Privacy notice
Last updated 21 May 2026
This notice explains how Optimal Group Ltd, trading as Optimal Health (“we”, “us”, “our”), collects and uses your personal data when you visit our website, book a service or attend our clinic. It is written to meet the requirements of the UK GDPR and the Data Protection Act 2018.
Who we are
Optimal Group Ltd is the data controller for personal data processed through Optimal Health. Our registered address is in Newport, South Wales. You can reach the controller at privacy@optimalhealth.co.uk.
The data we collect
Depending on how you interact with us, we may collect:
- Contact details— full name, email address, phone number, postcode.
- Booking information— the service you requested, your preferred date and time, optional notes you provide.
- Payment metadata— we do not handle card data ourselves. Bank-transfer deposits are visible to us only as a confirmation that the deposit cleared.
- Technical data— IP address, device type, pages visited. Used only to keep the site working and to spot abuse.
Why we use your data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Take your booking and confirm your appointment | Contract |
| Deliver the wellness service you requested | Contract |
| Communicate with you about your appointment | Contract; legitimate interests |
| Send optional updates if you opted in | Consent (withdrawable at any time) |
| Comply with legal, tax and accounting obligations | Legal obligation |
| Keep the website running and safe | Legitimate interests |
What data we do not hold
We hold only your booking contact details (name, email address, and phone number for the appointment) and your consent records. We do not collect, store, or process health, clinical, or special-category data through our online systems. Any clinical discussion takes place verbally in the clinic and is not recorded in our digital systems.
Who we share data with
We rely on named processors only. Each is contractually bound by a UK GDPR Article 28 data-processing agreement.
| Processor | Purpose | Location |
|---|---|---|
| Google Cloud / Firebase | Hosting, authentication, database, secure file storage. Data is processed within the europe-west2 region. | UK / EU |
| Resend | Transactional email (booking confirmations, reminders, cancellations, contact-form replies). | United States — safeguarded by the UK International Data Transfer Addendum. |
| Google (Gemini API) | Drafts of suggested replies in our admin tool. Customer messages are sent to the API in transit; we do not store outputs back to the message thread without an admin’s explicit action. | United States — safeguarded by the UK IDTA. |
| Our accountants | Bookkeeping and statutory reporting. They see invoice-level records (date, amount, service) but no clinical content. | United Kingdom |
We also disclose data to relevant authorities only where we are legally required to do so. Optimal Health and Optimal Lab are part of the same group and run on a shared, secure technical platform; your booking and contact details are scoped to Optimal Health within that platform and are not used for Optimal Lab’s marketing or sales. We do not hold special-category health data (see above).
International transfers
We store data within the UK or the European Economic Area where possible. Where a supplier processes data outside the UK or EEA (currently Resend and Google Gemini, both US-based), the transfer is covered by the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses.
Retention
Different categories of data are kept for different periods, in line with our purpose for processing and our legal obligations:
| Data category | Retention period | Reason |
|---|---|---|
| Invoice + payment metadata | Six years | UK tax-record statutory minimum. |
| Marketing contact details | Until you unsubscribe | Consent withdraws the lawful basis immediately. |
| Account record (signed-in users) | Until you close the account or 24 months of inactivity | Whichever comes first. Closing the account triggers a 30-day soft-delete grace period before permanent removal. |
| Site analytics | 25 months, aggregated | Industry standard for aggregated, non-identifying analytics. |
After the retention window, records are deleted or fully anonymised. You can ask for early deletion at any time using your right to erasure (see “Your rights”).
Your rights
Under the UK GDPR you have the right to access your data, to ask us to correct or delete it, to object to or restrict our processing, to withdraw any consent you have given, and to ask us to provide your data in a portable form. You can also lodge a complaint with the Information Commissioner’s Office.
To exercise any of these rights, email privacy@optimalhealth.co.uk. We respond within one calendar month.
Cookies
We use only the cookies necessary to make the site work. We do not use third-party advertising trackers. If this changes we will update this notice and ask for your consent first.
Changes to this notice
We may update this notice from time to time. The date at the top of the page reflects the most recent change. Material changes will be notified to you by email where we have your address.