Everhealth Privacy Notice

Last updated: 3 October 2026

1. Who we are

​

Everhealth is operated by Everhealth Clinic Ltd ("Everhealth", "we", "us" or "our").

​

Company number: 17177482

​

Registered office:
Mike Griffiths & Partners
The Yew Tree Inn
High Street
Gresford
Wrexham
United Kingdom
LL12 8RF

​

Clinic:
Everhealth
The Grange Clinic
1 Hoole Road
Chester
CH2 3NQ

​

Email: everhealthclinic@outlook.com
Telephone: 01244 350 718

​

Everhealth Clinic Ltd is the data controller for personal information processed in connection with the healthcare services we provide and for most personal information collected directly through our website.

​

We are registered with the Information Commissioner's Office ("ICO"). Our registration number is ZC177295.

​

We do not currently have a formally appointed Data Protection Officer. Questions about the use of your personal information should be sent to:

everhealthclinic@outlook.com

​

2. About this notice

​

This Privacy Notice explains how Everhealth collects, uses, stores and shares personal information relating to:

• patients and prospective patients;

• people making enquiries about our services;

• people using our website or online booking facilities;

• people completing our health questionnaires or online assessments;

• people receiving communications from us; and

• other individuals whose personal information we need to process in connection with the provision of healthcare.

​

Because Everhealth provides medical services, some of the information we process is health information. Health information is treated as special-category personal data under UK data-protection law and receives additional protection.

​

3. The information we collect

​

Depending on how you interact with Everhealth, we may collect and process the following information.

​

Identification and contact information

​

This may include:

• your name;

• title;

• date of birth;

• postal address;

• email address;

• telephone number;

• confirmation that you are aged 18 or over; and

• details of your NHS GP or other healthcare professionals where relevant.

​

Appointment and administrative information

​

This may include:

• appointments booked;

• appointment history;

• services purchased;

• correspondence with Everhealth;

• referral information;

• payment and billing records; and

• information required to administer your care.

​

Health and medical information

​

This may include:

• current and previous medical conditions;

• symptoms;

• family medical history;

• medications and treatments;

• allergies;

• lifestyle information;

• diet, physical activity, sleep and other health behaviours;

• height, weight and body composition;

• blood pressure and other examination findings;

• consultation notes;

• diagnoses and clinical opinions;

• laboratory and diagnostic test results;

• risk assessments;

• treatment recommendations;

• prescriptions;

• correspondence relating to your healthcare; and

• information you provide through medical questionnaires or health assessments.

​

Some of this information is special-category personal data.

​

Information submitted through our website

​

If you make an online enquiry, we may collect information such as your:

• name;

• email address;

• telephone number;

• reason for contacting us;

• enquiry; and

• intended timescale for taking action

​

Please avoid including unnecessary sensitive medical information in a general website enquiry.

 

Where information submitted through an enquiry reveals information about your health, we will treat it as health information.

​

Online health assessments or quizzes

​

Where Everhealth makes an online health assessment or quiz available, your responses may reveal information about your health, lifestyle or potential health risks.

​

If an assessment asks you to provide your name or email address, we will explain at the point of collection what we intend to do with that information.

​

We will not use detailed clinical information from your medical record to target marketing communications to you.

​

Payment information

​

Payments are processed through Semble Pay and its payment service providers.

​

Everhealth does not directly receive or store your full payment-card details.

​

We may receive information confirming that a payment has been made, the amount paid and other information required for accounting and administration.

​

Website and advertising information

​

When you visit our website, information may be collected about your device and your interaction with the website.

​

This can include:

• IP address;

• device or browser information;

• pages visited;

• referring website or advertising campaign;

• advertising click identifiers; and

• information indicating whether an action, such as making an enquiry or booking an appointment, followed an advertisement.

​

We use Google Ads conversion measurement for this purpose.

​

Non-essential advertising technologies are subject to your cookie choices. Please see our Cookie Policy for further information.

​

4. Where we obtain your information

​

Most information is obtained directly from you.

​

We may also receive personal information from:

• Semble, through our patient booking, questionnaire and clinical-record system;

• Randox, where laboratory investigations have been undertaken;

• other laboratories, diagnostic organisations or healthcare providers involved in your care;

• pharmacies involved in dispensing medication prescribed for you;

• a health coach or other healthcare professional involved in your agreed care; or

• another organisation where you have asked or authorised that information to be sent to Everhealth.

​

We do not routinely obtain information directly from your NHS GP record.

​

5. Why we use your information and our lawful bases

​

UK data-protection law requires us to identify a lawful basis for processing personal information.

​

Where we process health information or another type of special-category personal information, we must also identify an additional condition permitting that processing.

​

Responding to enquiries

​

We use personal information to:

• respond to questions about Everhealth;

• determine which service may be appropriate;

• arrange an appointment where requested; and

• follow up an enquiry where appropriate.

​

Our lawful basis is normally:

​

Article 6(1)(b): processing necessary to take steps at your request before entering into a contract; and/or

​

Article 6(1)(f): our legitimate interests in responding to enquiries and operating our healthcare service.

​

Where an enquiry contains health information, we will only process that information where an appropriate special-category condition also applies.

​

Booking and administering healthcare

​

We use personal information to:

• register you as a patient;

• arrange appointments;

• issue reminders;

• administer payments;

• communicate with you;

• maintain appropriate records; and

• provide access to our secure patient portal.

• ​

Our principal lawful basis is:

​

Article 6(1)(b): processing necessary for the performance of our contract with you.

​

We may also process some administrative information to comply with legal obligations under Article 6(1)(c).

​

Providing healthcare

​

We process health information in order to:

​

• take a medical history;

• assess your health;

• undertake examinations;

• arrange investigations;

• interpret investigation results;

• assess health risks;

• reach clinical decisions;

• make recommendations;

• prescribe treatment where appropriate;

• provide follow-up care;

• make referrals; and

• maintain your clinical record.

​

Our principal lawful bases are:

​

Article 6(1)(b): processing necessary to provide the healthcare service you have requested; and

​

Article 9(2)(h): processing necessary for medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.

​

This processing is carried out by, or under the responsibility of, healthcare professionals who are subject to professional duties of confidentiality.

​

Where applicable, we rely on the corresponding health or social care condition in Schedule 1 of the Data Protection Act 2018.

​

Consent to medical treatment is separate from the lawful basis on which we process your clinical record.

​

Laboratory testing and diagnostic services

​

Where required for your care, we may provide appropriate personal and clinical information to laboratories and diagnostic services.

​

This may include your:

• name;

• date of birth;

• contact details;

• relevant examination findings;

• clinical information; and

• information required to identify and interpret the investigation.

​

We process this information under the same healthcare bases described above.

​

Prescriptions

​

Where medication is prescribed, relevant information may be shared with our dispensing pharmacy, currently including CloudRx, or another appropriate pharmacy.

​

This is done where necessary for the provision of your healthcare and for the safe supply of medication.

​

Referrals and communications with other clinicians

​

Where appropriate, we may share relevant information with:

• your NHS GP;

• private specialists;

• diagnostic providers; or

• other healthcare professionals involved in your care.

​

We will ordinarily do this with your knowledge and agreement.

​

There may be exceptional circumstances in which information needs to be disclosed without prior agreement, for example where disclosure is required by law or where there is a serious and overriding concern relating to safety. Any such disclosure would be considered carefully and limited to what is necessary.

​

Maintaining records and dealing with professional or legal matters

​

We may process information where necessary to:

• maintain appropriate medical records;

• investigate concerns or complaints;

• respond to regulatory requirements;

• obtain advice from our professional indemnity provider;

• establish, exercise or defend legal claims; or

• demonstrate the care that has been provided.

​

Depending on the circumstances, our lawful bases may include:

• compliance with a legal obligation;

• our legitimate interests in safely operating and defending the healthcare service; and

• where special-category information is involved, healthcare purposes or the establishment, exercise or defence of legal claims.

​

Accounting and financial administration

​

We retain relevant transactional information to manage our accounts and meet company and tax obligations.

​

Our lawful basis is Article 6(1)(c) where processing is required by law.

​

Direct marketing

​

We may occasionally contact existing or previous customers about Everhealth services where data-protection and electronic-marketing law allows us to do so.

​

We will only send electronic marketing where:

• you have consented; or

• the legal requirements allowing us to contact an existing customer about our own similar services are satisfied.

​

Every electronic marketing communication will provide a straightforward means of opting out.

You can also opt out by contacting:

everhealthclinic@outlook.com

​

We do not use the detailed contents of your medical record, test results, diagnoses or other clinical information to select or target you for marketing.

​

Website advertising measurement

​

We use Google Ads conversion tracking to understand whether advertising results in actions such as visits, enquiries or bookings.

​

Our use of non-essential advertising cookies or similar technologies is based on your consent through our cookie-management system.

​

You can refuse advertising cookies without preventing you from accessing Everhealth's healthcare services.

​

6. Use of Heidi AI clinical scribe

​

Everhealth may use Heidi as an AI-assisted clinical documentation tool during consultations.

​

Where Heidi is used, it may process speech from the consultation and generate a draft transcript or clinical note.

​

We will tell you when we propose to use Heidi and will only use it during your consultation where you agree to this.

​

Use of Heidi does not replace the clinician's professional judgement. The clinician remains responsible for reviewing and approving information that is entered into your medical record.

​

No diagnosis or treatment decision is made solely by Heidi.

​

Our lawful basis for processing information through the tool remains the provision of your healthcare under Article 6(1)(b) and Article 9(2)(h).

​

Your agreement to use the recording/scribing functionality is an additional safeguard and choice about how your consultation is documented; it is not relied upon as the sole legal basis for maintaining your medical record.

​

Information processed by Heidi is subject to the security, retention and processing arrangements applicable to Everhealth's use of the service.

​

7. Automated decision-making

​

Everhealth does not make clinical decisions about you solely through automated processing.

Risk calculations and other clinical assessments used by Everhealth are interpreted by a clinician and form only part of the clinical assessment.

​

8. Who we share information with

​

We only share personal information where necessary and appropriate.

​

Depending on your care, recipients may include:

​

Semble

​

Semble provides our:

• appointment and patient administration system;

• electronic medical record;

• patient questionnaires;

• secure patient portal;

• appointment communications; and

• payment functionality through Semble Pay.

​

Randox

​

Randox provides laboratory testing.

​

We may provide information including your name, date of birth and relevant clinical or examination information. Test results are made available to Everhealth through the Randox Nexus system.

​

The Grange Clinic and Zanda

​

Where you attend The Grange Clinic for phlebotomy, limited information such as your name, date of birth and email address may be provided through the clinic's Zanda booking system so that your appointment can be administered.

​

The Grange Clinic may also process information independently in connection with services it operates, including reception services and CCTV.

​

CCTV at The Grange Clinic is controlled by The Grange Clinic rather than Everhealth.

​

Pharmacies

​

Relevant prescription and patient information may be supplied to CloudRx or another dispensing pharmacy where medication is prescribed.

​

Healthcare professionals and diagnostic providers

​

Where clinically appropriate and with appropriate authority, information may be shared with:

• NHS GPs;

• private specialists;

• diagnostic services;

• laboratories;

• health coaches; and

• other healthcare professionals involved in your care.

​

Professional advisers and indemnity providers

​

Information may be disclosed where reasonably necessary to our:

• professional indemnity provider;

• legal advisers;

• accountants or other professional advisers; or

• regulators and public authorities where disclosure is required by law.

​

Only information relevant to the relevant purpose will be disclosed.

​

Technology suppliers

​

We use technology providers to operate our business and website, including services provided by organisations such as:

• Wix;

• Microsoft;

• Google;

• Semble;

• Heidi; and

• other providers necessary to operate Everhealth's secure systems.

​

Where an organisation processes information on our behalf, we require appropriate contractual and security arrangements.

​

Some suppliers may act as independent controllers for particular activities rather than as processors acting solely on Everhealth's instructions. Their own privacy notices may therefore also apply.

​

9. International transfers

​

Some of the technology providers supporting our website, communications and advertising operate internationally.

​

This means that, in some circumstances, personal information may be processed outside the United Kingdom.

​

Where a transfer of personal information from the UK is treated as a restricted international transfer, we require an appropriate mechanism to protect that information. Depending on the recipient and destination, this may include:

​

• UK adequacy regulations;

• participation in an applicable UK-approved data-transfer framework;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved standard contractual clauses; or

• another safeguard permitted by UK data-protection law.

​

We take additional care where health information is involved and seek to use services with appropriate healthcare security and data-protection arrangements.

​

10. How long we keep information

​

We do not keep personal information indefinitely.

​

Retention depends on the nature of the information, why we hold it, professional record-keeping requirements and applicable legal obligations.

​

Our normal retention periods are:

​

Adult clinical records

​

As Everhealth provides services only to adults, we generally retain clinical records for 8 years after the conclusion of treatment or the patient's last substantive episode of care.

​

Records may be retained for longer where this is justified, for example because:

• continuing care is being provided;

• a complaint, investigation or legal claim exists or is reasonably anticipated;

• a professional or regulatory requirement applies; or

• another lawful reason requires continued retention.

​

Accounting and payment records

Relevant accounting and transactional records will generally be retained for at least 6 years from the end of the relevant accounting period, or longer where required by law.

​

Everhealth does not retain full payment-card information.

​

General enquiries

General enquiries that do not result in a patient relationship will normally be retained for up to 12 months after the last substantive contact, unless there is a reason to retain them for longer.

If an enquiry becomes part of your clinical care, relevant information may instead become part of your clinical record.

​

Emails and administrative correspondence

Correspondence will be kept only for as long as necessary for the purpose for which it was received.

Where correspondence is clinically relevant, the relevant information may be transferred to the clinical record and retained in accordance with the clinical-record retention period.

​

Marketing information

Where you unsubscribe from marketing, we may retain limited information on a suppression list so that we can respect your preference not to receive further marketing.

​

Cookie and website information

Cookie and advertising information is retained according to the applicable cookie, consent-management and advertising settings. Further information is provided in our Cookie Policy.

At the end of an applicable retention period, information will be securely deleted or anonymised unless there is a lawful reason to retain it.

​

11. How we protect your information

​

Everhealth takes appropriate technical and organisational measures designed to protect personal information.

​

These include, as appropriate:

• using dedicated clinical-record systems;

• restricting access to authorised individuals;

• using secure patient portals for clinical correspondence;

• using professional healthcare systems for medical information;

• avoiding routine transmission of clinical information by ordinary, unsecure email;

• applying access controls and authentication;

• maintaining professional confidentiality; and

• selecting suppliers with appropriate security and data-protection arrangements.

​

No information system can be guaranteed to be completely secure, but we regularly consider the safeguards appropriate to the sensitivity of the information we process.

​

12. Email and communications

​

Routine appointment confirmations and notifications may be sent to the email address you provide.

​

Clinical documents and correspondence are normally made available through the secure Semble patient portal rather than being included directly in ordinary email.

​

You are responsible for providing accurate contact information and informing us if it changes.

​

13. Your rights

​

Subject to the circumstances and exemptions provided by data-protection law, you may have rights to:

• be informed about how your personal information is used;

• obtain access to personal information we hold about you;

• have inaccurate personal information corrected;

• request deletion of personal information in certain circumstances;

• request restriction of processing in certain circumstances;

• receive certain information in a portable format;

• object to certain processing based on legitimate interests;

• object to direct marketing; and

• withdraw consent where processing is based on consent.

​

These rights are not absolute.

​

For example, a request to erase information does not normally require a healthcare provider to delete information that it is legitimately required to retain as part of a medical record.

​

To exercise your rights, contact:

everhealthclinic@outlook.com

​

We may need to verify your identity before disclosing personal information.

​

14. Confidentiality and sharing medical information

​

Your medical information is treated as confidential.

​

Healthcare professionals working with Everhealth are subject to professional confidentiality requirements.

​

We will ordinarily obtain your agreement before sending information to your NHS GP, another clinician or another healthcare provider unless sharing is otherwise justified or required by law.

​

15. Complaints about the use of your information

​

If you have concerns about how Everhealth uses your personal information, please contact us first so that we can investigate:

everhealthclinic@outlook.com

​

You also have the right to complain to the UK's data-protection regulator:

​

Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113

Everhealth Clinic Ltd's ICO registration number is ZC177295.

​

16. Changes to this notice

​

We may update this Privacy Notice where our services, suppliers, technology or legal obligations change.

​

The date at the top of this notice shows when it was last updated.

​

Where a change would materially affect how we use existing patient information, we will take reasonable steps to bring the change to the attention of affected individuals.