Privacy policy
How we look after your information
Hoxton Clinic is the private clinic service of Spring Pharmacy, a family-run community pharmacy on Hoxton Street since 1987. This policy explains what personal information we collect when you visit our website, book an appointment or use our services, how we use it, who we share it with, and the choices and rights you have.
Last updated: 10 November 2026
1. Who we are
Hoxton Clinic is a trading name of Spring Pharmacy Limited, a company registered in England and Wales (company number 05755986). Our registered office is 8 Manor Park, Church Road, Great Barton, Bury St Edmunds, Suffolk IP31 2QR.
Our clinic and pharmacy are at 233–235 Hoxton Street, London N1 5LG. The pharmacy is registered with the General Pharmaceutical Council (GPhC premises number 1040300). Our Superintendent Pharmacist is Mitul Maisuria (GPhC 2210558).
Spring Pharmacy Limited is the controller of the personal information described in this policy. This means we decide how and why it is used, and we are responsible for looking after it.
2. How to contact us about your data
If you have a question about this policy or want to use any of your rights, please get in touch:
Email: springpharmacyuk@gmail.com
Phone: 020 7739 7482
Post: Data Protection, Spring Pharmacy, 233–235 Hoxton Street, London N1 5LG
3. The information we collect
Depending on how you use our services, we may collect:
Contact and booking details: your name, email address, phone number, date of birth, the service and appointment you choose, and any notes you add when booking.
Health information: details you give us for a consultation, such as your medical history, current medicines, allergies, symptoms, travel plans and vaccination history, your height, weight and BMI for weight management, and the outcome of your consultation, including any treatment, vaccine or medicine supplied.
Payment information: what you paid and when. Card payments are handled by our payment provider; we never see or store your full card number.
Communications: emails, messages and call notes when you contact us, and your preferences about reminders and marketing.
Website and device information: the pages you visit, how you reached our website (for example from a Google advert, including the advert click reference), your browser and device type, and your cookie choices.
Most of this comes directly from you. We may also receive information from your GP or another healthcare professional, or from a parent or guardian booking on behalf of a child.
4. How we use your information and why
UK data protection law says we must have a lawful basis for each way we use your information, and an additional condition for health information.
To book, confirm, remind you about and manage your appointments: to perform our contract with you (Article 6(1)(b) UK GDPR).
To assess you, provide your care and keep a clinical record: to perform our contract with you and, for health information, because it is needed to provide health care by or under the responsibility of a health professional bound by confidentiality (Article 9(2)(h) UK GDPR and Schedule 1, paragraph 2 of the Data Protection Act 2018).
To meet our legal and professional duties: including GPhC standards, record-keeping rules, safeguarding, and tax and accounting law (Article 6(1)(c)).
To answer enquiries, handle complaints and improve our services: our legitimate interests in running a safe, well-organised clinic (Article 6(1)(f)).
To measure how well our website and adverts work: our legitimate interests, and your consent where cookies are involved.
To send you news and offers about our services: only with your consent (Article 6(1)(a)), which you can withdraw at any time.
To establish, exercise or defend legal claims: our legitimate interests and, for health information, Article 9(2)(f).
We do not sell your personal information, and we do not make decisions about your care by automated means.
5. Appointment confirmations and reminders
When you book online, your appointment is created in our booking system. We use automated workflows to send you confirmations, reminders and follow-up messages about your appointment by email. These messages contain only what is needed to manage your appointment, such as your name and the service, time and location, and they are not used for marketing unless you have opted in.
You can tell us at any time if you would rather not receive reminder emails.
6. Who we share your information with
We only share what is necessary, and we expect everyone we share with to keep it secure and confidential.
Service providers who process data for us: our website and marketing partner YL Digital Ltd, which builds and supports our website, booking and automation systems; Cal.com, our online booking and scheduling system; n8n, the workflow automation platform that routes booking information and sends appointment confirmations and reminders; Framer, which hosts our website; and our email, payment and IT providers. Each acts only on our written instructions under a contract that requires them to protect your data.
Healthcare professionals: your GP or another clinician, where this is needed for your care and with your agreement, unless the law requires otherwise.
Advertising and analytics providers: Google, so we can measure whether our adverts lead to bookings. We share an advert click reference and the fact that a booking was made. We do not send Google your name, contact details or any details of your consultation.
Regulators and authorities: such as the GPhC, the Information Commissioner, the police or a court, where we are legally required to, or to protect someone from serious harm.
Professional advisers and insurers: such as our lawyers, accountants and professional indemnity insurers.
A new owner of the pharmacy: if the business is sold or reorganised, under strict confidentiality.
7. Cookies and advertising
Our website uses cookies and similar technologies. Essential cookies make the website and booking tools work. With your permission, we also use analytics and advertising cookies, including Google’s, to understand how visitors use the site and whether our adverts work. You can accept, reject or change your choices at any time using “Cookie Settings” at the bottom of every page.
If you reach us from a Google advert, our booking system may store the advert click reference with your booking so we can tell Google a booking took place. This helps us spend our advertising budget responsibly.
8. Transfers outside the UK
We aim to keep your information in the UK and the European Economic Area. Some providers, such as Cal.com and Google, may process data in the United States. Where this happens, we make sure a lawful transfer mechanism is in place, such as the UK–US data bridge, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
9. How long we keep your information
We keep records only for as long as we need them or the law requires:
Adult clinical records: at least 8 years after your last contact with us, in line with the NHS Records Management Code of Practice.
Children’s clinical records: until their 25th birthday, or their 26th birthday if they were 17 when treatment ended.
Financial records: 6 years, to meet tax and accounting rules.
Booking, reminder and enquiry records that are not part of your clinical record: only as long as we need them, normally no more than 2 years. Automated workflow logs are deleted within about 30 days.
Marketing preferences: until you withdraw your consent.
10. How we keep your information secure
Access to your information is limited to staff and partners who need it to do their job, and our team is bound by professional and contractual confidentiality. Our systems use encryption in transit, individual accounts with multi-factor authentication, and role-based access controls. If a data breach is likely to put your rights at risk, we will tell you, and we will report it to the Information Commissioner’s Office where the law requires.
11. Children
Some services, such as travel vaccinations, are available to children. Bookings for children under 16 should be made by a parent or guardian, who should attend the appointment with them. We handle children’s information with extra care and keep it only as long as the law requires.
12. Your rights
Under UK data protection law you have the right to:
ask for a copy of the information we hold about you;
ask us to correct information that is wrong or incomplete;
ask us to delete your information, although we may need to keep clinical records for the periods above;
ask us to restrict how we use your information, or object to it, including objecting to direct marketing at any time;
ask for information you gave us to be transferred to you or another organisation in a commonly used format;
withdraw your consent at any time where we rely on it. This does not affect anything we did before you withdrew it.
To use any of these rights, contact us using the details in section 2. We will respond within one month and do not usually charge a fee. We may need to confirm your identity first.
13. Complaints
If you are unhappy with how we have handled your information, please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
14. Changes to this policy
We review this policy regularly and will update this page when anything changes. The date at the top of the page shows when it was last updated.