Privacy Policy
How Ombriel collects, uses, and protects personal data.
This Privacy Policy explains how Ombriel (“we”, “us”, “our”) processes personal data when you visit ombriel.top, request an appointment, or contact us. We follow UK GDPR and the Data Protection Act 2018.
1. Data controller
The data controller is:
Ombriel
Suite 4, Victoria Health House
11 Whitworth Street
Manchester M1 3UW
England
Email (general): [email protected]
Email (privacy): [email protected]
Telephone: +44 161 496 2189
2. Personal data we collect
2.1 Appointment request form
When you submit the booking request form we collect:
- Full name
- Telephone number
- Preferred consultation type (specialty)
- Preferred time window
- Optional free-text comment
- Confirmation that you agree to this Privacy Policy
We deliberately do not collect payment card details, medical history, diagnoses, or detailed symptoms through this website form. Please do not include sensitive health details in the optional comment field beyond what is needed to prepare a visit (for example, accessibility needs).
2.2 Contact by email or phone
If you email or call us, we process the contact details and information you choose to provide so we can respond.
2.3 Technical and cookie data
We process limited technical data such as IP address (stored as a one-way hash in our logs where applicable), browser type, and pages visited. Non-essential cookies (analytics and marketing) are used only after you give consent via our cookie banner. See our Cookie Policy.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Responding to appointment requests and arranging visits | Name, phone, specialty, preferred time, message | Art. 6(1)(b) UK GDPR — steps prior to a contract / service arrangement; and Art. 6(1)(a) where you tick the privacy consent box |
| Providing clinical care at a confirmed appointment | Contact and visit details; clinical notes held separately in clinic records | Art. 6(1)(b) and, for health data, Art. 9(2)(h) with appropriate safeguards under UK law |
| Operating and securing the website | Technical logs, strictly necessary cookies | Art. 6(1)(f) — legitimate interests (security, integrity of service) |
| Analytics (if enabled) | Cookie identifiers, usage metrics | Art. 6(1)(a) — consent |
| Advertising measurement (if enabled) | Cookie / advertising identifiers | Art. 6(1)(a) — consent |
| Responding to privacy or legal requests | Identity and correspondence | Art. 6(1)(c) — legal obligation; Art. 6(1)(f) where applicable |
Cookie consent and form privacy consent are separate. Accepting cookies does not replace the Privacy Policy checkbox on the appointment form.
4. Recipients and processors
We may share data with:
- Clinic staff involved in scheduling and care
- Hosting and IT providers who process data on our instructions
- Analytics or advertising partners only if you consent to those cookie categories
- Professional advisers or authorities where required by law
We do not sell your personal data.
5. International transfers
Our primary operations are in the United Kingdom. If a processor stores or accesses data outside the UK, we use appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or adequacy regulations, where required.
If you consent to Google or Meta advertising/analytics tools, those providers may process data in accordance with their own terms and safeguards. Information about how Google uses data when you use sites or apps that use Google services is available at Google Business Data Responsibility.
6. Retention
- Appointment enquiries (website form): up to 24 months after the last meaningful contact about that request, unless a longer period is needed for an established patient relationship or legal claim.
- Clinical records: retained according to UK clinical record-keeping standards applicable to private practice (typically longer than enquiry logs).
- Cookie consent logs: up to 24 months to demonstrate compliance.
- Server security logs: typically up to 12 months.
7. Your rights
Under UK GDPR you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase data in certain circumstances
- Restrict processing
- Data portability (where applicable)
- Object to processing based on legitimate interests
- Withdraw consent at any time (without affecting prior lawful processing)
To exercise these rights, email [email protected]. We may need to verify your identity. You can withdraw cookie consent anytime via .
8. Complaints
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office (ICO)
Website: https://ico.org.uk/
9. Children
This website is aimed at adults arranging private consultations. We do not knowingly collect data from children through the online form for marketing purposes. Appointments for minors should be arranged by a parent or guardian.
10. Automated decision-making
We do not use automated decision-making or profiling that produces legal or similarly significant effects about you based on the website form.
11. Security
We use appropriate technical and organisational measures, including HTTPS for the website, access controls for clinic systems, and hashed IP storage in certain logs. No method of transmission is completely secure; please avoid sending highly sensitive health details by unsolicited email unless we ask you to do so through a secure channel.
12. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Significant changes will be highlighted on the website where appropriate.
13. Contact
Questions about this policy: [email protected] · Clinic: [email protected] · +44 161 496 2189.