Privacy policy

Last Updated: 28 July 2026

At Health by Science, we take your privacy seriously. This policy explains what personal information we collect, why we need it, how we keep it safe, and your rights over it. It applies to all clients and website users in the United Kingdom.

1. Who we are

Health by Science Ltd is a Social Enterprise and Community Interest Company registered in Scotland (company number SC557048). We act as the data controller for the personal information we hold about you, meaning we are responsible for ensuring it is processed lawfully, fairly, and transparently.

Addresses: 98 Giles Street, Leith, Edinburgh, EH6 6BZ (Personal Training) and 100 Giles Street, Leith, Edinburgh, EH6 6BZ (Physiotherapy)
Email: hello@healthbyscience.co.uk
Phone: 0131 210 0002

Data Protection Officer: Stuart Maytham, Co-Director. You can contact our DPO about anything in this policy, or to exercise any of your rights, at hello@healthbyscience.co.uk.

We are registered with the Information Commissioner’s Office under registration number ZB629684.

2. Information we collect

Directly from you. When you fill out an enquiry form, contact us, complete a survey, or book an appointment, we collect details such as your name, contact information, and health history (current symptoms, medical background, and lifestyle information).

Booking appointments. We use Acuity Scheduling to manage our calendar. Acuity collects your contact details and appointment history so we can send you reminders and manage your bookings.

Enquiry and intake forms. We use Typeform for some enquiry and client intake forms. Typeform is based in Spain, within the EU.

During consultations. We use Google Meet for video consultations. With your explicit consent, we also use Heidi AI to assist with automated clinical note-taking during in-person and online sessions. Notes produced by Heidi AI are pseudonymised within the system. See Section 4a.

MOT assessments. If you book a Movement, Injury, Strength or Performance MOT, your coach or physiotherapist records your movement grades, notes on each movement pattern, mobility restrictions and relevant lifestyle factors on a structured assessment form. This is used to produce your summary report. See Section 4a.

Your programme app (Everfit). We use Everfit to deliver your exercise and rehabilitation programmes. Through the app we hold your name and contact details, your programme, your exercise and progress records, self-reported symptoms, outcome measures and any messages between you and your practitioner. Everfit, Inc. is based in the United States. Please see Section 6.

Everfit’s own role. When you create your Everfit app account, Everfit also collects information about you directly, under its own privacy policy. For that information Everfit acts as an independent controller alongside us, which means Everfit decides how it uses that information and may use it for its own business purposes. We cannot control or instruct that use. You can read Everfit’s privacy policy at everfit.io/privacy. If you want to exercise your data protection rights over the information Everfit holds in its own right, you will need to contact Everfit directly, and we will help you do that.

Client communications. We use WhatsApp (Meta) to send appointment reminders and brief administrative messages. We do not send clinical information, diagnoses or consultation notes via WhatsApp. We use Zapier to connect our systems and automate routine tasks such as booking confirmations and report delivery.

Marketing emails. We use Brevo (Sendinblue SAS, France) to manage our email lists and send marketing emails. Brevo holds your email address, first name, and which of our services you have enquired about or used. See Section 3a.

Payments. We use Stripe to process payments. Stripe holds your name, payment amount and transaction reference. We do not see or store your card details.

Accounts and invoicing. We use QuickBooks (Intuit) for our financial records. Your name and payment references may appear on invoices.

Website and AI chat. We use Synflow as our AI receptionist and website chat widget. Synflow is based in Germany, within the EU. When you interact with our website chat, Synflow may collect your name, contact details, and the content of your enquiry.

Website analytics. We use Google Analytics 4 to understand how people use our site. Your IP address is anonymised. This only happens if you consent to non-essential cookies. See Section 9.

Internal team communications. We use Slack for internal communication between our staff. Your name and contact details may be mentioned in staff messages when we are coordinating your care. Slack is not one of our clinical record systems, and our staff are instructed not to share consultation notes, diagnoses or treatment details there. Where clinical information is unavoidably mentioned while coordinating your care between practitioners, we rely on Article 9(2)(h), described in Section 3. Slack Technologies, Inc. is based in the United States. See Section 6.

AI-assisted clinical reasoning (internal use). Our clinical and coaching staff may use Google Gemini within Google Workspace to assist with clinical reasoning and programme planning. Before any client data is used with Gemini in this way, all direct identifiers are removed. See Section 4a.

3. How we use your information

• Providing care: To give you personalised health advice and maintain accurate records of your sessions.
• Communication: To send you reminders, updates, and responses to your questions via email, the Everfit app, and WhatsApp.
• Programme delivery: To create, manage, and deliver your personalised exercise and rehabilitation programmes through Everfit.
• Assessment reporting: To produce and send your MOT summary report.
• Legal and professional standards: We are required by HCPC guidelines to keep health records for 8 years.
• Improving our service: To analyse trends anonymously so we can improve our website, app, and services.
• Marketing: To send occasional emails about our services to people who have asked to hear from us. See Section 3a.

Our lawful bases for processing

For personal data generally (UK GDPR Article 6):

• Contract (Article 6(1)(b)), to deliver the services you have booked
• Legal obligation (Article 6(1)(c)), to maintain health records as required by HCPC guidelines
• Legitimate interests (Article 6(1)(f)), for enquiry management, service improvement, internal analytics, and marketing to people who have used our services
• Consent (Article 6(1)(a)), for non-essential cookies and website analytics

For health information, which is “special category” data and needs an additional basis (UK GDPR Article 9):

• Health and social care purposes (Article 9(2)(h)), for your clinical records, your MOT assessments and reports, your rehabilitation and training programmes, and communication between practitioners involved in your care. This is our main basis for handling your health information. It applies because we are a regulated health provider and your information is handled by health professionals under a duty of confidentiality.
• Explicit consent (Article 9(2)(a)), for Heidi AI note-taking and for client stories and testimonials. These are the two things we will always ask you about separately, and you can decline either without it affecting your care.

3a. Marketing communications

We may occasionally send emails to people who have enquired about or used our services, covering new or returning services, health and wellbeing tips, and updates from Health by Science.

How we decide who to email. When you make an enquiry or book with us, we ask you directly whether you would like to hear from us. We only send marketing emails to people who say yes. If you say no, we keep a record of that so we do not contact you by mistake, and our email system automatically blocks every send to you.

Lawful basis. We rely on our legitimate interests in communicating with people who have engaged with our services (UK GDPR Article 6(1)(f)). A Legitimate Interest Assessment has been completed and is held on file. Under the UK Privacy and Electronic Communications Regulations we also rely on the soft opt-in for existing clients (Regulation 22), and we go beyond the minimum by asking you directly at the point of enquiry or booking.

How to stop. Every marketing email contains an unsubscribe link. You can also reply STOP to any marketing email, or email hello@healthbyscience.co.uk. We action opt-outs immediately. You have an absolute right to object to direct marketing under UK GDPR Article 21, and we will stop with no need for you to give a reason.

What we will not do. We will never share or sell your email address to third parties for marketing. We do not reference your health conditions, diagnoses or treatment history in marketing emails.

Confirmations are different. Booking confirmations, payment receipts, appointment reminders and your MOT report are service messages, not marketing. You will continue to receive these even if you have opted out of marketing, because we need to send them to deliver the service you have booked.

4. Who we share your data with

We do not sell your data. We only share it with trusted third-party “data processors” who help us run our business, and we have Data Processing Agreements in place with them.

• Programme delivery: Everfit, Inc. (USA), exercise and rehabilitation programme management. Everfit is also an independent controller of the account information it collects from you directly, as explained in Section 2
• Assessment reports: Google AI Studio (Gemini), report content generation; Gamma Tech, Inc. (USA), report formatting and hosting
• Scheduling and forms: Acuity Scheduling (Squarespace, USA), appointment booking and reminders; Typeform (Spain), client intake forms and surveys
• Consultations and notes: Google (Meet, Drive, Workspace), video calls, document storage, and AI-assisted clinical reasoning, under our Google Cloud Data Processing Addendum; Heidi AI (UK), automated consultation note-taking, with your consent
• Automation and communications: Zapier (USA), workflow automation; WhatsApp (Meta, USA), client communications
• Marketing email: Brevo / Sendinblue SAS (France), email list management and delivery
• Payments: Stripe Payments Europe Ltd (UK and EEA), payment processing
• Accounting: Intuit / QuickBooks (USA), financial records and invoicing
• Internal communications: Slack Technologies, Inc. (USA), staff messaging
• Website and AI receptionist: Synflow (Germany), AI chat widget and enquiry management
• Website analytics: Google Analytics 4, anonymised usage statistics, subject to your cookie consent
• Social media: Meta (Facebook and Instagram), where you have consented to us sharing your story. Meta acts as an independent platform, not as our processor

Please note that Google AI Studio is a separate Google service from Google Workspace and operates under different Google terms, as explained in Section 4a.

Our bookkeeper and accountants have access to our QuickBooks account as authorised users of our systems. They work under confidentiality agreements with us.

Only authorised Health by Science staff who have completed data protection training may access your information.

4a. AI usage information

Health by Science uses AI tools in three ways that may involve your information. This section explains all three.

Heidi AI, clinical note-taking

Heidi AI is used to assist with note-taking during in-person and online consultations. It transcribes and summarises conversations to help our practitioners produce accurate clinical records.

• What it processes: your spoken words during the consultation, health information you share, and any other information discussed as part of your care.
• How we protect your data: Heidi Health Ltd is a UK company and processes and stores your data on UK servers. Your data is pseudonymised within the system. We have a Data Processing Agreement in place with Heidi.
• Lawful basis: explicit consent. You will be asked to consent via a checkbox on our booking form. You may withdraw consent at any time by emailing hello@healthbyscience.co.uk.
• If you withdraw consent: we will stop using Heidi for your sessions immediately and ask Heidi to delete your transcripts. Notes already reviewed and saved to your clinical record will be retained as part of that record, as we are required to keep it.
• Data retention: notes are retained for 8 years in line with HCPC guidelines. Raw transcription data is subject to Heidi’s own retention policy.
• Opting out: use of Heidi AI is entirely optional. Leave the checkbox unticked when booking and our practitioners will take notes manually instead. This will not affect your care.

MOT report generation

When you complete a Movement, Injury, Strength or Performance MOT, we produce your summary report using two AI tools.

• What is processed: your first name, your assessment date, the movement grades your practitioner recorded, the notes they made on each movement pattern, any mobility restrictions identified, and relevant lifestyle information you have shared. We do not put your consultation notes, clinical records, contact details or date of birth into these tools.
• Google AI Studio (Gemini) turns your assessment data into the written content of your report. Because we are in the UK, Google’s paid-service data terms apply, which means Google does not use your information to train or improve its AI models. Google processes it under its data processing terms for products where Google acts as a processor. This is a different Google service from Google Workspace and is covered by separate Google terms.
• Gamma turns that content into the formatted report you receive.
• Lawful basis: contract (Article 6(1)(b)), and Article 9(2)(h) for the health-related content, as your report is produced by a health provider as part of the service you have booked.
• Your grades are set by your practitioner, not by AI. The grades in your report are recorded by the coach or physiotherapist who assessed you in person. The AI tools write and format the report around those grades. They do not assess you and do not change your grades.
• Human involvement: your report is based on the assessment your practitioner carries out with you in person. The written report is then generated automatically from that assessment and is not individually reviewed before it is sent. If anything in your report looks wrong, please tell us and we will correct it.
• Data retention: your report is retained as part of your client record for 8 years in line with HCPC guidelines.

Google Gemini, clinical reasoning (internal use only)

Our staff may use Google Gemini within Google Workspace to assist with clinical reasoning and programme planning. This is an internal tool only. Gemini is never used to communicate with you directly.

• Data protection: HBS has accepted the Google Cloud Data Processing Addendum. Google does not use your data to train its AI models.
• Anonymisation: all direct identifiers are removed before any client data is used in this way, under our internal standard operating procedure.
• Clinical judgement: AI output is always reviewed by your practitioner. It supports our thinking; it does not make decisions about your care.

Everfit AI features. The Everfit platform includes its own AI functionality. We do not currently use these features with client information.

4b. Client stories and testimonials

We occasionally share client success stories on our social media channels (Facebook, Instagram) and use them internally for quality assurance and clinical development.

We will only ever share your story with your explicit consent. Your practitioner will ask you directly and record your answer. You will be shown the specific content we intend to share before it is published and asked to confirm you are happy with it.

Where stories are shared publicly we take steps to minimise identifiability. However, if a video or photo shows your face or other identifying features you remain identifiable, and we will seek your explicit consent under UK GDPR Article 9(2)(a) where the content shows or implies anything about your health.

Your consent covers use on our social media channels and internal use by our staff for quality assurance and clinical reasoning. You can withdraw it at any time by emailing hello@healthbyscience.co.uk. On withdrawal we will remove published content and delete the source files.

Source videos and photos are held in Google Drive with access restricted to your practitioner and our directors only.

5. Keeping your data safe

• Encryption: your data is encrypted both in transit (SSL/TLS) and at rest.
• Access controls: only staff who need to see your data can access it. Two-factor authentication is required on our staff accounts.
• Staff training: all staff complete mandatory data protection training before accessing client data.
• Regular reviews: we review our systems and processes regularly, and our data protection documentation at least annually with an external data protection consultant.
• Breach notification: if a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it. If a breach is likely to result in a high risk to you, we will also contact you directly and without undue delay, explaining what happened and what you can do.

6. International data transfers

Some of our service providers are based outside the UK. Where that happens we put safeguards in place under Chapter V of the UK GDPR, which usually means the UK Extension to the EU-US Data Privacy Framework, or Standard Contractual Clauses with the UK International Data Transfer Addendum.

No transfer arises for: Google Workspace and Google Drive (configured to European servers), Heidi AI (UK servers), Synflow (Germany), Typeform (Spain) and Brevo (France).

Safeguards in place for: Acuity Scheduling, WhatsApp, Zapier, QuickBooks, Slack and Google Analytics, all in the United States.

Google AI Studio. Google’s terms for this service permit your report data to be stored transiently or cached in any country where Google or its agents maintain facilities. Google processes it under its data processing terms for products where Google acts as a processor.

Everfit, an honest note. Everfit, Inc. is based in the United States and holds your programme and progress information. We are currently working with Everfit to put the specific UK-approved transfer safeguards in place, and this is not yet complete. In the meantime we limit what we hold in Everfit to what is needed to deliver your programme. Your full clinical records are held separately in our own systems on European servers and are not copied into Everfit. If you would prefer your programme to be delivered without using Everfit, contact us and we will discuss alternatives with you.

Gamma. Gamma Tech, Inc. is based in the United States. We are currently confirming the UK transfer safeguards for this provider. Your MOT report contains your first name and assessment findings only, and no contact details or clinical records.

7. Your rights

You have the following rights over your personal data. To exercise any of them, email us at hello@healthbyscience.co.uk. We will respond within one month.

• Right of access (Subject Access Request): request a copy of all data we hold about you, together with details of how it is used, who it has been shared with, how long it is kept, and whether it has been transferred outside the UK.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your data, subject to our legal obligation to retain health records for 8 years under HCPC guidelines.
• Right to data portability: request a digital copy of your data to take elsewhere.
• Right to restrict processing: ask us to limit how we use your data in certain circumstances.
• Right to object: you can object to processing based on our legitimate interests, on grounds relating to your particular situation. For direct marketing this right is absolute: if you object we must stop immediately, you do not need to give a reason, and we will not ask you for one.
• Right to withdraw consent: where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before you withdrew it.

A note on Everfit. Because Everfit acts as an independent controller of the account information it collects from you directly, some rights requests about that information need to go to Everfit rather than to us. Contact us anyway and we will tell you which parts we can handle and help you with the rest. We are also required to let Everfit know within three working days when we receive a request that concerns your Everfit account, so you may hear from them separately.

8. Data retention

• Health records: 8 years from the date of last treatment, in line with HCPC guidelines.
• MOT assessment records and reports: retained as part of your client record for 8 years.
• Programme data in Everfit: your account is archived when your programme ends and deleted in line with the health records retention period above.
• Enquiry and contact records: 2 years from the date of last contact, unless you become a client.
• Marketing lists: we keep your email address and marketing preference until you opt out or ask us to remove you. If you opt out we keep a suppression record so that we do not contact you again by mistake.
• Financial records: 7 years in line with HMRC requirements.
• Client story source files: for as long as your consent stands, and deleted on withdrawal.
• Automation data: information passing through Zapier is in transit only and is subject to Zapier’s own retention terms. We do not store data in Zapier.

For full details please refer to our Data Retention Policy, available on request.

9. Cookies

We use cookies to help our website run smoothly. Some are essential, to keep the site working. Others are performance or targeting cookies, including Google Analytics 4, which help us understand how people use our site. Analytics data is anonymised.

You will be asked to consent to non-essential cookies when you first visit our website, and you can change your preferences at any time using the cookie settings link on our site. You can also manage cookies in your browser settings, though some parts of our site may not work as well if you disable certain cookies.

10. Changes to this policy

If we make significant changes to how we handle your data, we will let you know via email or a notice on our website. The date at the top of this policy will always reflect when it was last updated.

Contact us

If you have any questions about your privacy or wish to exercise your rights, please get in touch:

Data Protection Officer: Stuart Maytham
Email: hello@healthbyscience.co.uk
Phone: 0131 210 0002
Address: 98 Giles Street, Leith, Edinburgh, EH6 6BZ

You also have the right to complain to the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk | Helpline: 0303 123 1113