MeadoWell Therapies Ltd Data Protection and Privacy Policy

Your data: your rights

Last updated: 10 August 2026

info@meadowelltherapies.co.uk | www.meadowelltherapies.co.uk

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website or engage with our clinical services. We are committed to maintaining the highest standards of confidentiality and data protection in accordance with UK GDPR, the Data Protection Act 2018, and relevant professional regulations. By using our website or services, you agree to the terms of this Privacy Policy

Who We Are: We are a clinical service providing psychological therapy, neurodevelopmental assessment, rehabilitation, occupational therapy, and related professional support. Our clinicians are registered with the Health and Care Professions Council (HCPC) and other relevant professional bodies. Our website is hosted and managed through Squarespace

What is personal data? Personal data is information that can identify a living individual, either on its own or together with other information. Examples include your name, contact details, referral information and health information. Health data is special category data and receives extra legal protection. Processing means collecting, using, storing, sharing or deleting data.

Who controls your data? MeadoWell Therapies Ltd is committed to protecting and respecting your privacy. For the purposes of data protection laws, MeadoWell Therapies Ltd is the “controller” of the processing of your personal data. That means that we decide why and how your personal information is processed and are responsible to you under the law for that processing. MeadoWell Therapies Ltd is registered with the Information Commissioner’s Office (ICO), the UK’s independent body that oversees data rights and privacy, with registration number ZC188763.Notification details for MeadoWell Therapies Ltd can be accessed by searching the Information Commissioner’s Office Data Protection Public Register using registration number ZC188763.

Data protection leads: MeadoWell Therapies Ltd has not appointed a separate Data Protection Officer. The Directors of the Company, Dr Suzannah Ritter and Rachel Mayne, are the named data protection leads for privacy questions and rights requests. You can contact them at info@meadowelltherapies.co.uk.

What data does MeadoWell Therapies Ltd collect? We may collect the following types of information:

Information you provide directly:

• Contact details (name, email address, phone number)

• Information submitted through forms or enquiries

• Clinical or assessment information shared during therapy or consultation

• Preferences or communication choices

Information collected automatically:

• IP address

• Browser type

• Device information

• Website usage data (e.g., pages visited, links clicked)

• Cookie and analytics data (see Cookie Section)

Information from third‑party providers

• If you use integrated services (e.g., payment processors, scheduling tools), we may receive information from those providers.

How your data is used:

• Provide therapy, assessment, rehabilitation, and consultation services

• Respond to enquiries and manage appointments

• Maintain clinical records in line with professional standards

• Improve our website and services

• Ensure security and prevent misuse

• Comply with legal, regulatory, and professional obligations

If you do not provide information we reasonably need, we may be unable to provide services to you. We will not share your personal information with third parties for marketing purposes.

Special category health data: Some information we process, including medical history, current medications, clinical notes, questionnaires and information about mental or physical health, is special category data. Where we process this information, we identify both an Article 6 lawful basis and an Article 9 condition. For clinical care, this will usually be because processing is necessary for health care or treatment by professionals subject to confidentiality obligations. Where required by the Data Protection Act 2018, we will maintain appropriate internal accountability documentation for special category data, including relevant Schedule 1 conditions, safeguards and retention information.

Lawful bases for processing personal data:

The exact lawful basis we rely on depends on the purpose of the processing. The table above explains the main purposes and the lawful basis that applies to each. We document our lawful bases internally before processing personal data. Where we rely on legitimate interests, we consider and balance our interests against your rights and freedoms. Where we rely on consent or explicit consent, you can withdraw that consent at any time, although this will not affect processing that has already taken place before withdrawal (See table below).

Cookies and Website Technologies: Our website uses cookies and similar technologies to ensure the site functions correctly, support security, improve your browsing experience, and help us understand how visitors use our services. Some cookies are essential for the website to operate, while others are optional and used only with your consent. You can remove or disable cookies at any time through your browser settings. Please note that disabling certain cookies may affect website functionality.

Types of Cookies We Use

1. Strictly Necessary Cookies: These cookies are required for the website to function and cannot be switched off. They support security, enable page navigation, allow forms to operate, and provide services you request. These cookies do not usually require consent.

2. Analytics and Performance Cookies: These cookies help us understand how visitors use our website, including which pages are visited and how the site performs. We only use analytics cookies where consent is required and has been given, unless a lawful exemption applies. Analytics may be provided by Squarespace or trusted third‑party providers such as Google Analytics (if enabled).

3. Functionality Cookies: These cookies remember choices you make, such as preferences or form settings, where applicable.

4. Third‑Party Cookies and Technologies: Our website is hosted and managed through Squarespace. Third‑party cookies may be set by trusted providers that support website functionality, security, forms, analytics, or service delivery. Details of any cookies used should be available through our cookie settings tool or cookie notice.

Managing Your Cookie Preferences: You can accept, reject, or manage non‑essential cookies through our cookie banner or cookie settings tool (where available). You may change your preferences at any time. Non‑essential cookies will not be set before you have given consent, unless a lawful exemption applies.

Cookie Provider List: Squarespace provides a current list of cookies and similar technologies used on websites hosted on its platform. This list should be available through our cookie settings tool or cookie notice and includes each cookie’s purpose, category, duration, and whether it is first‑party or third‑party

How your data is protected: We use secure systems and industry‑standard safeguards to protect your information. Clinical records are stored in line with HCPC, professional, and legal requirements. We do not sell your information or share it for marketing purposes

Who can access your data? We may share information with:

• Clinical team members involved in your care

• Trusted service providers (e.g., Squarespace, scheduling systems, secure email providers)

• Legal or regulatory bodies where required

• Emergency services if necessary to protect safety

We only share the minimum information necessary.

How long do we keep your information? We follow applicable professional, regulatory and legal record-keeping requirements. We only retain information for as long as necessary for clinical, legal, or regulatory purposes. MeadoWell Therapies Ltd keeps adult clinical records for seven years after treatment ends. For children and young people, clinical records will usually be kept until the client reaches age 25, or for seven years after treatment ends, whichever is later. Records relating to safeguarding, complaints, legal claims, supervision, website use, financial matters or other legal, regulatory, professional, accounting or tax requirements may be kept for different or longer periods where this is necessary for the purpose for which the information was collected. Website and analytics data will only be kept in identifiable form for as long as necessary for the purposes for which it was collected. Anonymous or aggregated website analytics may be retained for longer to help us understand long-term trends.

Your data rights: Under UK GDPR, you have the right to:

• Be informed about how your personal information is used

• Access your information

• Request corrections to inaccurate or incomplete information

• Request deletion of your information (where applicable)

• Restrict processing of your information

• Object to certain types of processing

• Withdraw consent at any time, where consent is the lawful basis

• Request data portability

• Object to automated decision‑making and profiling

We do not use automated decision‑making or profiling that has legal or significant effects.

You can exercise your rights by contacting us. You also have the right to raise concerns with the Information Commissioner’s Office (ICO)You can find more information at ico.org.uk or contact the ICO by telephone on 0303 123 1113.

International data transfers: Squarespace and other providers may store data on servers outside the UK. Where this occurs, appropriate safeguards (such as Standard Contractual Clauses) are used to protect your information.

Data breach protocol: If a personal data breach happens, we will take prompt action to contain and assess it. We will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach if it is likely to result in a risk to people’s rights and freedoms. If the breach is likely to result in a high risk to you, we will also tell you without undue delay, explain what data was affected where possible, and describe the steps we have taken or recommend to reduce the risk. We will keep a record of personal data breaches, whether or not they are reported to the ICO. If you suspect a data breach, please contact your named Associate and MeadoWell Therapies Ltd immediately at info@meadowelltherapies.co.uk.

To reduce risk, we double-check email addresses before sending and encourage password protection for any sensitive documents sent to us. We will password protect documents containing your data before sending them by email where appropriate. If an email is sent to the wrong address, we will try to recall the email immediately if our system allows this, promptly ask the recipient to delete the email, assess the risk to your rights and freedoms, notify the ICO where required, and tell you where the law requires us to do so.

Links to other websites: Our website may contain hyperlinks to websites that are not operated by us. These links are provided for your reference and convenience only and do not imply endorsement of those third-party websites or any association with their operators. We do not control these websites and are not responsible for their personal data practices. We encourage you to review the privacy policy on any website you visit before using that site or providing personal data.

Changes to this policy and governing law: We may update this policy if our services, website features, communication methods or data protection practices change. If we make changes, we will update this page and encourage you to check it regularly. This policy is governed by the laws of England and is incorporated by reference into our terms and conditions of service where applicable.

Contacting us: For any enquiries, please contact MeadoWell Therapies Ltd at info@meadowelltherapies.co.uk or by post at MeadoWell Therapies Ltd, R1 & R2 Wellbeing Hub South, Mamhilad House, Mamhilad Park Estate, Pontypool, NP4 0HZ. Company number: 17204823. ICO registration number: ZC188763.