Privacy Policy

TravelWell4Less is the “data controller” responsible for your personal data. This means we decide how and why your personal data is processed. Our travel health consultations are provided by our team of pharmacists registered with the General Pharmaceutical Council (GPhC).

As the data controller, we are responsible for ensuring your information is handled lawfully, fairly, and transparently, and for upholding your rights under UK data protection law.

If you have any questions about this policy or how we handle your data, you can contact us at:

• Business name: TravelWell4Less
• Email: travelwell4less@gmail.com
• Website: travellwell4less.com

You may contact us to exercise any of your data protection rights, to raise a concern, or to request further information about our data practices.

In the course of providing our services, we collect and process the following categories of personal data:

• Identity and contact details— such as your name, date of birth, email address, telephone number, and postal address.
• Travel details— your intended destination(s), travel dates, and itinerary information.
• Payment information— details necessary to process your booking payment. Card payments are handled securely by our payment processor (Stripe); we do not store your full card number on our systems.
• Booking and account information— appointment dates and times, and records of your communications with us.

Because we provide healthcare-related services, we also collect “special category data” concerning your health. This information is treated with the highest level of care and protection. It includes:

• Travel health questionnaires— the information you provide about your health in preparation for your consultation.
• Medical history information— including pre-existing conditions, allergies, current medications, and previous adverse reactions.
• Vaccination records— details of vaccines you have previously received and those recommended or administered.
• Consultation notes— the records and clinical notes created by the pharmacist during and after your consultation.

We collect and use your personal and health data for the following purposes:

• To provide safe, accurate, and personalised travel health advice and recommendations.
• To assess your suitability for specific vaccinations and travel medications.
• To create and maintain accurate clinical records of your consultations.
• To manage your bookings, take payment, and communicate with you about your appointment.
• To follow up on your care where included in your chosen package.
• To comply with our legal, regulatory, and professional obligations as a healthcare provider.

Under the UK GDPR, we must have a valid lawful basis to process your personal data. The lawful bases we rely on are:

• Contract (Article 6(1)(b))— processing necessary to provide the consultation services you have requested and to take payment.
• Legal obligation (Article 6(1)(c))— where we must process data to comply with the law and our professional/regulatory duties.
• Legitimate interests (Article 6(1)(f))— for limited purposes such as maintaining the security of our service and responding to enquiries.

For special category health data, we additionally rely on Article 9(2)(h)of the UK GDPR — processing necessary for the provision of health care and treatment by, or under the responsibility of, a health professional bound by a duty of professional confidentiality. Where required, we may also rely on your explicit consent (Article 9(2)(a)).

We retain your personal and health data only for as long as necessary for the purposes set out in this policy and to meet our legal and professional obligations.

• Clinical and consultation records (including health questionnaires, medical history, vaccination records, and consultation notes) are retained in line with professional record-keeping guidance, normally for a minimum of 8 years from the date of your last consultation (or, for patients under 18, until their 25th birthday, whichever is longer).
• Payment and transaction records are retained for 6 years to comply with HMRC and accounting requirements.
• General enquiry correspondence is retained for no longer than necessary to deal with your query.

When data is no longer required, it is securely deleted or anonymised.

We do not sell your personal data. We only share it where necessary to provide our services or to comply with the law. Your data may be shared with:

• Payment processors— Stripe, Inc., who securely process your card payment on our behalf.
• Your GP or other healthcare providers— where clinically appropriate and with your knowledge, to support your care and continuity of treatment.
• Regulatory and public health authorities— where we are legally or professionally required to do so (for example, the GPhC or UK Health Security Agency).
• Professional service providers— such as secure IT, hosting, and record-keeping providers who act as our processors under strict contractual safeguards.

Any third party we share data with is required to keep it secure and use it only for the agreed purpose.

Under the UK GDPR and the Data Protection Act 2018, you have the following rights:

• The right to be informed about how your data is used (which this policy provides).
• The right of access— to request a copy of the personal data we hold about you.
• The right to rectification— to have inaccurate or incomplete data corrected.
• The right to erasure— to request deletion of your data, subject to our legal record-keeping obligations.
• The right to restrict processing in certain circumstances.
• The right to data portability— to receive your data in a structured, commonly used format.
• The right to object to certain processing.
• Rights relating to your consent— where we rely on consent, you may withdraw it at any time.

To exercise any of these rights, please contact us at travelwell4less@gmail.com. We will respond within one month, as required by law.

If you have a concern about how we have handled your personal data, please contact us first at travelwell4less@gmail.com so we can try to resolve it.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post:Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised “last updated” date.