Privacy Policy

Hearology^® is a trading name of Glorious Day Ltd, a company registered in England and Wales (company number 04045932), with its registered office at Unit A3, Gateway Tower, 32 Western Gateway, London E16 1YL. We provide ear care and audiology at our five clinics: London Bridge, Liverpool Street, Orpington, Oxted and Forest Row.

Glorious Day Ltd is the data controller for the personal information described in this policy, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy covers hearology.uk, our clinics, and any contact you have with us by phone, email or social media.

The information we collect depends on how you use our services:

• When you book online: your name, email address, phone number, date of birth and postcode, the appointment you choose, and any promotional code you use. Your date of birth helps us set the right appointment length and check that the appointment is suitable. We also record the type of device you used and the page you first arrived on, so we can see which pages lead to bookings.
• When you book for a child or young person: the child's name and date of birth, and the parent or guardian's name, email address, phone number and postcode, with their confirmation that they are the parent or guardian and consent to the appointment.
• When you receive care: your clinical history, examination findings, test results, treatment notes and any letters to or from other health professionals. This is health information, which the law treats as special category data.
• When you pay: a record of the payment. We never see or store your full card details; payments are handled by Stripe.
• When you contact us: what you tell us in a form, email, call or message, and our reply. We also record the type of device you used and the page you first arrived on, so we can see which pages lead to bookings.
• When you visit our website: technical information such as your device type, browser and the pages you visit. We count visits and the steps people reach in the booking process without cookies and without identifying anyone. Anything that identifies your browser or follows you between visits is collected only if you agree in our cookie banner. Our hosting and security providers process your internet address to run and protect the website: see the privacy policies of Vercel and Cloudflare.

We see children aged 3 to 12 for children's ear cleaning, and young people aged 13 to 17 for ear wax removal. A parent or legal guardian books these appointments, gives their details and consent, and comes to the appointment with the child. We check that the adult with the child is their parent or legal guardian before we go ahead.

We use a child's information only to provide and record their care, and we contact the parent or guardian about it, not the child.

• to book, confirm, change and remind you about appointments;
• to provide your care, keep accurate clinical records and, where you agree, share information with your GP or another health professional;
• to take payment and keep financial records;
• to answer your questions and deal with any complaint;
• to protect our website and booking system from spam and misuse;
• to count visits and booking steps in a way that identifies no one, so we can see how the website and booking process are working (this needs no cookies);
• to understand in more detail how the website is used and to measure our advertising, but only if you agree to cookies;
• to see which pages and adverts lead to bookings and enquiries, using the device type and landing page stored with each booking.
• to send you ear health tips and offers, only if you ask us to.

We never use your health information for marketing, and we never sell your personal information.

The law allows us to use personal information only where we have a lawful basis. We rely on:

• Contract: to book and provide the appointment you ask for, and to take payment.
• Health or social care (UK GDPR Article 9(2)(h)): to process health information for your care, by or under the responsibility of a registered health professional.
• Legal obligation: to keep clinical and financial records for as long as the law and professional rules require.
• Legitimate interests: to run our clinics safely, keep our systems secure and handle complaints; to count visits and booking steps without cookies or identifiers, so we can run and improve our website and booking service; and to keep our own records of where bookings and enquiries come from. You can object to any of these: see "Your rights".
• Consent: for marketing emails; for non-essential cookies and similar technologies, including analytics, session recording and advertising measurement; and for sharing protected contact details with advertising partners. You can withdraw consent at any time: see "Your cookie choices".

Some pages and services on our website relate to your hearing or ears, which we treat as sensitive. Without your consent to cookies, the service you looked at is never recorded against anything that identifies you. We never send your medical details, such as test results or appointment notes, to analytics, recording or advertising providers. What analytics and advertising partners may receive with your consent is set out under "Cookies and analytics".

We only send you marketing emails if you tick the "keep my ears in good hands" box when you book or get in touch. The box is never ticked for you. Every email has a link to unsubscribe in one tap, and you can also ask us to stop at any time by emailing dataprotectionofficer@hearology.uk.

Unsubscribing from marketing doesn't affect the emails we send about your appointments.

We use a consent tool to ask for your choice about cookies. Everything except strictly necessary cookies is off until you choose. We don't place analytics, recording or advertising cookies without your consent.

If you accept analytics or marketing cookies, we and our partners use cookies and similar technologies to:

• measure how people use our website, including the pages they visit and how they find us;
• see how a visit looks and behaves, using session recordings that help us find and fix problems. Form fields are masked, so what you type is not recorded. We link a recording to your visit and, if you book, to your booking reference, so we can see how the booking worked;
• measure whether our adverts lead to bookings and show you adverts that are more relevant. We share limited information with advertising partners to do this. Your details are sent in protected form over encrypted connections, with contact details such as email and phone hashed.

If you decline, or haven't chosen yet, none of the above runs and no analytics, recording or advertising cookies are set. We still count visits in a basic way, without cookies, on our own servers and in our analytics provider, to improve our services. This uses no cookie and identifies no one. It records that a page was viewed or a booking step was reached, and it records which service a step was for, but never anything that identifies you. As with any website, our providers can see your internet address and browser type when they receive these counts.

Whatever you choose, we never send your medical details, such as test results or appointment notes, to analytics, recording or advertising providers. If you agree to analytics cookies, we measure your visit in detail, including the service you looked at or booked. Only if you also agree to marketing cookies do we share protected contact details with advertising partners, alongside the booking and the service booked, to match it to an advert.

Some features load content from other providers only when you use them, such as maps and embedded videos.

This is the full list of cookies our website uses, what each one does and how long it lasts. It's kept up to date automatically by Cookiebot, our consent-management platform, so it always matches the cookies actually in use.

Some measurement on our website uses no cookie at all. It is described under Cookies and analytics above, so it does not appear in this list.

We share information only where we need to, and only with organisations that protect it to the standards the law requires. They act on our instructions under a written agreement, and may not use your information for their own purposes. The exception is analytics and advertising providers, which may also use information under their own privacy policies.

• Payments: Stripe, to take online payments securely.
• Booking, email and IT: the providers that run our booking calendar, website, email and clinical systems.
  • Neon: hosts the database that holds your booking or enquiry while we process it.
  • Postmark: sends our booking and enquiry emails.
  • Vercel: hosts our website and runs our online booking.
  • Cloudflare: protects our website and manages our domain names.
• Security: Cloudflare, whose Turnstile check helps stop automated spam on our forms.
• Analytics, advertising and cookie-management providers: these providers receive information only as described under "Cookies and analytics". They help us manage your cookie choices, measure how our website is used, and measure our adverts. Where you have accepted cookies, advertising partners may also receive limited, protected information to match a booking to an advert.
• Hosting and reporting providers: providers that host our website and booking service and store our reporting data, in the UK and EU where we can.
• Maps: our map provider, which receives your device's internet address when map tiles load.
  • Mapbox: supplies the map tiles on our clinic pages; your browser fetches them directly from Mapbox.
  • Google Places: supplies our clinics' public Google ratings; it receives no information about you.
• Your care: your GP, a hospital or another health professional, with your agreement or where it's needed for your safety.
• Where the law requires it: for example, to a regulator such as the Care Quality Commission, or where a court orders it.

We store our reporting data in the UK and EU. Some of our providers, including hosting, analytics and advertising providers, may process information in the United States or other countries outside the UK. When they do, we make sure the transfer is protected by UK adequacy regulations, including the UK extension to the EU-US Data Privacy Framework for certified providers, or by approved contract terms such as the UK International Data Transfer Agreement or the UK addendum to the EU standard contractual clauses.

We keep clinical records for as long as professional guidance and the law require. For adults this is usually eight years after your last appointment. For children, it is until their 25th birthday, or their 26th if they were 17 at the end of their treatment, whichever is later.

We keep financial records for six years. For an enquiry made on the website, we keep no copy of your message or contact details once it's delivered, only a record of the type of enquiry and where it came from; the enquiry stays in our email for up to two years. Marketing preferences are kept until you unsubscribe. After that, information is securely deleted or anonymised.

Website measurement data. We keep a secure copy of analytics and booking data to analyse and improve our services, and we minimise or anonymise personal details over time. We keep our own records of where bookings and enquiries come from, and our anonymous visit totals, for as long as they help us understand long-term trends in how people find and use our service. Anonymous totals stay. Session recordings are kept by the provider for a short period, normally around 30 days.

You have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct anything that is wrong or incomplete;
• ask us to delete your information, where we don't need to keep it by law;
• object to, or ask us to restrict, how we use your information;
• ask for information you gave us to be sent to you or another provider in a common format;
• withdraw your consent at any time, where we rely on it.

Cookies and measurement. You can change or withdraw your cookie choice at any time using "Change cookie settings" in the cookie declaration below, or the cookie icon at the bottom left of every page. Withdrawing stops analytics, recording and advertising cookies and tags from your next page, and cookies already set are deleted. Our anonymous visit counts use no cookie and identify no one, so your cookie choice does not affect them. To ask what protected contact details we have shared with advertising partners, or to have them removed, contact us. You can also manage advertising settings in your own accounts with those partners.

To use any of these rights, email dataprotectionofficer@hearology.uk. There's no charge, and we'll reply within one month. We may ask you to confirm your identity first.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

We protect your information with access controls, encryption when it travels over the internet, secure providers and regular staff training. Only the people who need your information to look after you can see it. If something goes wrong, we have a procedure for dealing with it and will tell you and the Information Commissioner's Office when the law requires us to.

We review this policy regularly. When we change it, we'll update the date at the top of this page, and we'll tell you directly if a change affects you significantly.

For any question about this policy or your information, email our Data Protection Officer at dataprotectionofficer@hearology.uk or write to Data Protection Officer, Glorious Day Ltd, Unit A3, Gateway Tower, 32 Western Gateway, London E16 1YL.

To make a complaint about any other part of our service, email complaints@hearology.uk.