Effective Date: 25-02-2025
Last Updated: 25-02-2025

It’s Psoriasis (“we,” “us,” or “our”) is committed to protecting your privacy and handling your data transparently. This Privacy Policy explains how we collect, use, store, and disclose your personal information in compliance with the UK General Data Protection Regulation (UK GDPR) and other applicable laws.

1. Information We Collect

We collect and process the following types of personal data:

1.1 Personal Information

  • Name, email address, and any details provided via our website’s contact form or booking system.
  • Information shared via email, WhatsApp, or Zoom calls (not recorded unless explicitly requested by the client(s)).

1.2 Health Information

  • Health details voluntarily provided by clients via Google Forms, email, WhatsApp, or other communications.
  • Lab data: If you choose to order lab tests through us, we may process your name and address and other necessary details to facilitate the order. Labs may send results directly to you or to us for review.

1.3 Payment Information

  • Payments are processed securely via Stripe or invoice, and we do not store your payment details.

1.4 Technical Data & Cookies

  • We use cookies, Google Analytics, and other tracking tools to improve our website and analyze traffic. More details are in our Cookie Policy.

1.5 International Data Transfers

  • We may store and process your data in locations outside the UK and EU, including the United States, where our third-party service providers (e.g., Google, Notion, Stripe) operate. When transferring data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or reliance on adequacy decisions, to protect your privacy rights under UK GDPR.

2. Legal Basis for Processing

Under UK GDPR, our processing of your personal data relies on:

  • Consent – When you voluntarily provide health information, we require explicit consent. You can withdraw consent anytime.
  • Contractual Necessity – When data is needed to provide our services.
  • Legitimate Interests – To improve our services, ensure security, and communicate with you, provided these interests do not override your rights.

3. How We Use Your Data

We use your data to:

  • Provide and manage our services.
  • Personalize your experience and improve our offerings.
  • Facilitate lab test ordering and interpretation.
  • Process transactions securely.
  • Communicate with you regarding inquiries, updates, and educational resources.
  • Conduct marketing (with your explicit opt-in consent).
  • Analyse website performance using cookies and analytics.

4. Sharing and Disclosure of Data

We do not sell or rent your data. Your information may be shared with:

  • Authorised Team Members – Only specific personnel who need access to provide services.
  • Third-Party Service Providers – Such as Stripe (payments), Google Drive/Notion (data storage), and analytics tools.
  • Laboratory Providers – To facilitate lab orders; results may be shared with you and, if requested, with your healthcare provider.

5. Data Storage and Security

Your data is stored securely in:

  • Google Drive & Notion – For client records and notes. While Notion is GDPR-compliant, we avoid storing highly sensitive data there. If you perceive any data to be highly sensitive, you must let us know and we can add additional layers of protection.
  • WhatsApp – Used for 24/7 coaching, with end-to-end encryption.
  • Email Communications – For lab result interpretations and coaching-related correspondence.

We apply encryption and access controls to protect data. However, no system is 100% secure, so we recommend clients avoid sending highly sensitive information via email or messaging apps.

We use third-party providers such as Google Drive, Notion, and Stripe, which implement their own security and compliance measures. While we take reasonable steps to ensure these providers comply with UK GDPR, we are not responsible for any data breaches or compliance failures on their part.

6. Data Retention

We retain personal data only as long as necessary for legal, contractual, or business needs:

  • Health Records: Retained for 8 years from the last interaction (in line with medical data guidelines).
  • Marketing Emails: Until you unsubscribe.
  • Client Requests for Deletion: We will delete your data upon request unless retention is legally required.

7. Your Rights Under UK GDPR

You have the right to:

  • Access your personal data.
  • Correct inaccurate or incomplete data.
  • Request deletion of your data (except where legally required to retain it).
  • Restrict processing of your data.
  • Object to data processing.
  • Withdraw consent at any time.

To exercise your rights, contact us at gemma@itspsoriasis.co.

8. Children’s Privacy

Our services are primarily designed for adults; however, we may work with children under the supervision and consent of their parent or legal guardian. We do not collect personal data directly from children. Any information related to a child’s health is provided by the parent or guardian, and we ensure it is handled securely and in compliance with UK GDPR. If you believe a child’s data has been shared with us without parental consent, please contact us at gemma@itspsoriasis.co and we will take appropriate action.

9. Health Information Disclaimer

Our services are for educational and informational purposes only. We do not diagnose, treat, or prescribe for any medical condition. The information provided in consultations, emails, or any other communication is not a substitute for professional medical advice. Always consult a qualified healthcare provider before making any health decisions.

10. ICO Registration

We are registered with the UK Information Commissioner’s Office (ICO) under registration number [Insert Number]. You can contact the ICO at www.ico.org.uk if you have concerns about our data handling.

11. Call Recording & AI Processing

We may record coaching calls or use AI-based tools to summarise lab results only upon client request. Recordings are stored securely and deleted after 12 months (most clients want long term access to recordings about their labs so this can be extended upon request). Clients can request deletion or opt out at any time.