Last updated: 7 July 2026
At Hever Health, we take the handling of your personal data seriously. This notice explains why we collect your information and exactly what we do with it, both when you visit this website and when you are a patient of the clinic.
The Data Controller for your personal data is Hever Health Limited, Hever Castle Golf Club, Hever Road, Edenbridge, Kent, TN8 7NP. If you have any questions about this notice or how we use your data, please contact us using the details on our contact page. Our ICO registration number is ZA510190.
Part 1 — Your data as a patient
When you supply your personal details to this clinic, they are stored and processed for the following reasons.
1. To provide you with treatment We need to collect personal information about your health in order to provide you with the best possible care. Your requesting treatment and our agreement to provide that care constitutes a contract between us, and we process information about your health for the purpose of providing healthcare. You may, of course, decline to provide this information, but without it we would not be able to treat you safely or effectively.
2. Legitimate interest We have a legitimate interest in collecting your information because without it we could not do our job safely or to the standard you deserve. We also believe it is important that we can contact you to confirm appointments or update you on matters related to your care. This too falls under legitimate interest, in this case yours as a patient.
How long we keep your records We have a legal obligation to retain your records for eight years following your most recent appointment, or until the age of 25 if that period is longer. After this time has elapsed, you may ask us to delete your records. Otherwise, we will retain them indefinitely so that we can provide you with the best possible care should you return to us in future.
How your records are stored Your records are held in two ways:
- Cloud storage: We use a specialist medical records system (PPS, provided by Rushcliff) to store your data electronically. This provider operates in compliance with data protection law. Access is password protected, with passwords updated regularly.
- On-site computers: Our office computers are password protected, backed up regularly, and the premises are locked and alarmed outside working hours.
Who has access to your data We will never share your data with anyone who does not need access to it, and we will never do so without your written consent. The following people and agencies have routine access only:
- The medical records service responsible for storing and processing our files
- Your practitioner, so they can provide your treatment
- Our reception staff, who manage appointments and reminders but do not have access to your medical history or sensitive personal information
- Administrative staff such as our bookkeeper, who access only essential contact details and never your medical notes
From time to time we may engage consultants whose work could bring them into contact with your personal data, though not your medical notes. We will ensure they understand their obligation to treat that information as confidential, and we will require them to sign a non-disclosure agreement.
Part 2 — Your data as a website visitor
This section covers information we collect through this website, which is separate from your clinical records.
Enquiry and contact forms When you complete a form on our website (for example our contact form), we collect the details you provide, such as your name, email address, phone number and message. We use this to respond to your enquiry and to arrange care where appropriate. Our lawful basis is our legitimate interest in responding to you, and taking steps at your request before providing treatment. To protect our forms from spam and abuse we use Google reCAPTCHA, which is subject to Google’s privacy policy and terms.
Online booking Our online booking is provided through PPS Online Booking (Rushcliff). When you book through the widget on our site, your booking details are collected and processed by that provider on our behalf so that we can manage your appointment. Their handling of your data is governed by their own agreements with us as our medical records and booking provider.
Analytics and website measurement With your consent, we use analytics tools to understand how visitors use our website so we can improve it:
- Google Analytics 4 (loaded through Google Tag Manager), which gives us anonymous, aggregated statistics such as which pages are visited and how people arrive at the site.
- Microsoft Clarity, which helps us see how visitors interact with pages through aggregated heatmaps and anonymised session recordings. These recordings mask the content you type and are used only to improve the site’s usability.
These tools set cookies and only run after you accept them through our cookie banner. You can change or withdraw your choice at any time. For the full list of cookies and how to manage them, see our Cookie Policy.
Embedded content Some pages include content from other services, such as Google Maps (to show our location) and YouTube (for videos). These services may set their own cookies and are only loaded once you have given consent. Until then you will see a placeholder in their place.
Third parties who process website data
- Google (Analytics, Tag Manager, reCAPTCHA, Maps, YouTube)
- Microsoft (Clarity)
- PPS / Rushcliff (online booking)
- Our website hosting provider
Some of these providers may process data outside the UK. Where they do, that transfer is protected by appropriate safeguards required under UK data protection law.
How long we keep website data We keep enquiry and form data only for as long as needed to deal with your enquiry and any care that follows, after which it is deleted or retained under the clinical retention period above where it becomes part of your care record. Analytics data is retained in aggregated form only.
Your rights
You have the right to:
- Ask to see the personal data we hold about you
- Ask us to correct any factual errors
- Ask us to erase your records, provided the legal minimum retention period has elapsed
- Object to, or ask us to restrict, certain processing
- Withdraw your consent at any time where we rely on consent (such as analytics cookies)
- Ask for a copy of the data you have given us in a portable format
We are committed to handling your personal data responsibly and to ensuring that access is limited only to those with a genuine need.
How to make a complaint
If you feel that we are mishandling your personal data in any way, you have the right to complain to our Data Controller. Please contact us directly in the first instance using the details on our contact page.
You also have the right to raise a concern with the Information Commissioner’s Office (ICO) at ico.org.uk if you are not satisfied with our response.
Changes to this notice
We may update this notice from time to time. When we do, we will change the “last updated” date at the top of this page.