Privacy Policy

Hatt Clinic is committed to protecting your personal data and being transparent about how we use it. This policy explains what information we collect, why we collect it, how long we keep it, and your rights in relation to it.

This policy applies to data collected via our website, by telephone, by email, and in the course of providing clinical services.

Data Controller: Hatt Clinic, Couch Lane, Devizes, SN10 1EB
Email: sue@hattclinic.co.uk

This policy was last updated in August 2026.

How We Collect Your Information

We collect information in the following ways:

• When you contact us — you voluntarily provide your name, email address, phone number, and any other information you choose to share with us.
• When you sign up for our newsletter — you provide your name and email address so we can send you our latest news, advice, and offers at periodic intervals. Every newsletter includes an unsubscribe link so you can opt out at any time.
• When you use our website — we collect certain technical data automatically through cookies. Further details are set out in the Cookies section below.
• When you become a patient — we collect and maintain medical and treatment records in the course of delivering the services you have purchased.

Why We Process Your Personal Data (Lawful Basis)

Under UK data protection law (UK GDPR and the Data Protection Act 2018), we must have a lawful basis each time we process your personal data. The table below sets out what we use your data for and the legal basis we rely on in each case.

Data Transfers to Third Parties

PPS (Patient Partnership System)

We use PPS, a specialist clinical patient management system, to securely store and manage your patient records. PPS is password protected and is only accessible to authorised members of Hatt Clinic staff. PPS acts as a data processor on our behalf and is not permitted to use your data for any other purpose.

Google Analytics

Google Analytics is a web analytics service provided by Google, Inc., which helps us understand how our website is used. Information about your use of our website, including your IP address, may be transmitted to and stored on Google’s servers. We use this information to compile reports and improve the site. The data collected is anonymised and includes the number of visitors, where visitors have come from, and which pages they visited.

More information: Google Privacy Policy
To opt out of Google Analytics tracking across all websites: Google Analytics Opt-out

YouTube

We use YouTube to host and display video content on our website. YouTube cookies are only activated when you press play on a video.

More information: Google / YouTube Privacy Policy

Facebook Pixel

We use Facebook Pixel to help us reach our existing audience on Facebook with relevant content. This data is retained for between 30 and 180 days.

We do not sell your personal data to any third party. Where we share data with third parties, we ensure they are under contractual obligations to handle it in accordance with UK data protection law.

Cookies

Cookies are small text files placed on your device when you visit our website. We use persistent cookies (which remain until you or your browser deletes them) to help improve your experience.

When you visit our website for the first time, you will see a cookie notice. By continuing to browse, you consent to our use of cookies as described in this policy.

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For guidance on managing cookies in your browser, visit the relevant support page:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law.

• Patient medical and treatment records — we retain these for a minimum of 7 years in accordance with our legal obligations. In practice, we retain records indefinitely to support continuity of care should you return to us in the future. You have the right to request deletion of your records once the 7-year minimum period has elapsed, subject to any ongoing legal obligations at that time.
• Marketing and newsletter data — retained until you withdraw your consent to receive communications, at which point we will remove you from our mailing list promptly.
• General enquiry and contact data — retained for a reasonable period to handle your enquiry and for up to 2 years thereafter in case of any follow-up.

Your Rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure — you can ask us to delete your data where there is no longer a lawful reason to hold it (subject to our legal retention obligations, as described above).
• Right to restriction — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — you can ask us to provide your data in a portable, machine-readable format.
• Right to object — you can object to us processing your data on the basis of legitimate interests, or for direct marketing purposes.
• Right to withdraw consent — where we rely on your consent to process data (e.g. for marketing), you can withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact our Data Protection Officer at sue@hattclinic.co.uk. We will respond within one calendar month of receiving your request.

Complaints

If you are unhappy about the way we have used your information, please email our Data Protection Officer directly at sue@hattclinic.co.uk.

On receipt of your complaint we will:

• Verify your identity
• Acknowledge your complaint
• Investigate your complaint promptly
• Let you know when you can expect a response from us
• Let you know the outcome and the measures we are taking to prevent a recurrence

If you are not satisfied with the outcome of our investigation, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO):