01. Introduction
This Privacy Policy explains how personal information is collected, used and protected through the Crystal Pathways website.
This policy applies to website users, website enquiries and newsletter subscribers only. It does not apply to patient records, clinical notes, assessment records, treatment records or other medical information collected as part of healthcare services. Those matters are covered separately in the clinic’s Patient Privacy Notice.
02. Who we are
For the purposes of data protection law, the organisation responsible for this website is:
Crystal Pathways Ltd
Company number: 12102960
Address:85 Great Portland Street, First Floor, London, W1W 7LT
Email: hello@crystalpathways.co.uk
Crystal Pathways is registered with the Care Quality Commission (CQC) for the regulated activities of Diagnostic and Screening Procedures and Treatment of Disease, Disorder or Injury. Crystal Pathways Ltd’s Statement of Purpose, which describes the clinic’s regulated activities and governance arrangements, is available on request.
03. What this policy covers
This policy applies when you:
- Visit our site;
- Complete a contact form;
- Sign up to receive newsletters or clinic updates;
- Use or interact with website tools, embedded content or external booking links;
- Contact us using details published on the website.
It does not cover information processed as part of your care, treatment, diagnosis, assessment or clinical booking journey beyond the website itself. That information is dealt with separately under the clinic’s Patient Privacy Notice and any relevant third-party platform notices.
04. The information we collect
Depending on how you use the website, we may collect:
- Your name;
- Your email address;
- Your telephone number;
- The reason you are contacting the clinic;
- Technical information such as IP address, browser type, device information and website usage data;
- Cookie and tracking information, where accepted and applicable;
- Correspondence you send to us.
IMPORTANT: Please do not include detailed medical or highly sensitive personal information in a general website contact form.
05. How we collect your information
We collect personal information:
- Directly from you when you complete a form or sign up to receive emails;
- When you contact us by email;
- Automatically through cookies and similar technologies when you use the website;
- Through third-party tools linked to or embedded on the website.
06. How we use your personal information
We may use your information to:
- Respond to your enquiry;
- Manage incoming communications;
- Operate, maintain and improve the website;
- Keep the website secure and prevent spam or misuse;
- Administer newsletter subscriptions;
- Send clinic news, updates or marketing communications where we are lawfully permitted to do so;
- Maintain internal records;
- Comply with legal or regulatory obligations;
- Establish, exercise or defend legal rights.
07. Our lawful bases
Depending on the circumstances, we may rely on one or more of the following lawful bases:
- Legitimate interests, for running and improving the website, handling enquiries, maintaining security and administering communications;
- Consent, where you choose to subscribe to newsletters, accept non-essential cookies, or where consent is otherwise required;
- Legal obligation, where we are required to process or disclose information by law;
- Contract, or steps taken at your request before entering into a contract, where your enquiry relates directly to arranging services.
08. Contact forms and enquiries
If you contact us through the website, we may collect:
- Your name;
- Your contact number;
- Your email address;
- The reason for contacting the clinic.
This information is used to respond to your enquiry and manage communications with you.
Form submissions are sent to the clinic’s reception inbox and may also be stored within the website’s WordPress system using WPForms or Forminator.
You should not use this general website contact form for urgent medical matters, emergencies, or the transmission of detailed confidential medical information.
09. Newsletter and marketing communications
If you sign up to receive emails from us, your information may be processed through MailChimp or another email communication platform used by the clinic.
We will only send newsletters or marketing communications where we have a lawful basis to do so. In most cases, that will be your consent, given by actively subscribing through the newsletter sign-up form or as an existing client where legitimate interest applies.
You can unsubscribe from marketing emails at any time by using the unsubscribe link in the email or by contacting us at hello@crystalpathways.co.uk.
10. Booking and third-party services
The website may connect you with third-party systems and services used to support clinic operations, including:
- Semble for appointment booking, clinical scheduling and appointment-related interactions;
- Salesforce for enquiry and case management, used to record and manage contact from prospective patients and referrers;
- Google Maps for location information;
- Google Analytics for website performance and usage insights;
- reCAPTCHA to protect forms from spam and abuse;
- Meta Pixel for advertising or campaign measurement, where enabled and lawfully consented to;
- MailChimp for newsletter sign-up and email communications;
- GoDaddy for website hosting.
Where you move from this website to a third-party service, that provider may process your information under its own privacy information and terms, as well as under any clinic policies that apply to patient services.
Useful links:
- Semble Privacy Policy (semble.io/privacy-policy)
- Salesforce Privacy Statement (salesforce.com/company/privacy)
- Google Privacy Policy (policies.google.com/privacy)
- Meta Privacy Policy (facebook.com/privacy/policy)
- MailChimp Privacy Policy (intuit.com/privacy/statement)
11. Cookies and similar technologies
We use cookies and similar technologies to help the website function, understand usage, improve performance and, where enabled, support analytics or advertising.
Further detail is set out in our Cookie Policy.
12. Sharing your information
We may share website-related personal information with service providers and professional parties where reasonably necessary, including providers involved in:
- Email communications and newsletter services;
- Booking or appointment systems;
- Legal, regulatory or professional advice.
We do not sell your personal information.
We may also disclose information where required to do so by law, regulation, court order, or where necessary to protect our legal rights.
13. International transfers
Some third-party providers we use may store personal information outside the UK. Where that happens, we expect appropriate safeguards to be in place in accordance with applicable data protection law.
14. How long we keep website information
We keep personal information for no longer than is reasonably necessary for the purposes described in this policy, including dealing with enquiries, maintaining records, administering subscriptions, meeting legal obligations and resolving disputes.
Contact form data may remain stored within WordPress unless it is deleted in line with internal retention practices or at the request of the individual, subject to any lawful need to keep it.
15. Children’s privacy
This website may be used by adults and by parents, guardians or carers making enquiries on behalf of children. Some users may also be children or young people themselves.
We aim to handle personal information fairly and appropriately where children may access the website.
Parents and guardians should avoid including unnecessary sensitive information in general website forms.
16. Your rights
Depending on the circumstances, you may have the right to:
- Request access to your personal information;
- Ask for inaccurate information to be corrected;
- Ask for information to be erased;
- Ask for the use of your information to be restricted;
- Object to certain processing;
- Ask for transfer of your information where applicable;
- Withdraw consent at any time where we rely on consent.
To exercise your rights, please contact: hello@crystalpathways.co.uk
17. Complaints
If you have concerns about how your personal information is used, please contact us first.
You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint if you believe information has been handled unlawfully or unfairly.
18. Security
We take reasonable technical and organisational measures to protect information collected through the website. Our case management system, Salesforce, holds ISO 27001 certification, an internationally recognised information security standard, and our own systems have been independently tested and hold Cyber Essentials Plus certification. However, no internet-based service can be guaranteed to be completely secure.
Please avoid sending unnecessary confidential medical information through a general website contact form.
19. External links
This website may contain links to other websites, systems or services. If you follow a link to a third-party website or platform, that site will have its own privacy information and terms. We are not responsible for the privacy practices of third-party websites.
20. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes to the website, the way we use personal information, or legal and regulatory requirements. The latest version will always be published on this page.