Privacy policy

Last Updated: 11 August 2026

At Health by Science, we take your privacy seriously. This policy explains what personal information we collect, why we need it, how we keep it safe, and your rights over it. It applies to all clients and website users in the United Kingdom.

Our counselling service has its own separate privacy policy, available at counsellingedinburgh.co.uk.

1. Who we are

Health by Science Ltd is a Social Enterprise and Community Interest Company registered in Scotland (company number SC557048). We act as the data controller for the personal information we hold about you, meaning we are responsible for ensuring it is processed lawfully, fairly, and transparently.

Addresses: 98 Giles Street, Leith, Edinburgh, EH6 6BZ (Personal Training) and 100 Giles Street, Leith, Edinburgh, EH6 6BZ (Physiotherapy)
Email: hello@healthbyscience.co.uk
Phone: 0131 210 0002

Data Protection Officer: Stuart Maytham, Co-Director. You can contact our DPO about anything in this policy, or to exercise any of your rights, at hello@healthbyscience.co.uk.

We are registered with the Information Commissioner’s Office under registration number ZA320594.

2. Information we collect

Directly from you. When you fill out an enquiry form, contact us, complete a survey, or book an appointment, we collect details such as your name, contact information, and health history (current symptoms, medical background, and lifestyle information).

Booking appointments. We use Acuity Scheduling to manage our calendar. Acuity collects your contact details and appointment history so we can send you reminders and manage your bookings.

Enquiry and intake forms. We use Typeform for our enquiry and client intake forms. Depending on which form you complete, this may include information about your health, your symptoms or the reason for your enquiry.

Enquiry messaging. We use Intercom to respond to enquiries about our services. When you get in touch, we may send you an automated first reply and then continue the conversation with you. Intercom holds your name, your contact details and the content of that conversation, including anything you tell us about your symptoms or the reason for getting in touch.

During consultations. We use Google Meet for video consultations. We use Heidi, a clinical documentation tool, to help our practitioners write up your consultations. See Section 4a.

MOT assessments. If you book a Movement, Injury, Strength or Performance MOT, your coach or physiotherapist records your movement grades, notes on each movement pattern, mobility restrictions and relevant lifestyle factors on a structured assessment form. This is used to produce your summary report. See Section 4a.

Your programme app (Everfit). We use Everfit to deliver your exercise and rehabilitation programmes. Through the app we hold your name and contact details, your programme, your exercise and progress records, self-reported symptoms, outcome measures and any messages between you and your practitioner. Everfit, Inc. is based in the United States. Please see Section 6.

Everfit’s own role. When you create your Everfit app account, Everfit also collects information about you directly, under its own privacy policy. For that information Everfit acts as an independent controller alongside us, which means Everfit decides how it uses that information and may use it for its own business purposes. We cannot control or instruct that use. You can read Everfit’s privacy policy at everfit.io/privacy. If you want to exercise your data protection rights over the information Everfit holds in its own right, you will need to contact Everfit directly, and we will help you do that.

Client communications. We use WhatsApp (Meta) to send appointment reminders and brief administrative messages, and to chat with you when you enquire about personal training or physiotherapy so we can arrange an appointment. You may choose to tell us something about your symptoms or injury in those messages. We do not send you clinical information, diagnoses or consultation notes via WhatsApp, and your clinical record is not kept there. We use Zapier to connect our systems and automate routine tasks such as booking confirmations and report delivery.

Marketing emails. We use Brevo (Sendinblue SAS, France) to manage our email lists and send marketing emails. Brevo holds your email address, first name, and which of our services you have enquired about or used. See Section 3a.

Payments. We use Stripe to process payments. Stripe holds your name, payment amount and transaction reference. We do not see or store your card details.

Accounts and invoicing. We use QuickBooks (Intuit) for our financial records. Your name and payment references may appear on invoices.

Website AI receptionist. We use Synflow as our AI receptionist. Synflow is based in Germany, within the EU. When you interact with it, Synflow may collect your name, contact details, and the content of your enquiry.

Website analytics. We use Google Analytics 4 to understand how people use our site. Google Analytics 4 does not store IP addresses. This only happens if you consent to non-essential cookies. See Section 9.

Internal team communications. We use Slack for internal communication between our staff. Your name and contact details may be mentioned in staff messages when we are coordinating your care. Slack is not one of our clinical record systems, and our staff are instructed not to share consultation notes, diagnoses or treatment details there. Where clinical information is unavoidably mentioned while coordinating your care between practitioners, we rely on Article 9(2)(h), described in Section 3. Slack Technologies, Inc. is based in the United States. See Section 6.

AI-assisted clinical reasoning (internal use). Our clinical and coaching staff may use Google Gemini within Google Workspace to assist with clinical reasoning and programme planning. Before any client data is used with Gemini in this way, all direct identifiers are removed. See Section 4a.

3. How we use your information

Providing care: To give you personalised health advice and maintain accurate records of your sessions.
Communication: To send you reminders, updates, and responses to your questions via email, the Everfit app, and WhatsApp.
Programme delivery: To create, manage, and deliver your personalised exercise and rehabilitation programmes through Everfit.
Assessment reporting: To produce and send your MOT summary report.
Legal and professional standards: We are required by HCPC guidelines to keep health records for 8 years.
Improving our service: To analyse trends anonymously so we can improve our website, app, and services.
Marketing: To send occasional emails about our services to people who have enquired about or used them. See Section 3a.

Our lawful bases for processing

For personal data generally (UK GDPR Article 6):

• Contract (Article 6(1)(b)), to deliver the services you have booked
• Legal obligation (Article 6(1)(c)), to maintain health records as required by HCPC guidelines
• Legitimate interests (Article 6(1)(f)), for enquiry management, clinical documentation, service improvement, internal analytics, and marketing to people who have enquired about or used our services
• Consent (Article 6(1)(a)), for non-essential cookies and website analytics

For health information, which is “special category” data and needs an additional basis (UK GDPR Article 9):

• Health and social care purposes (Article 9(2)(h)), for your clinical records, your MOT assessments and reports, your rehabilitation and training programmes, and communication between practitioners involved in your care. This is our main basis for handling your health information.
• Explicit consent (Article 9(2)(a)), for client stories and testimonials. We will always ask you about this separately, and you can decline without it affecting your care.

3a. Marketing communications

We may occasionally send emails to people who have enquired about or used our services, covering new or returning services, health and wellbeing tips, and updates from Health by Science.

How we decide who to email. When you book an appointment or make an enquiry, we add you to our mailing list so we can occasionally tell you about our services. Both our booking and enquiry forms give you the option to tell us you would rather not receive these, and every email we send includes a link to unsubscribe. If you unsubscribe, we keep your email address on a suppression list so that we do not contact you again by mistake.

Which service you booked. We record which of our services you have enquired about or used, and we sometimes use that to decide which emails to send you, so that someone who came to us about an injury is not sent material aimed at someone training for a marathon. We use the service you booked, not any diagnosis, assessment result or clinical note. Our emails are written for a general audience and are not tailored to your individual condition.

Lawful basis. We rely on our legitimate interests in communicating with people who have engaged with our services (UK GDPR Article 6(1)(f)). A Legitimate Interest Assessment has been completed and is held on file. Under the UK Privacy and Electronic Communications Regulations we also rely on the soft opt-in for existing and prospective clients (Regulation 22), which allows us to market our own similar services to people who have enquired about or used them.

How to stop. Every marketing email contains an unsubscribe link. You can also reply STOP to any marketing email, or email hello@healthbyscience.co.uk. We action opt-outs immediately. You have an absolute right to object to direct marketing under UK GDPR Article 21, and we will stop with no need for you to give a reason.

What we will not do. We will never share or sell your email address to third parties for marketing. We do not reference your health conditions, diagnoses or treatment history in marketing emails.

Confirmations are different. Booking confirmations, payment receipts, appointment reminders and your MOT report are service messages, not marketing. You will continue to receive these even if you have opted out of marketing, because we need to send them to deliver the service you have booked.

4. Who we share your data with

We do not sell your data. We only share it with third-party “data processors” who help us run our business. We require written data processing terms with each of them, covering security, confidentiality and what they are permitted to do with your information.

• Programme delivery: Everfit, Inc. (USA), exercise and rehabilitation programme management. Everfit is also an independent controller of the account information it collects from you directly, as explained in Section 2
• Assessment reports: Google AI Studio (Gemini), report content generation; Gamma Tech, Inc. (USA), report formatting
• Scheduling and forms: Acuity Scheduling (Squarespace, USA), appointment booking and reminders; Typeform, enquiry and client intake forms
• Enquiry messaging: Intercom, enquiry conversations and automated replies
• Consultations and notes: Google (Meet, Drive, Workspace), video calls, document storage, and AI-assisted clinical reasoning, under our Google Cloud Data Processing Addendum; Heidi Health Ltd (UK), clinical documentation
• Automation and communications: Zapier (USA), workflow automation; WhatsApp (Meta, USA), client communications
• Marketing email: Brevo / Sendinblue SAS (France), email list management and delivery
• Payments: Stripe Payments Europe Ltd (UK and EEA), payment processing
• Accounting: Intuit / QuickBooks (USA), financial records and invoicing
• Internal communications: Slack Technologies, Inc. (USA), staff messaging
• Website AI receptionist: Synflow (Germany), AI receptionist and enquiry management
• Website analytics: Google Analytics 4, usage statistics, subject to your cookie consent
• Social media: Meta (Facebook and Instagram), where you have consented to us sharing your story. Meta acts as an independent platform, not as our processor

Please note that Google AI Studio is a separate Google service from Google Workspace and operates under different Google terms, as explained in Section 4a.

Our bookkeeper and accountants have access to our QuickBooks account as authorised users of our systems. They work under confidentiality agreements with us.

Access to your information is restricted to the Health by Science staff who need it to provide your care or manage your booking.

4a. AI usage information

Health by Science uses AI tools in three ways that may involve your information. This section explains all three.

How we use AI to write up your clinical notes

We use Heidi, a clinical documentation tool provided by Heidi Health Ltd, to help our practitioners record your consultations. Heidi produces a written summary of your appointment, which your practitioner reviews and edits before it becomes part of your clinical record. Your information is processed on UK servers.

Heidi does not make decisions about your care. Your practitioner does that, and checks and corrects everything Heidi produces.

Using Heidi is part of how we deliver and document your care, so we are not able to offer appointments without it. If you have questions about this before booking, please contact us at hello@healthbyscience.co.uk.

Our lawful basis for this processing is Article 6(1)(f), our legitimate interest in producing accurate and timely clinical records, together with Article 9(2)(h), for the provision of health care.

You have the right to object to processing based on our legitimate interests. If you object to our use of Heidi, we will not be able to offer you appointments, and we will help you find an alternative provider if you would like us to.

We previously described this as running on your consent. That was not accurate, because consent has to be something you can decline and Heidi is a necessary part of how we work. We have corrected it here.

If you would like a Heidi transcript from a past appointment deleted, contact us and we will arrange it, subject to our obligation to keep clinical records for eight years.

MOT report generation

When you complete a Movement, Injury, Strength or Performance MOT, we produce your summary report using two AI tools.

What is processed: your first name, your assessment date, the grades and scores your practitioner recorded, your height and bodyweight where a Performance or Strength MOT measures against them, your training goals and training experience, the notes your practitioner made, any mobility restrictions identified, and relevant lifestyle information you have shared. We do not put your consultation notes, clinical records, contact details or date of birth into these tools.

Google AI Studio (Gemini) turns your assessment data into the written content of your report. Because we are in the UK, Google’s paid-service data terms apply, which means Google does not use your information to train or improve its AI models. Google processes it under its data processing terms for products where Google acts as a processor. This is a different Google service from Google Workspace and is covered by separate Google terms.

Gamma turns that content into the formatted report you receive.

Lawful basis: contract (Article 6(1)(b)), and Article 9(2)(h) for the health-related content, as your report is produced by a health provider as part of the service you have booked.

Your grades are set by your practitioner, not by AI. The grades in your report are recorded by the coach or physiotherapist who assessed you in person. The AI tools write and format the report around those grades. They do not assess you and do not change your grades.

Human involvement: your report is based on the assessment your practitioner carries out with you in person. The written report is then generated automatically from that assessment and is not individually reviewed before it is sent. If anything in your report looks wrong, please tell us and we will correct it.

Data retention: your report is retained as part of your client record for 8 years in line with HCPC guidelines.

Google Gemini, clinical reasoning (internal use only)

Our staff may use Google Gemini within Google Workspace to assist with clinical reasoning and programme planning. This is an internal tool only. Gemini is never used to communicate with you directly.

Data protection: HBS has accepted the Google Cloud Data Processing Addendum. Google does not use your data to train its AI models.
Anonymisation: all direct identifiers are removed before any client data is used in this way, under our internal standard operating procedure.
Clinical judgement: AI output is always reviewed by your practitioner. It supports our thinking; it does not make decisions about your care.

Everfit AI features. The Everfit platform includes its own AI functionality. We do not currently use these features with client information. Everfit’s own terms permit it to use information from the platform to train its AI models, on the basis that the information is anonymised first and does not identify any individual. See Section 6.

4b. Client stories and testimonials

We occasionally share client success stories on our social media channels (Facebook, Instagram) and use them internally for quality assurance and clinical development.

We will only ever share your story with your explicit consent. Your practitioner will ask you directly and record your answer. You will be shown the specific content we intend to share before it is published and asked to confirm you are happy with it.

Where stories are shared publicly we take steps to minimise identifiability. However, if a video or photo shows your face or other identifying features you remain identifiable, and we will seek your explicit consent under UK GDPR Article 9(2)(a) where the content shows or implies anything about your health.

Your consent covers use on our social media channels and internal use by our staff for quality assurance and clinical reasoning. You can withdraw it at any time by emailing hello@healthbyscience.co.uk. On withdrawal we will remove published content and delete the source files.

Source videos and photos are held in Google Drive with access restricted to your practitioner and our directors only.

5. Keeping your data safe

Encryption: your data is encrypted in transit (SSL/TLS), and our main record systems encrypt data at rest.
Access controls: only staff who need to see your data can access it. Our staff sign in to the systems holding your information through Google Workspace, and we are in the process of making two-step verification mandatory on all staff accounts.
Staff training: data protection training is being rolled out across our team, with completion recorded for each staff member. Access to client information is limited to the staff who need it to provide your care or manage your booking.
Regular reviews: we review our systems and processes regularly, and our data protection documentation at least annually with an external data protection consultant.
Breach notification: if a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it. If a breach is likely to result in a high risk to you, we will also contact you directly and without undue delay, explaining what happened and what you can do.

6. International data transfers

Some of our service providers are based outside the UK. Where that happens we put safeguards in place under Chapter V of the UK GDPR, which usually means the UK Extension to the EU-US Data Privacy Framework, or Standard Contractual Clauses with the UK International Data Transfer Addendum.

No transfer arises for: Google Workspace and Google Drive (configured to European servers), Heidi (UK servers), Synflow (Germany) and Brevo (France).

Safeguards in place for: Acuity Scheduling, WhatsApp, Zapier, QuickBooks, Slack, Google Analytics, Gamma Tech, Inc. and Typeform.

Google AI Studio. Google’s terms for this service permit your report data to be stored transiently or cached in any country where Google or its agents maintain facilities. Google processes it under its data processing terms for products where Google acts as a processor.

Everfit, an honest note

Everfit, Inc. is based in the United States. To transfer personal data there lawfully we need a specific safeguard recognised under UK law, such as the UK Addendum to the standard contractual clauses, the International Data Transfer Agreement, or certification under the UK Extension to the EU-US Data Privacy Framework.

We asked Everfit to put one of these in place. They told us they are not able to offer any of them and are not certified under the Data Privacy Framework. We do not currently have a UK-specific safeguard for this transfer, and we are not going to describe the position as anything other than that. Your information is protected by the European standard contractual clauses in our agreement with Everfit, which carry the same substantive protections, but the UK-specific instrument is missing.

Everfit has confirmed that your data is processed in the United States, by Everfit and by its sub-processors, all of which are also in the United States. Everfit’s terms also permit it to use information from the platform to train its own AI models, on the basis that the information is anonymised first and does not identify any individual.

We have taken and recorded a written decision to continue using Everfit while limiting what goes into it to the information needed to deliver your programme. Your clinical records, consultation notes and assessment reports are held in our own systems in the UK and Europe and are not copied into Everfit. We keep this decision under review and will revisit it if Everfit’s position changes.

If you would prefer your programme delivered without Everfit, please contact us at hello@healthbyscience.co.uk and we will arrange an alternative.

7. Your rights

You have the following rights over your personal data. To exercise any of them, email us at hello@healthbyscience.co.uk. We will respond within one month.

• Right of access (Subject Access Request): request a copy of all data we hold about you, together with details of how it is used, who it has been shared with, how long it is kept, and whether it has been transferred outside the UK.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your data, subject to our legal obligation to retain health records for 8 years under HCPC guidelines.
• Right to data portability: request a digital copy of your data to take elsewhere.
• Right to restrict processing: ask us to limit how we use your data in certain circumstances.
• Right to object: you can object to processing based on our legitimate interests, on grounds relating to your particular situation. For direct marketing this right is absolute: if you object we must stop immediately, you do not need to give a reason, and we will not ask you for one.
• Right to withdraw consent: where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before you withdrew it.

A note on Everfit. Because Everfit acts as an independent controller of the account information it collects from you directly, some rights requests about that information need to go to Everfit rather than to us. Contact us anyway and we will tell you which parts we can handle and help you with the rest. We are also required to let Everfit know within three working days when we receive a request that concerns your Everfit account, so you may hear from them separately.

8. Data retention

• Health records: 8 years from the date of last treatment, in line with HCPC guidelines.
• MOT assessment records and reports: retained as part of your client record for 8 years.
• Programme data in Everfit: your account is archived when your programme ends and deleted in line with the health records retention period above.
• Enquiry and contact records: 2 years from the date of last contact, unless you become a client.
• Enquiry conversations: held for as long as we need them to deal with your enquiry and, where you do not become a client, for 2 years from the date of last contact.
• Marketing lists: we keep your email address and marketing preference until you opt out or ask us to remove you. If you opt out we keep a suppression record so that we do not contact you again by mistake.
• Financial records: 7 years in line with HMRC requirements.
• Client story source files: for as long as your consent stands, and deleted on withdrawal.
• Automation data: Zapier moves information between the systems we use. Zapier keeps a record of these transfers, including the information passed, for 30 days. We do not use Zapier as a long-term storage system, and no clinical records or consultation notes pass through it.

If you would like more detail about how long we keep any particular information, please contact us at hello@healthbyscience.co.uk.

9. Cookies

We use cookies to help our website run smoothly. Some are essential, to keep the site working. Others are performance or targeting cookies, including Google Analytics 4, which help us understand how people use our site.

Google Signals. Our Google Analytics setup includes a Google feature called Google Signals. Where you are signed in to a Google account and have allowed Google to use your activity, this lets us understand how people use our site across different devices. It only operates if you consent to non-essential cookies, and you can withdraw that consent at any time.

You will be asked to consent to non-essential cookies when you first visit our website, and you can change your preferences at any time using the cookie settings link on our site. You can also manage cookies in your browser settings, though some parts of our site may not work as well if you disable certain cookies.

10. Changes to this policy

If we make significant changes to how we handle your data, we will let you know via email or a notice on our website. The date at the top of this policy will always reflect when it was last updated.

Contact us

If you have any questions about your privacy or wish to exercise your rights, please get in touch:

Data Protection Officer: Stuart Maytham
Email: hello@healthbyscience.co.uk
Phone: 0131 210 0002
Address: 98 Giles Street, Leith, Edinburgh, EH6 6BZ

If you are unhappy with how we have handled your personal information, please tell us at hello@healthbyscience.co.uk. We will acknowledge your complaint within 30 days and respond to it as quickly as we can.

You also have the right to complain to the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk | Helpline: 0303 123 1113