protection Lead at: [Insert Email Address].