Privacy Policy
Draft for legal review before launch. Last updated: 20 October 2026.
This notice explains how The Frequency Hub Ltd uses personal information about clients, the people they care for, pet owners, vets, enquirers and website visitors, and the rights you have. Last reviewed: 20 October 2026.
Who we are
The Frequency Hub Ltd (company no. 17124765), 5 The Gardiners, Harlow, England, CM17 9QU, is the controller of your information. Clinic: Unit 92, Greenway Business Centre, Harlow, CM19 5QE. Data protection contact: Vernon Lacey, Director, info@frequencyhub.co.uk, 01279 408223. We are registered with the Information Commissioner's Office, registration number ZC270627.
What we collect
- Contact and account details: name, email, phone, address, date of birth, and your client portal login.
- Bookings and payments: appointments, plans, invoices and payment records. Card details are handled by the payment provider, not stored by us.
- Health-related information: health questionnaires, consent forms, session notes, scan files and programme details, and samples (saliva or a fingernail clipping) for programmes.
- Family members and dependants: the same kinds of information about a child or an adult you book for, and the details of the carer link.
- Pets: your animal's details, samples (hair, fur or feather) and session records, plus your vet's name and practice details and the vet's agreement.
- Enquiries: what you tell us through the contact form, email or phone, and franchise interest registrations.
- Website: the technical information needed to run the site and portal securely (see our Cookie Policy).
Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Taking and managing your bookings, plans and client portal account | Contract (Art 6(1)(b)) |
| Using health questionnaires, consent forms, session notes, scan files and samples to provide your sessions and programmes safely | Contract (Art 6(1)(b)) and, because this is special category health data, your explicit consent (Art 9(2)(a)) |
| Service messages: confirmations, reminders and changes to your booking or account | Contract (Art 6(1)(b)), or legitimate interests (Art 6(1)(f)) in running our service |
| Payments, invoices and accounting records | Contract (Art 6(1)(b)) and legal obligation (Art 6(1)(c)): tax and company law require us to keep accounting records |
| Providing sessions to a family member or dependant, and managing carer access | Legitimate interests (Art 6(1)(f)) in providing the booked service and running the account, with explicit consent for health data from the dependant, or from a person with parental responsibility for a child who isn't yet able to decide (Art 9(2)(a)) |
| Animal sessions, and contacting your vet to get and record their agreement | Contract with you (Art 6(1)(b)); legitimate interests (Art 6(1)(f)) for your vet's practice contact details. We share session summaries with your vet only with your consent |
| Answering enquiries from the contact form, email or phone | Legitimate interests (Art 6(1)(f)) in replying, or steps you ask us to take before a contract (Art 6(1)(b)) |
| Sending franchise information you asked for | Consent (Art 6(1)(a)); you can unsubscribe at any time |
| Keeping the website and portal secure, and keeping an audit log of who views and changes records | Legitimate interests (Art 6(1)(f)) and our security duties (Art 32) |
| Safeguarding a child or an adult at risk | Recognised legitimate interest in safeguarding (Art 6(1)(ea)); for health data, the safeguarding condition in the Data Protection Act 2018 (Sch 1 para 18) |
| Handling complaints and legal claims | Legitimate interests (Art 6(1)(f)); for health data, legal claims (Art 9(2)(f)) |
We don't send marketing emails unless you've asked for them, and we don't make decisions about you by automated means alone.
Do you have to give us your information?
We need your contact and booking details to take a booking, and your health questionnaire before a session so we can check it's suitable. If you don't provide them, we may not be able to provide the session. Everything else is optional.
Health information and samples
Health-related information is kept in our access-controlled client portal and only the practitioners who need it can see it. Every view and change is logged. Samples are labelled with a reference, stored securely, used only for your programme and disposed of confidentially afterwards. Scan files are also kept on our clinic computers and in encrypted cloud storage (Proton Drive) under the same retention rules.
Family members, dependants and carer access
Some clients book on behalf of someone else: a child, or an adult they care for. We call that person a "dependant". The information we hold about a dependant (including health-related information from scans and sessions) belongs to the dependant, not to the carer.
Who can see a dependant's records. A carer can see a dependant's records only where we have a lawful reason and have recorded it, for example: the carer has parental responsibility for a child who is not yet able to manage their own information; the dependant has agreed; or the carer holds a registered health and welfare lasting power of attorney or a court order that covers this. Carer access is authorised until it is reviewed or revoked; it is never permanent, and we review it at least every 12 months. We show carers only what they need. Some practitioner notes are never shown to carers in the portal.
Children aged 12 and over. Once a child understands their rights (we usually expect this from about age 12, and in Scotland the law presumes it from 12), they can contact us directly to see their information, get their own login, and tell us whether a parent or carer should keep seeing it. They do not need a parent's permission to do this.
Turning 18 (or 16 in Scotland). When a dependant becomes an adult, the carer's access to their records is suspended automatically, unless the adult tells us they want it to continue or someone has legal authority to act for them. Shortly before, we may send a short administrative email explaining what will change. This email never contains health information or marketing. The dependant can claim their own account at any time by contacting us. We will check their identity with them directly, and a carer's approval is not needed.
Adults with a carer. An adult can withdraw a carer's access at any time by contacting us directly, without the carer's involvement.
Notes written by carers. Anything a carer adds to a dependant's record forms part of the dependant's record. The dependant may be able to see it later, for example when they take over their own account.
In short, for young people: your information is yours. You can ask us to see it, fix it or delete it. You can have your own login and decide if your parent or carer can still see your records. Talk to us on 01279 408223 or at info@frequencyhub.co.uk, and you don't need anyone's permission.
Pets and vets
Information about your animal is held in your account. Before we work with an animal we ask for your vet's agreement, so we hold your vet's name, practice and contact details and a record of their agreement. We share session summaries with your vet only with your consent.
Who we share it with
We don't sell your information. We share it only with:
- Service providers who work for us under contract and only on our instructions: Wix.com (website, bookings, client portal and payments pages), Zoom (online sessions), Proton (our email and encrypted file storage), and, once we take card payments online, our payment provider.
- Your vet, as described above, with your consent.
- Professional advisers (for example our accountant, insurer or solicitor) where needed.
- Authorities where the law requires it, or to protect a child or an adult at risk.
International transfers
Some of our providers store or access information outside the UK. Wix.com is based in Israel and hosts data in the United States and other countries; Zoom is based in the United States; Proton is based in Switzerland. Where information leaves the UK, we rely on UK adequacy regulations (which cover Israel, Switzerland and the EEA), the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") for US providers certified under it, or the ICO's International Data Transfer Agreement or Addendum. You can ask us for details.
How long we keep it
| Record | How long |
|---|---|
| Client records (portal record, session notes and scan files) | 7 years after your last session |
| Clients first seen under 18 | Until their 25th birthday, or 7 years after their last session, whichever is later |
| Invoices and payment records | 6 years from the end of the financial year (31 March) they fall in |
| Enquiries from people who never had a session | 2 years after the last contact |
| Franchise interest registrations | [to confirm], or until you unsubscribe or ask us to delete them |
| Samples | Disposed of confidentially when your programme ends |
We keep records for longer only while there's an open data request, complaint or legal claim. Afterwards we securely delete them; we keep only a note that a deletion happened, with no name or health details. Backup copies are deleted on their own cycle.
Your rights
Every person, including a dependant of any age who understands their rights, can ask us to:
- give them a copy of their information (access);
- correct it if it's wrong (rectification);
- delete it (erasure), unless we have to keep it, for example accounting records;
- restrict how we use it (restriction);
- give it to them, or to another organisation, in a portable format (portability);
- stop using it where we rely on legitimate interests (objection), and stop any marketing at any time;
- withdraw consent at any time, without affecting what we did before.
Contact us at info@frequencyhub.co.uk or 01279 408223, or ask in person. We'll check your identity in a proportionate way and reply within one month.
Complaints
If you're unhappy with how we've used your information, please tell us first (info@frequencyhub.co.uk). We'll acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
Cookies
See our Cookie Policy.
Changes
We'll update this notice when our services change, and show the date at the top.