Privacy Policy

Last updated: 13 November 2026

1. Who we are
This policy explains how Roshni Clinic, the trading name of ROSHNI CLINIC LTD, a private company limited by shares (company number 11787834, registered in England and Wales; registered office: 297 Manningham Lane, Bradford, Yorkshire, England, BD8 7NA), collects and uses personal information through roshniclinic.com and in providing our services ("we", "us"). We are the controller of the information described here. For any question about your information, call us on +44 7345 099569, use our Contact page, or write to us at our registered office.

2. The information we collect
- Contact details: your name, email address, phone number and, where needed, your address.
- Your assessment answers: your age, sex, height and weight, goals, experience, lifestyle, and your answers to our health and suitability questions.
- Health information from your care: consultation notes, measurements, prescriptions, treatments you receive, progress check-ins and messages with our clinical team.
- Orders and payments: the services you book, your preferred appointment times and the payments you make. Card payments are handled by Stripe; we never see or store your full card details.
- Messages you send us through our contact form, by email or by phone.
- Technical information needed to run the website securely, such as your IP address and browser type in our server logs.

3. Health information is special
Information about your health is "special category" data under UK data protection law, and we treat it with particular care. We use it only to assess whether our services are suitable for you and to provide your care. It is seen only by the people involved in your care and the staff who support them.

4. Why we use your information, and our lawful bases
- To assess your suitability and provide your consultations, programme and treatments, and to keep your clinical record: to take steps at your request before entering a contract with you and to perform that contract. For your health information, we rely on its being necessary for the provision of health care under the responsibility of a health professional.
- To take payments and keep financial records: to perform our contract with you and to meet our legal obligations.
- To reply to your enquiries and arrange appointments: our legitimate interest in responding to people who contact us.
- To keep our website and systems secure and working: our legitimate interest in running a safe service.
- To send you news and offers by email: only with your consent, which you can withdraw at any time by using the unsubscribe link or contacting us.
We do not sell your information, and we do not use it for advertising profiling.

5. How decisions about your care are made
Your assessment answers are checked against safety rules set by our clinical team, which highlight answers that need a closer look. Decisions about whether a programme, treatment or medicine is suitable for you are made by our clinical team, and you will never be refused care by a decision made solely by a computer. You can always ask to speak to a member of our team about a decision.
If a prescription-only medicine is considered, we may ask for your consent to contact your GP, and we may share relevant information with them where it is important for your safety.

6. Who we share your information with
We share your information only where needed, with:
- our clinical team and the staff who support your care;
- our service providers, who process it on our instructions and under contract: the PepFlow platform that runs our website, assessments, records and patient portal, our cloud hosting provider, and our email and messaging providers;
- Stripe, our payment provider, which processes your payment;
- your GP or another healthcare professional, where you agree or where it is necessary for your safety;
- regulators, the police or other authorities, where the law requires it.

7. International transfers
Some of our service providers, such as Stripe, may process information outside the UK. Where they do, we make sure it is protected by the safeguards UK law requires, such as UK adequacy regulations or the International Data Transfer Agreement.

8. How long we keep your information
- Clinical records, including your assessment if you become a patient: for 8 years after your last contact with us, in line with NHS records guidance for adults.
- An assessment that does not lead to care, and enquiries: for up to 2 years, then deleted.
- Payment and financial records: for 6 years, as tax law requires.
- Marketing preferences: until you withdraw your consent.

9. Keeping your information secure
Your information is sent over encrypted connections and stored on secure systems with access limited to those who need it. Your patient portal is protected by your own login.

10. Cookies and similar technologies
We do not use advertising or analytics cookies. We use only what the website needs to work: your browser keeps your cart, an assessment in progress and the summary shown after you submit it, so that you do not lose them; and a cookie may be set when you arrive through a link from our team, so that we know which link you used. Staff use a sign-in cookie to access our admin area.

11. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information, where we are not required to keep it;
- ask us to restrict or to stop using your information in certain cases;
- ask for information you gave us in a format you can take elsewhere; and
- withdraw your consent at any time, where we rely on it.
To use any of these rights, contact us. We will reply within one month. We may need to confirm your identity first.

12. Complaints
If you are unhappy with how we have used your information, please contact us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

13. Children
Our services are for adults aged 18 and over. We do not knowingly collect information about children.

14. Changes to this policy
We may update this policy from time to time. The latest version is always on this page.