Privacy & Cookies Policy
The Vesey Private Hospital Ltd takes your privacy seriously. This policy explains how we collect, use and protect your personal and health data.
Who we are
The Vesey Private Hospital Ltd. Registered in England and Wales, Company No. 13989980. Unit 3, The Courtyard, Reddicap Trading Estate, Sutton Coldfield B75 7BU. CQC Provider ID: 1-12376210923. ICO data-controller registration: ZB342995. Data controller contact: hello@thevesey.co.uk.
What data we collect and why
When you book an appointment, we collect your name, date of birth, email address, phone number and relevant medical information. This data is used to:
- → Deliver your healthcare appointment
- → Communicate with you about your appointments and results
- → Process payment via Stripe (PCI-DSS compliant)
- → Issue invoices via Xero (if applicable)
- → Maintain clinical records as required by CQC regulation
We do not sell your data to third parties. Health data is processed under Article 9(2)(h) of UK GDPR — necessary for healthcare provision.
Cookies
Our website uses cookies for analytics (Google Analytics via GTM), session management and improving user experience. By continuing to use our site you consent to necessary cookies. You can manage cookie preferences in your browser settings.
Third-party services used: Google Analytics (analytics), GTM (tag management), Stripe (payments), Setmore/Medesk (booking), Xero (invoicing), MailerLite (email marketing), Microsoft Clarity (UX analytics). Each operates under their own privacy policy.
Your rights
Under UK GDPR, you have the right to: access your personal data, correct inaccuracies, request erasure (subject to legal retention requirements), restrict processing, and data portability. To exercise these rights, contact hello@thevesey.co.uk.
If you are unhappy with how we have used your information, you have the right to complain to us directly — we acknowledge data protection complaints within 30 days and respond without undue delay. You can also complain to the ICO at any time at ico.org.uk; you do not have to complain to us first.
The My Vesey app (iOS & Android)
My Vesey is the patient app for existing Vesey patients. It securely displays your own records — results, appointments, letters and invoices — by loading your patient portal over an encrypted (HTTPS) connection. It is a viewer for your care; it is not a diagnostic tool. The app handles your data as follows:
- Signing in. Sign-in is passwordless: we email you a secure, single-use link. Your session is held only on your device and is cleared when you sign out or delete the app. There is no password to store.
- Face ID / Touch ID / fingerprint. You can turn on a biometric lock for the app. Your biometric data never leaves your device and is never sent to The Vesey — your phone only tells the app whether the check passed.
- Notifications. If you allow notifications, we store a device token so we can send you your own appointment, results and letter alerts. You can turn notifications off at any time in your phone's settings, and the token is deleted if you ask us to erase your data.
- Apple Health (iPhone only). You can choose to share data from Apple Health — such as activity, heart rate or weight — with The Vesey. We only read the categories you approve, only when you tap "Connect Apple Health", and only with your explicit consent. This data is stored encrypted and added to your record so your care team can see it. It is never used for advertising or marketing and is never shared with third parties. You can stop sharing at any time in the Health app, and it is removed if you ask us to erase your data.
- Your health information is shown from your record; it is not stored by the app beyond your phone's temporary browser cache, which is removed when you delete the app.
- No tracking or advertising. The app contains no advertising, and no third-party analytics or tracking.
- Deleting your account and data. You can request erasure of your account and data from within the app (Your details → Privacy & your data), or by emailing us. As a regulated clinic we may be required to keep some clinical records for the retention period below, but we will erase everything we can and confirm what has been done.
Data retention
Clinical records are retained for a minimum of 7 years from last contact in accordance with NHS and CQC guidance. Marketing data is retained until you unsubscribe or request deletion. Payment records are retained for 7 years for tax purposes.