The HeliosCheck.com privacy policy

1. Who we are

HeliosCheck.com is a consultant-led gynecology and women’s health consultancy. It is operated by [COMPANY LEGAL NAME], a company registered in [COUNTRY OF REGISTRATION] under company number [COMPANY REGISTRATION NUMBER], with its registered office at [REGISTERED OFFICE ADDRESS]. Where this policy says “we”, “us” or “HeliosCheck”, it means that company.

For the purposes of the UK GDPR, the EU GDPR and the Data Protection Act 2018 we are the data controller for the personal data described below. Our clinicians are also bound, independently of data protection law, by professional duties of confidentiality. You can read who they are on our about page, and how a consultation is conducted on how it works.

Our data protection registration number is [ICO / DPA REGISTRATION NUMBER]. This policy sits alongside our terms of service, our medical disclaimer and our cookie policy. Read together, those four documents describe the whole relationship between you and HeliosCheck.com.

2. What personal data we collect

Data you give us directly

• Enquiry data. Your name, email address, and the content of any message you send through our contact page or by email.
• Booking and account data. Contact details, the consultation type you chose, the appointment time, your time zone, and the confirmation reference returned by our payment processor. Full card numbers never reach our servers.
• Intake form data. Cycle and bleeding history, obstetric and gynecological history, current medicines and doses, contraception, allergies and past reactions, relevant family history, and the one question you most want answered. This is health data.
• Documents you upload. Blood results, imaging or scan reports, letters from other clinicians, and photographs you choose to send. These are stored inside your clinical record, not in general file storage.
• Consultation and follow-up data. The clinical note written during or after your appointment, the written plan we issue, and the messages you exchange with your clinician during the 14-day follow-up window.
• Feedback and complaints. Anything you tell us about how the service went, including a formal complaint and our response to it.

Data we collect automatically

When you browse helioscheck.com we collect standard technical data: IP address (truncated before storage wherever analytics consent has been given), browser and device type, referring page, the pages you viewed, and the approximate region the request came from. Strictly necessary cookies operate whatever you choose; analytics cookies are set only after you consent, and the full list is in our cookie policy.

Data we receive from other people

Occasionally a third party sends us data about you: your own doctor or a hospital team, where you have asked for results or a letter to be shared with us; our payment processor, which confirms whether a payment succeeded; and, rarely, a relative or carer contacting us on your behalf. We check that anyone contacting us on your behalf has your authority before we discuss anything clinical with them.

3. Health data is special-category data

Almost everything a gynecologist needs to know is, in legal terms, special-category personal data under Article 9 of the UK and EU GDPR. That category covers data concerning health, sex life and sexual orientation, and processing it is prohibited outright unless a specific condition in Article 9(2) is met. A lawful basis under Article 6 is necessary but not sufficient — a second condition is always required on top.

For care delivered through HeliosCheck.com we rely primarily on Article 9(2)(h): processing necessary for the provision of health care or treatment, carried out by or under the responsibility of a professional subject to a duty of professional secrecy. In the UK that is coupled with the condition at Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Where processing is not care — for example sending a summary to a third party because you asked us to — we rely on your explicit consent under Article 9(2)(a), recorded at the time you gave it.

In practice this means two things. We ask only for the health information we genuinely need to answer your question, and we do not repurpose it afterwards. Your intake form is not used to build a marketing profile, is not enriched with third-party data, and is not used to train any external model.

4. Our lawful bases, purpose by purpose

The law requires a lawful basis for each purpose, not one basis for the whole business. Ours are set out in full below, alongside the Article 9 condition that applies to health data.

Where we rely on legitimate interests we have carried out a balancing assessment, and you can ask us for a summary of it using the contact details at the end of this page.

5. How we use your data

• To reply to your enquiry and, if you go ahead, to arrange and hold the consultation.
• To let your clinician read your history before you meet — the reason a HeliosCheck.com appointment can open with your actual question rather than your date of birth.
• To write and send your plan, and to answer your follow-up messages for 14 days.
• To write the section of your plan intended for your own doctor, which we give to you to forward. We do not send it behind your back.
• To keep an accurate clinical record, as our regulators and indemnity providers require.
• To take payment, issue receipts and meet tax obligations.
• To handle a complaint, a safeguarding concern or a legal claim.
• To keep the service secure and investigate misuse.
• With your consent only: to understand which of our conditions pages are actually read, so we know what to write and update next.

We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not profile you for advertising. No clinical decision on HeliosCheck.com is made by software: a named consultant reads your history, speaks to you, and signs the plan.

6. Who we share your data with

We share the minimum necessary, with a defined list of recipients, each under a written contract that limits what they may do with it.

• Your clinician and the clinical team. The consultant you are booked with, and — where cover is genuinely required, for example during illness or leave — another consultant bound by the same duties.
• Our secure hosting and infrastructure providers. They store the encrypted record. They do not access its contents except where strictly necessary for technical support, under our instruction, and every such access is logged.
• Our video and secure messaging provider. Consultations run over an encrypted connection. Calls are not recorded by default.
• Our payment processor. They receive the data needed to take the fee and tell us whether it succeeded. We never receive your full card details.
• Another clinician or service you have asked us to write to. Only with your explicit, recorded consent, and only the information you agreed to.
• Emergency services or a hospital team, where there is an immediate risk to your life and you are not able to consent — the vital interests basis described above.
• Our professional advisers, indemnity provider and auditors, where necessary to establish, exercise or defend a legal claim or to meet a regulatory obligation.
• A regulator, court or public authority, where we are legally compelled to disclose. We satisfy ourselves that the request is valid and disclose only what is required.

What we never do: we do not sell personal data, we do not share it with data brokers, we do not pass it to advertising networks, and we do not place advertising or retargeting pixels on helioscheck.com. No commercial arrangement anywhere in this business depends on your health information leaving it.

7. A note for patients in the United States

HIPAA applies to covered entities and their business associates, and whether it applies to a particular consultation depends on how that consultation is paid for and delivered. [HIPAA covered-entity status to be confirmed by US counsel before launch.] Rather than wait on that determination, we have built the service to HIPAA-aware standards throughout: minimum-necessary disclosure, role-based access control, audit logging of every record access, encryption in transit and at rest, workforce confidentiality training, and Business Associate Agreements with US-based processors that handle protected health information.

Where HIPAA does apply to your care, you additionally have the right to receive a Notice of Privacy Practices, to request an accounting of certain disclosures, to ask for confidential communications by an alternative means or at an alternative address, and to complain to the Office for Civil Rights without retaliation. The CDC’s public health law summary of HIPAA is a readable starting point if you would rather understand the framework than take our word for it. State law may give you further rights: several US states impose stricter rules on reproductive health data than HIPAA does, and where they apply, they apply.

8. International transfers

HeliosCheck.com serves patients in more than one country, so some data crosses borders. Where personal data leaves the UK or the EEA we rely on one of the following: a finding of adequacy by the UK government or the European Commission covering the destination country; the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses; or the EU Standard Contractual Clauses themselves, supported by a transfer risk assessment and, where needed, supplementary technical measures such as encryption with keys held in the originating region.

Our primary hosting region is [PRIMARY HOSTING REGION]. Our current sub-processor list is available on request from the address below, and you can ask which transfer mechanism we rely on for any named processor.

9. How long we keep your data

We do not keep data indefinitely, and we do not delete clinical records early simply because it would be tidier. Those two constraints pull in opposite directions, so the periods are set explicitly rather than left to judgement.

Retention minimums for health records are set by regulators, not by us. If you want to see how a national health system frames the same duty, the NHS explains how patients access their own health records and what is held on their behalf. At the end of the applicable period, records are securely destroyed or irreversibly anonymised.

10. Your rights

You have the following rights over your personal data. They are free to exercise, and asking about them will never affect the care you receive.

• Access. Ask for a copy of the personal data we hold about you, including your clinical record. We answer within one calendar month and do not charge for a first, reasonable request.
• Rectification. Ask us to correct anything inaccurate. In a clinical record we do not erase the original entry — we add a dated correction alongside it, which is the professionally correct way to handle it.
• Erasure. Ask us to delete data. This applies fully to enquiries, analytics and marketing records. It does not usually extend to clinical records we are legally and professionally required to retain; where that is the case we tell you which rule applies.
• Restriction. Ask us to pause processing while a dispute about accuracy or lawful basis is resolved. The record is kept but not otherwise used.
• Portability. Ask for the data you gave us in a structured, commonly used, machine-readable format, or ask us to send it directly to another provider where that is technically feasible.
• Objection. Object to processing based on our legitimate interests. We stop unless we can show compelling grounds that override your rights — and we always stop for direct marketing, no questions asked.
• Withdraw consent. Where we rely on consent — analytics cookies, optional emails, a disclosure to a third party you authorised — you can withdraw it at any time. Withdrawal does not undo processing that was lawful before you withdrew.
• Complain to a supervisory authority. The Information Commissioner’s Office in the UK, your national data protection authority in the EEA, or the Office for Civil Rights at the US Department of Health and Human Services where HIPAA applies. You do not have to come to us first, though we would like the chance to put it right.

How to exercise a right

Write to hello@helioschecks.com with “data rights request” in the subject line, or use the contact page. We will ask you to verify your identity — that protects you, not us — and we will respond within one calendar month. If your request is complex we may extend by up to two further months, and we will tell you why inside the first month. If we decide we cannot do what you have asked, we will name the exemption we are relying on and explain how to challenge that decision.

11. How we protect your data

• Encryption in transit (TLS 1.2 or above) and at rest for all clinical records and uploads.
• Role-based access control: a clinician sees the records of their own patients, not everyone’s.
• Multi-factor authentication on every staff and clinician account.
• Audit logging of record access, retained and reviewed.
• Clinical data and website analytics held separately, and never joined.
• A written data processing agreement with every processor, and due diligence before any is appointed.
• Confidentiality and information governance training for everyone with access, refreshed annually.
• A documented incident response procedure. Where a personal data breach is likely to result in a risk to your rights and freedoms we notify the supervisory authority within 72 hours of becoming aware, and we notify you directly, without undue delay, where the risk is high.

No system is perfectly secure and we will not pretend otherwise. What we can commit to is collecting less than we could, keeping it no longer than we must, and telling you plainly if something goes wrong. Please do not send clinical details through social media or other unencrypted channels — use the routes described on our contact page.

12. Children and young people

HeliosCheck.com consultations are intended for people aged 16 and over. We do not knowingly collect personal data from a child under 16 without the involvement of a parent or legal guardian. Where care for a young person under 16 is arranged, it is arranged in advance through the contact page, with a parent or guardian present unless the clinician assesses the young person as competent to consent and judges it appropriate for them to be seen alone. That assessment, and the reasoning behind it, is recorded.

If you believe a child has given us personal data without the right authority, tell us and we will delete it promptly, subject only to any record we are professionally required to keep about the contact itself.

13. Changes to this policy

We update this policy when the service changes, when a processor changes, or when the law changes. The date at the top of the page always reflects the current version. Where a change materially affects how we use data you have already given us, we will tell you directly by email rather than rely on you noticing a new date. Previous versions are archived and available on request.

14. Contact us, and our Data Protection Officer

For anything in this policy — a question, a rights request, or a complaint — write to:

• Email: hello@helioschecks.com
• Data Protection Officer: [DPO NAME], [DPO EMAIL ADDRESS], [DPO POSTAL ADDRESS]. A DPO must be appointed and named here before launch — large-scale processing of special-category health data makes this mandatory under Article 37(1)(c).
• Postal address: [COMPANY LEGAL NAME], [REGISTERED OFFICE ADDRESS]
• UK or EU representative, if applicable: [REPRESENTATIVE NAME AND ADDRESS]

If you are not satisfied with our response you can complain to the Information Commissioner’s Office in the UK, to your national data protection authority in the EEA, or to the Office for Civil Rights at the US Department of Health and Human Services where HIPAA applies.

Read next: our terms of service, our medical disclaimer, our cookie policy, and our editorial policy, which explains how the health information published on HeliosCheck.com is written and reviewed. Common questions about privacy and confidentiality are also answered on our FAQ page.