Privacy Policy

Last updated: July 2026

1. Introduction

Together Clinic is operated by At Health Ltd, a GPhC-registered online pharmacy and independent prescribing service. We are committed to protecting your privacy and handling your personal information responsibly, securely and transparently.

This Privacy Policy explains how we collect, use, store, share and protect your personal information when you visit our website at www.togetherclinic.co.uk, book a consultation, request a prescription, purchase medication or otherwise interact with us online.

Because Together Clinic provides prescription medication and clinical healthcare services — including weight management treatments — some of the personal information we process is classified as special category health data under UK data protection law. We take our obligations in respect of this data extremely seriously.

By using our website and services, you acknowledge that you have read and understood this Privacy Policy. Please read it carefully before submitting any personal information to us.

2. Who We Are — Data Controller

At Health Ltd (trading as Together Clinic) is the Data Controller responsible for your personal information. As Data Controller, we determine how and why your personal data is processed, and we are responsible for ensuring that processing is carried out in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Company: At Health Ltd (t/a Together Clinic)
Website: www.togetherclinic.co.uk
Email: support@togetherclinic.co.uk
Superintendent Pharmacist: Ahmed Nizar Al-Liabi (GPhC No.: 2208502, Independent Prescriber)

If you have any questions about how we handle your personal data, or wish to exercise your data protection rights, please contact us at support@togetherclinic.co.uk.

3. Information We Collect

3.1 Personal Information You Provide

We collect personal information that you provide directly to us, including when you register, book a consultation, complete a health assessment or place an order. This may include:

Full name and date of birth
Contact details — email address, telephone number, postal address
Account login credentials
Consultation and health assessment responses
Medical history, current medications and health conditions
Prescription and treatment information
Payment information (processed securely via Stripe — we do not store full card details)
Identity verification documents (where required)
GP details and NHS number (where relevant)
Communications with our clinical and support teams

3.2 Special Category Health Data

As a clinical prescribing service offering weight management treatments and other prescription medications, we necessarily process special category health data about you. This includes information about your physical health, medical history, weight, BMI, existing conditions and current treatments.

Special category health data receives additional legal protection under UK GDPR. We process this data only where we have a lawful basis to do so, and handle it with the highest standards of confidentiality in accordance with GPhC and NHS guidelines.

3.3 Technical Information Collected Automatically

When you visit our website, we may automatically collect certain technical information, including:

IP address and approximate location
Browser type, version and language
Device type and operating system
Pages visited, links clicked and time spent on pages
Referring URL (how you arrived at our website)
Date and time of access
Cookie identifiers and session data

This information is used to maintain website security, analyse usage patterns and improve the performance and usability of our website.

4. How We Use Your Information

We use your personal information for the following purposes:

To create and manage your patient account
To conduct clinical consultations and health assessments
To issue, process and manage prescriptions
To dispense and deliver prescription medications
To process payments for consultations and medication orders
To manage your treatment plan, including repeat prescriptions and dose adjustments
To send you appointment confirmations, order updates and clinical communications
To verify your identity where required for regulatory compliance
To respond to your enquiries and provide patient support
To comply with our legal, regulatory and professional obligations as a GPhC-registered pharmacy
To prevent fraud, misuse of our services and protect patient safety
To improve our website, services and clinical processes
To send you marketing communications about our services where you have given your explicit consent

You may withdraw your consent to marketing communications at any time by contacting us at support@togetherclinic.co.uk or by using the unsubscribe link in any marketing email.

5. Legal Basis for Processing

We process your personal information on one or more of the following lawful bases under UK GDPR:

Contract. Processing is necessary to provide our services to you — including conducting consultations, issuing prescriptions and delivering medication.
Legal obligation. Processing is necessary to comply with our obligations as a GPhC-registered pharmacy, under MHRA regulations, the Human Medicines Regulations 2012, and other applicable legislation.
Legitimate interests. Processing is necessary for our legitimate interests in operating and improving our services, preventing fraud and maintaining website security, where these interests are not overridden by your data protection rights.
Consent. Where we rely on consent — including for marketing communications and, where required, for the processing of special category health data — we will ask for your explicit consent at the appropriate time. You may withdraw consent at any time.

5.1 Special Category Health Data

Where we process special category health data, we do so under Article 9(2)(h) UK GDPR — processing necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment — and/or with your explicit consent under Article 9(2)(a). All such processing is carried out under the obligation of professional secrecy in accordance with GPhC standards.

6. Sharing Your Information

We do not sell, rent or trade your personal information. We may share your information with carefully selected third-party organisations only where necessary to deliver our services, operate our systems or comply with legal obligations.

All third-party providers are required to process your personal information securely, confidentially and in accordance with applicable data protection law. Where required, we have Data Processing Agreements in place with our providers.

6.1 Third-Party Service Providers

The third parties we currently work with include:

Provider	Purpose	Privacy Policy
Stripe	Payment processing for consultations and medication orders	stripe.com/gb/privacy
Gildhart (PharmoDigital Ltd)	Digital marketing, website design and management	gildhart.com
Google Analytics	Website traffic and usage analytics	policies.google.com/privacy
Kinsta	Website hosting and infrastructure	kinsta.com/legal/privacy-policy
Booking system	Appointment scheduling	To be confirmed

6.2 Clinical and Regulatory Disclosure

We may also share your personal information in the following circumstances:

With your GP or other treating clinicians where clinically necessary or where you have requested this.
With the General Pharmaceutical Council (GPhC), MHRA or other regulatory bodies where required by law or for inspection purposes.
With law enforcement or other authorities where required by law, court order or to protect the safety of patients or the public.
With our professional indemnity insurers where necessary in connection with a claim or complaint.

7. Cookies

Our website uses cookies and similar technologies to provide core functionality, analyse how visitors use our website, remember your preferences and support our marketing activity.

7.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device on subsequent visits and store certain information about your preferences or activity.

7.2 Types of Cookies We Use

Strictly necessary cookies: Essential for the website to function. These cannot be disabled and do not require your consent. They include cookies that manage your session, maintain security and support the checkout process.
Analytics cookies: Used to collect anonymised information about how visitors use our website (e.g. pages visited, time spent, referral source). We use Google Analytics for this purpose. You can opt out of Google Analytics tracking at tools.google.com/dlpage/gaoptout.
Functional cookies: Allow the website to remember choices you have made (such as your preferred language or login status) to provide a more personalised experience.
Marketing cookies: Used to track visits across websites and deliver advertising relevant to your interests. These are only set with your consent.

7.3 Managing Cookies

When you first visit our website, you will be presented with a cookie consent banner allowing you to accept or decline non-essential cookies. You can update your preferences at any time via the cookie settings link in our website footer.

You can also manage or delete cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our website. For more information, visit www.allaboutcookies.org.

8. Data Security

We implement appropriate technical, organisational and physical safeguards to protect your personal information against accidental loss, unauthorised access, misuse, alteration or disclosure. These measures include:

Encryption of data in transit using TLS/SSL
Encrypted storage of sensitive personal and health data
Access controls restricting data access to authorised personnel only
Regular security assessments and staff training
Secure payment processing via Stripe — we do not store full card details on our systems

While we take all reasonable steps to protect your information, no method of internet transmission or electronic storage is completely secure. If you have concerns about the security of your data, please contact us at support@togetherclinic.co.uk.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with our obligations under UK GDPR.

9. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or to comply with our legal, regulatory and professional obligations.

Patient health and prescription records: Retained for a minimum of 8 years from the date of last treatment in accordance with NHS and GPhC guidance (or until the patient’s 25th birthday if they were a child at the time of treatment, whichever is longer).
Financial and transaction records: Retained for 7 years in accordance with HMRC requirements.
Marketing consent records: Retained for as long as you remain an active subscriber, plus a reasonable period to evidence consent in the event of a complaint.
Website analytics data: Retained in anonymised or aggregated form for up to 26 months (standard Google Analytics retention).
General enquiry and contact data: Retained for up to 2 years from the date of last contact, unless a longer period is required.

When your personal information is no longer required, it will be securely deleted or anonymised.

10. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights in relation to your personal information:

Right of access. You may request a copy of the personal information we hold about you (a Subject Access Request).
Right to rectification. You may request that we correct any inaccurate or incomplete personal information.
Right to erasure. You may request that we delete your personal information where there is no longer a lawful basis for us to hold it — subject to our legal and regulatory retention obligations (see Section 9).
Right to restrict processing. You may request that we limit how we use your personal information in certain circumstances.
Right to object. You may object to processing based on our legitimate interests, including the use of your data for direct marketing purposes.
Right to data portability. Where processing is based on consent or contract and carried out by automated means, you may request a copy of your data in a structured, commonly used and machine-readable format.
Right to withdraw consent. Where we rely on consent as our lawful basis, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at support@togetherclinic.co.uk. We will respond to your request within one calendar month. In some cases, we may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

11. Children’s Privacy

Our services are intended for adults aged 18 and over. We do not knowingly collect personal information from individuals under the age of 18. If you believe that we have inadvertently collected information from a minor, please contact us immediately at support@togetherclinic.co.uk and we will take steps to delete it.

12. International Data Transfers

We aim to process and store your personal information within the United Kingdom and the European Economic Area (EEA). Where any of our third-party providers process data outside the UK or EEA, we ensure that appropriate safeguards are in place — such as Standard Contractual Clauses approved by the ICO — to protect your personal information in accordance with UK GDPR.

13. Third-Party Links

Our website may contain links to third-party websites, platforms or services. We are not responsible for the privacy practices or content of those websites. We encourage you to review the privacy policies of any third-party sites before providing your personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, technology, our services or the third parties we work with. Any material changes will be published on this page together with an updated “Last Updated” date. Where changes are significant, we may also notify you by email.

We encourage you to review this page periodically to stay informed about how we protect your personal information.

15. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have a concern about how we handle your personal information, please contact us:

Company: At Health Ltd (t/a Together Clinic)
Website: www.togetherclinic.co.uk
Email: support@togetherclinic.co.uk

You also have the right to raise a concern directly with the Information Commissioner’s Office (ICO):

ICO website: www.ico.org.uk
ICO helpline: 0303 123 1113