Last updated: 29 August 2026
Co Wellbeing Clinic (“we”, “us” or “our”) is committed to protecting your privacy and handling your personal information responsibly.
This policy explains what information we collect, why we use it, who it may be shared with, how long it is retained and the rights you have under the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations and the Data (Use and Access) Act 2025.
This policy applies to visitors to cowellbeingclinic.co.uk and to people who contact us, book an appointment or receive a service from us.
1. Who we are
Co Wellbeing Clinic is operated by Kelly Ruddy as a sole trader.
Clinic address:
Eternal Clinic
22 Heddon Court Parade
Cockfosters Road
Cockfosters
EN4 0DB
Email: hello@cowellbeingclinic.co.uk
Telephone: 07903 723394
Kelly Ruddy, trading as Co Wellbeing Clinic, is the data controller for personal information collected through this website and through the services we provide, except where a test provider, nutritional therapist or laboratory is separately responsible for a test, laboratory service or treatment pathway.
2. Information we collect
The information we collect depends on how you interact with us.
Enquiries and bookings
When you contact us through the website, by telephone, email, WhatsApp or social media, we may collect:
Your name.
Your telephone number.
Your email address.
The content of your enquiry.
The service you are interested in.
Your appointment and booking information.
Records of our correspondence with you.
Consultation and treatment information
Where necessary to provide a service safely, we may collect:
Your date of birth.
Your address and emergency-contact details.
Relevant medical history.
Information about medications and supplements.
Allergies and sensitivities.
Previous treatments.
Pregnancy or breastfeeding information.
Relevant health conditions, symptoms or concerns.
Consultation, consent and treatment records.
Treatment photographs, where appropriate and with your permission.
Adverse-reaction, incident or aftercare information.
Sample-collection information
Where we are engaged solely to collect a blood or other sample on behalf of a test provider, nutritional therapist or laboratory, we collect and use only the information reasonably required to:
Confirm your identity.
Carry out the sample collection safely.
Label and prepare the sample correctly.
Complete the required documentation.
Arrange secure handover or dispatch.
In these circumstances, you remain the client of the test provider, nutritional therapist or laboratory that arranged the test.
Co Wellbeing Clinic does not analyse the sample, select or control the laboratory, receive or interpret the resulting report or advise you on the meaning of the results.
Payments and financial information
We may collect information required to:
Take or record payment.
Issue invoices or receipts.
Process refunds.
Maintain accounting and tax records.
We do not normally store complete payment-card details. Card information is processed by the relevant payment provider.
Children’s information
Where a parent or legal guardian arranges a paediatric blood-collection appointment, we may collect:
The child’s name and date of birth.
Information required to identify the child.
Relevant health and safety information.
Details of the parent or legal guardian.
Consent and appointment records.
Website information
When you visit the website, we may collect:
Your IP address.
Browser and device information.
Pages visited and time spent on the website.
General location information derived from your IP address.
Cookie choices and website preferences.
Technical information required to maintain website security.
3. How we use your information
We may use personal information to:
Respond to enquiries.
Arrange, confirm and manage appointments.
Provide consultations and treatments.
Assess whether a service is suitable and safe.
Provide appropriate aftercare.
Collect and prepare samples for secure handover or dispatch.
Take payments and maintain financial records.
Communicate with you about an appointment or service.
Respond to complaints, incidents or safety concerns.
Maintain clinical and administrative records.
Comply with legal, regulatory, insurance and safeguarding requirements.
Establish, exercise or defend legal claims.
Maintain the security and operation of our website.
Understand how visitors use the website and improve its content.
Send marketing information where you have consented or where the law otherwise permits it.
We do not sell personal information.
4. Our lawful bases
We process personal information only where we have a lawful basis.
Depending on the circumstances, we may rely on:
Contract
Processing may be necessary to respond to a request before you book or to provide and manage the service you have requested.
Legal obligation
We may need to process or retain information to comply with tax, accounting, insurance, safeguarding, professional, regulatory or other legal obligations.
Legitimate interests
We may use information where reasonably necessary for the operation and protection of the clinic, including:
Business administration.
Appointment management.
Website and information security.
Service improvement.
Fraud prevention.
Responding to complaints.
Defending legal claims.
We consider the effect on your rights before relying on legitimate interests.
Consent
We may rely on your consent for:
Processing health or genetic information where explicit consent is appropriate.
Optional website cookies.
Marketing communications.
Publishing testimonials.
Using identifiable photographs or videos for promotional purposes.
You may withdraw consent at any time. Withdrawal does not affect processing that lawfully took place before consent was withdrawn.
Vital interests
In an emergency, we may use or disclose information where necessary to protect someone’s life and consent cannot reasonably be obtained.
5. Health and genetic information
Information about your physical or mental health and genetic information is classed as special-category data and receives additional legal protection.
We may collect limited health information where it is necessary to:
Assess whether a treatment or sample-collection procedure can be performed safely.
Tailor a treatment appropriately.
Provide aftercare.
Respond to an adverse reaction or emergency.
Meet clinical, insurance, safeguarding or legal requirements.
We normally process this information with your explicit consent.
Where we collect a sample on behalf of a test provider, nutritional therapist or laboratory, we do not analyse the sample or receive or interpret the resulting report.
Questions about the analysis, results, storage or subsequent use of an externally commissioned sample should be directed to the test provider, nutritional therapist or laboratory responsible for the test.
You may withdraw consent to optional processing. However, we may be unable to provide a treatment or sample-collection service without information that is necessary to perform it safely.
6. Children’s information
We take particular care when processing children’s personal and health information.
A parent or legal guardian must normally provide consent for a paediatric appointment and must attend or properly authorise the appointment.
Information about a child is used only for the appointment, related administration, safety, safeguarding and required record-keeping.
We do not knowingly use children’s information for targeted advertising.
7. Who we share information with
We share personal information only where reasonably necessary to provide a requested service, operate the clinic or comply with the law.
Depending on the circumstances, recipients may include:
A test provider, nutritional therapist or laboratory responsible for arranging or processing a test.
A courier responsible for transporting a sample.
Bloods & Beyond Ltd where a service is provided under its governance arrangements.
Goodbody Wellness Ltd where it is independently responsible for a blood-testing service.
A prescriber where a treatment requires a patient-specific prescription.
Payment, banking and accounting providers.
Website, hosting, email and IT-support providers.
Insurers and professional advisers.
Regulators, professional bodies or safeguarding authorities.
Emergency services.
Courts, law-enforcement agencies or public authorities where disclosure is required or permitted by law.
Where Goodbody Wellness Ltd or another test provider, nutritional therapist or laboratory manages a test independently, that organisation is responsible for its own processing, results and privacy information.
Sample collection for another professional or provider
Where Co Wellbeing Clinic collects a sample on behalf of a test provider, nutritional therapist or laboratory, we may pass the sample and the minimum necessary identifying information to the nominated recipient or courier.
Once the sample has been securely handed over, the test provider, nutritional therapist or laboratory responsible for commissioning and managing the test is responsible for its:
Analysis.
Laboratory processing.
Results.
Retention.
International transfers.
Subsequent use of the sample or associated information.
The privacy notice of the relevant test provider, nutritional therapist or laboratory will apply to those activities.
8. WhatsApp and social media
If you contact us through WhatsApp, Instagram or Facebook, your communication is also processed by the operator of that service.
These platforms are operated by Meta and have their own privacy policies and international-processing arrangements.
Please avoid sending detailed medical or highly sensitive information through social media unless it is necessary. We may ask you to continue a sensitive conversation through a more appropriate channel.
9. International transfers
Co Wellbeing Clinic does not determine whether a test provider, nutritional therapist or laboratory processes a sample or associated information outside the United Kingdom.
Any international transfer arranged as part of an externally commissioned test is the responsibility of the test provider, nutritional therapist or laboratory that commissions and manages the test. Its privacy notice should explain the relevant arrangements and safeguards.
Some of our technology, communications and website providers may process limited information outside the UK.
Where an international transfer is our responsibility, we use an appropriate legal mechanism where required, such as:
UK adequacy regulations.
The UK International Data Transfer Agreement.
An approved UK Addendum.
Another legally recognised safeguard.
Google Analytics may involve information being processed outside the UK, including in the United States. Google provides international-transfer safeguards for its services.
WhatsApp, Instagram and Facebook may also process information internationally under Meta’s privacy terms.
10. Cookies and similar technologies
The website uses cookies and similar technologies.
When you first visit, the cookie banner allows you to choose whether to accept optional cookies.
You can review or change your choice at any time by selecting “GDPR Cookie Settings” on the website. You can then enable or disable the available cookie categories and select “Save Changes”.
You can also manage cookies through your browser settings, although disabling essential cookies may affect website functionality.
Strictly necessary cookies
Some cookies are required for the website to operate, maintain security and remember cookie preferences.
These cookies do not require consent where an applicable exemption exists under the Privacy and Electronic Communications Regulations.
Analytics cookies
With your permission, we may use Google Analytics to understand how visitors use the website, including:
Which pages are visited.
How visitors reached the website.
Approximately how long visitors stay.
General browser and device information.
Analytics information helps us improve the website.
Optional analytics cookies will only be used where you have consented or where their use qualifies for a lawful low-risk exemption and all applicable transparency and objection requirements have been met.
Google Analytics cookies may include:
_ga: Used to distinguish website visitors. It normally expires after approximately two years.
ga[container ID]: Used to maintain session information. It normally expires after approximately two years.
Google Analytics is configured not to provide us with your complete IP address.
Advertising cookies
We do not currently use advertising, retargeting or social-media tracking cookies such as a Meta or Facebook advertising pixel.
If this changes, we will update this policy and provide appropriate cookie controls.
Google Fonts
The website may load fonts provided by Google. This can involve the visitor’s browser connecting to Google and transmitting technical information such as an IP address.
11. How long we keep information
We keep personal information for no longer than reasonably necessary.
Our normal retention periods are:
General enquiries that do not result in an appointment or booking: six months.
Clinical, consultation and treatment records: seven years from the date of the last appointment or treatment, unless a longer period is required by law, a regulator, safeguarding requirements, an insurer or a legal claim.
Sample-collection records: only for as long as necessary to complete the collection, handover and associated administrative, safety or legal record-keeping.
Financial, invoice and tax records: normally at least six years, in accordance with HMRC requirements.
Marketing records: until you unsubscribe, withdraw consent or the information is no longer required.
Cookie-preference records: for as long as required to remember and demonstrate your choices.
Complaints, incidents and legal claims: until the matter has concluded and the applicable legal limitation period has expired.
The test provider, nutritional therapist or laboratory responsible for an externally commissioned test determines how long the sample, laboratory results and associated testing records are retained.
When information is no longer required, it will be securely deleted or anonymised.
12. Your rights
Subject to applicable legal conditions and exemptions, you may have the right to:
Be informed about how your information is used.
Request access to your personal information.
Ask us to correct inaccurate or incomplete information.
Ask us to erase information.
Ask us to restrict how information is used.
Object to processing based on legitimate interests.
Object to direct marketing.
Receive certain information in a portable format.
Withdraw consent at any time.
Challenge certain automated decisions.
Complain about how your information has been handled.
When responding to an access request, we are required to carry out reasonable and proportionate searches.
We may ask for information to confirm your identity. If we reasonably require clarification or further information to respond to a request, the response period may be paused until the necessary information is received, where permitted by law.
There is normally no charge for exercising your rights. A reasonable fee may be charged, or a request refused, where the law permits this because a request is manifestly unfounded or excessive.
13. Automated decision-making
We do not make decisions about clients based solely on automated processing where those decisions have legal or similarly significant effects.
If this changes, we will provide appropriate information and safeguards, including the ability to:
Request human intervention.
Express your point of view.
Challenge a significant automated decision.
14. Data-protection complaints
If you are concerned about how we have used your information, please contact us using the details below.
Please provide enough information for us to understand and investigate your concern.
We will acknowledge a data-protection complaint within 30 days and respond without undue delay. We will explain the outcome of our investigation and any action taken.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the ICO.
15. Keeping information secure
We use appropriate technical and organisational measures to protect personal information against:
Unauthorised access.
Accidental loss.
Improper use.
Alteration.
Disclosure.
Destruction.
Measures include secure record storage, appropriate access controls, password protection and limiting access to people who need the information to perform their role.
Samples are labelled, stored and transported in accordance with the requirements applicable to the relevant collection service.
No internet, email or electronic-storage system can be guaranteed to be completely secure. Please contact us promptly if you believe your information has been lost, misused or disclosed improperly.
16. Third-party websites
The website contains links to external services, including WhatsApp, Instagram and Facebook.
We do not control external websites or their privacy practices. You should review the privacy information provided by an external service before submitting personal information.
17. Changes to this policy
We may update this policy when our services, suppliers, website technologies or legal obligations change.
The latest version will be published on this website with its revision date.
Where a change materially affects how existing information is used, we will take reasonable steps to notify those affected.
18. Contact us
If you have a question, wish to exercise a data-protection right or want to make a complaint, please contact:
Kelly Ruddy
Co Wellbeing Clinic
Eternal Clinic
22 Heddon Court Parade
Cockfosters Road
Cockfosters
EN4 0DB
Email: hello@cowellbeingclinic.co.uk
Telephone: 07903 723394
19. Blood Testing Services
Blood Testing Services Provided in Partnership with Goodbody Wellness Ltd
Blood sample collection (phlebotomy) at Co Wellbeing Clinic is provided on behalf of Goodbody Wellness Ltd.
Goodbody Wellness Ltd is the provider of the blood testing service and is registered with the Care Quality Commission (CQC) for the regulated activity of Diagnostic and Screening Procedures.
Co Wellbeing Clinic acts as a partner clinic for Goodbody Wellness Ltd and provides blood sample collection (phlebotomy) on Goodbody Wellness Ltd’s behalf. The blood testing service operates under the clinical governance, policies, procedures, quality assurance systems and regulatory oversight of Goodbody Wellness Ltd.
Goodbody Wellness Ltd is responsible for the clinical management, governance, laboratory arrangements, result reporting, clinical oversight and day-to-day management of the blood testing service. Blood samples collected at Co Wellbeing Clinic are processed by Goodbody Wellness Ltd’s approved laboratory partners, and results are reviewed and managed in accordance with Goodbody Wellness Ltd’s clinical governance framework.
At no point will Co Wellbeing Clinic have access to or interpret the results of the blood tests. Test results are sent directly to patients by Goodbody Wellness Ltd.