Last updated: October 2026

MAKEWELL PRIVACY NOTICE

Makewell ensures that all client details and records are kept in the strictest confidence. We collect information about you to:

Make sure your care is safe and effective
Work effectively with other professionals involved in your care
Comply with legal obligations

This Privacy Notice explains how Makewell may use any personal information we collect about you when you use our website, use any Makewell products and services or communicate with Makewell. This Notice covers the following areas:

Who is responsible for your data
Personal data we collect about you
Categories of data we collect
Sensitive personal data
How and why we use your personal data
Telephone Conversations
Text Messages
Use of Artificial Intelligence
Requesting access, correction or deletion of your data
Young People’s Information
Sharing your personal data
Financial Data sharing and Third parties
Security of your personal data
Disclosure of your personal data
Cookies
Updates to our Privacy Notice
How to contact us
References

1. Who is responsible for your data

Our Data Controllers work as a team, jointly determining the purposes of how the data is managed. This team is:

Chief Operating Officer

Director of Nursing and Quality

Director of Operations

Director of Services

You can contact them via

Phone	0845 4238993
Email	bookings@ecgtraining.co.uk
Post	ECG The Gatehouse, Bradwell Abbey, Alston Drive, Milton Keynes, MK13 9AP

2. Personal data we collect about you

When using the term “personal data” in our Privacy Notice, we mean information that relates to you and allows us to identify you, either directly or in combination with other information that we may hold.

We collect some personal data from you, for example, when you use our website, use our services or contact us.

Your personal data may include your name, your contact details, information on how you use our website or how you interact with us.

3. Categories of data we collect

We may collect and process the following information about you:

Your name,
Your contact details (email address, telephone number(s), postal address)
Information about your transaction, including your payment card details when you purchase products or services
When you create an account.
When you register on our website, when you take part in our competitions, or when you choose an offer that we make available on our website
Information about your bookings, if you require special assistance or other requirements
Information about your health, if you have a medical condition that may affect your treatment (please see section “Sensitive personal data” below for more information)
The communications you exchange with us (for example, your emails, letters or telephone calls)
When you contact Makewell or you are contacted by Makewell
Your feedback
When you reply to our requests for feedback or participate in our customer surveys

4. Sensitive personal data

In the course of providing services to you, we may collect information about your

racial or ethnic origin, physical or mental health, or religious beliefs. Under UK data protection law (UK GDPR), this is called “special category data” and has extra protection.

For example, we may collect this information in the following circumstances:

To assess your health, provide advice and supply appropriate treatment.
We use your health information because we need it to provide your care. The law allows this where care is given by, or under the responsibility of, a health professional who has a duty of confidentiality (UK GDPR Article 9(2)(h)). We also need it to provide the service you have asked us for (UK GDPR Article 6(1)(b)).

This means we do not rely on your consent to keep and use your clinical record. This is separate from your consent to treatment, which we will always ask for. We will ask for your consent separately for anything that is not part of your care, such as sharing anonymised information for research (see section 11). If you choose not to share health information with us, we may not be able to provide some or all of the services you have asked for.

This information is always kept confidential with access restricted to health care professionals and members of our clinical team. The data is stored to meet the highest standards of data security.

5. How and why we use your personal data

Data will be processed by in accordance with the type of product or service required. We use your personal data for the following purposes:

Processing of orders for products and services
For contractual purposes to provide the product or service ordered.
To communicate with you and manage our relationship with you
To assess, deliver, and monitor healthcare services, including the recording, storage and use of clinical information for the purposes of assessment, treatment and ongoing monitoring of healthcare conditions.
To improve our services and experiences for customers.
The business purposes for which we will use your information include accounting, billing and audit, credit or other payment card verification along with anonymised statistical and marketing analysis.
To comply with our legal obligations.

6. Telephone Conversations

We may record telephone conversations for quality assurance, training purposes, and to comply with regulatory requirements. When recording calls, we will always inform you at the start of the call that the conversation is being recorded and obtain your consent to do so, unless the recording is necessary to fulfil a legal obligation or is in the legitimate interests of our business, in which case we will provide you with clear notice of this practice in our privacy policy. We will cease recording when taking payment details.

7. Text Messages

We may text you appointment reminders or brief administrative messages, but only if you have opted in to receive texts, for example when you book. You can withdraw this consent at any time. Text messages are not a secure or encrypted way to send information, so we will never send clinical detail, results or other sensitive information by text.

8. Use of Artificial Intelligence

We may use AI tools, such as an AI scribe, to help record or summarise your consultation. Where this happens, we will tell you before or during your appointment and you can decline. Any AI tool used in this way is checked and approved by us before use, and a member of our clinical team always checks the accuracy of anything it produces before it is relied on or added to your record.

9. Requesting access, correction or deletion of your data

You have a right to request access to the data that we hold about you. If you would like to request a copy of some or all of the data that Makewell holds about you, please email bookings@wemakewell.co.uk. You will then be sent a copy of our Subject Access Request Policy which sets out what we require to deal with your request.

You can also ask us to delete personal data we hold about you. This does not usually apply to your healthcare record once you have received an assessment or treatment from us, because we have a legal and professional duty to keep clinical records for minimum periods set by law. Where this does not apply – for example, to marketing preferences or an enquiry that did not lead to treatment – we will delete your information in line with our standard retention periods.

If you think something in your record is wrong, you can ask us to correct it. Where the information is factual, such as your address or date of birth, we will update it. Where it is a clinician’s professional opinion, we may not be able to change it, but we will add a note to your record setting out your view.

10. Young People’s Information

If you are aged 16 or 17, you are legally able to consent to your own healthcare and to control access to your own health information in the same way as an adult. This means a parent or guardian will not be given access to your records, or told about your care, without your consent, even if they made or paid for your appointment. If you are under 16, the same may apply if your clinician assesses that you are able to understand and consent to your own treatment.

11. Sharing your personal data

All client details and records are kept in the strictest of confidence.
We share your information with other organisations only where this is needed to deliver your care, and only with the following types of service provider:
- Clinical software providers: secure, cloud-based systems that hold your clinical record and support your care, such as our booking, records and consultation software. Your information is stored in the UK or the EU, with appropriate safeguards in place.
- Accredited diagnostic laboratories: when you have a test, we send your sample to a regulated laboratory for processing, together with the details needed to match it to you. The laboratory sends the results back to us.
- Specialist assessment and reporting services: for some checks, we send images or recordings taken during your appointment to a specialist provider, who reviews them and reports back to our clinician. This includes skin and mole images for dermatology review, ear images for ear assessments, and heart traces (ECGs) for interpretation.
- Online assessment and questionnaire providers: for some assessments, such as ADHD questionnaires, we will send you a link to complete a form on a specialist provider’s secure website. We share only the details needed to set this up, such as your name and email address. The provider sends the results to us so that we can use them in your assessment.

Each of these providers has a written agreement with us. This requires them to keep your information secure and confidential, and to use it only to provide their service to us.
We keep an up-to-date list of the providers we currently use. If you would like a copy, please contact us (see section 17).
Makewell will not share your information with any other third party, including other health services without your explicit permission. However, there are rare exceptions to this principle. These exceptions include situations where we are legally required to share information, such as when mandated by a court order, or if there is a serious risk to your safety or the safety of others.
Makewell will not share your information for marketing purposes with any companies outside Makewell.
With your consent, we may share anonymised information about your care with trusted research organisations, such as universities with ethical approval and a signed data-sharing agreement, to support health and care research. This anonymised information will never be sold or used for commercial purposes, and choosing not to take part will never affect your care.

Through our website we may provide links to third-party websites. When you link to other websites you should read their own privacy policies/notices. Please be aware that this Privacy Notice does not apply to such websites and Makewell Is not responsible for your information that third parties may collect through these websites.

12. Financial Data sharing and Third parties

Worldpay: Your payment details are transmitted securely to Worldpay for verification and payment processing. Worldpay adheres to strict data protection regulations and uses advanced encryption to safeguard your information. For more details on how Worldpay handles your data, you can review their Privacy Notice.

Stripe: If you opt to pay through Stripe (for example, via online payment links), your payment data is sent directly to Stripe. Stripe complies with leading security standards, including PCI-DSS (Payment Card Industry Data Security Standard), ensuring that your financial information is protected. More information about Stripe’s data protection practices is available in their Privacy Policy.

We do not store your full credit or debit card details on our systems. Instead, these details are securely handled by Worldpay or Stripe, depending on your payment method.

We only share financial information necessary to process payments and issue refunds. These providers are contractually obligated to handle your data in compliance with applicable data protection laws and to never use your information for any purpose other than processing payments on our behalf.

13. Security of your personal data

We are committed to taking appropriate measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage to that personal data. When you provide your personal data through our website this

information is transmitted across the internet securely using high-grade encryption. The information that you provide to us will be held in secure systems, which are located on our premises or those of an appointed third party.

Clinical Information: Clinical records are stored on a secure system in accordance with ISO 27001 information and security management.

Access to your records is limited to the staff directly involved in your care, and all access is logged. Looking at a record without a valid reason is treated as a serious disciplinary matter and may also be a criminal offence.

Financial Information: We take the security of your payment information seriously and implement strict measures to ensure it is protected against unauthorised access, disclosure, or misuse. Our security practices for payment data include the following:

Encrypted Transactions: All payment transactions made through our website or in-person systems are encrypted using industry-standard SSL (Secure Socket Layer) technology to protect your financial information during transmission.
Secure Payment Providers: We use trusted third-party payment processors, such as

Worldpay and Stripe, which comply with the Payment Card Industry Data Security Standard (PCI-DSS). This ensures that your card information is handled securely and never stored in an unprotected format.

No Local Card Storage: We do not store your full credit or debit card information on our systems. Instead, payments are processed directly by Worldpay or Stripe, and they handle the secure storage of card information as required by their security standards.
Access Control: Access to payment-related records, such as billing information and receipts, is restricted to authorised personnel who require it to perform their duties (e.g., issuing refunds or resolving payment queries).

Disclosure of your personal data.

As described in this Privacy Notice, there are some instances where we need to disclose your personal data to third parties. Where Makewell discloses your personal data to a third party, we require that third party to have appropriate measures in place to protect your personal data; however, in some instances we may be compelled by law to disclose your personal data to a third party and have limited control over how it is protected by that party.

We will retain your personal data for as long as we need it in order to fulfil our purposes set out in this Privacy Notice or in order to comply with the law.

Clinical Records will be retained in accordance with statutory guidance and best practice. If you make an enquiry that does not lead to a booked appointment, we will keep your enquiry details for 3 months from your last contact with us, after which they will be deleted or anonymised, unless you ask us to stay in touch.

15. Cookies

In order to improve our services, to provide you with more relevant content and to analyse how visitors use our website, we use technologies, such as cookies. We will not be able to identify you from the information we collect using these technologies.

You can delete cookies if you wish; while certain cookies are necessary for viewing and navigating on our website, most of the features will still be accessible without cookies. For more information on how we use cookies and how you can remove them, please read our Cookie Policy on the website.

16. Updates to our Privacy Notice

We review this Privacy Notice on a regular basis and will publish any new version on the website. This Notice was last reviewed and/or updated in October 2026.

How to contact us:

Please contact us if you have any questions about our Privacy Notice addressed to Bookings@Makewell.co.uk

If you are unhappy with how we have handled your information, please contact us first so that we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), which regulates data protection in the UK:

Website: ico.org.uk/make-a-complaint

Phone: 0303 123 1113

References:

Records Management Code of Practice 2021 https://transform.england.nhs.uk/media/documents/NHSX_Records_Management_CoP_V7.pdf