Privacy Policy

Information we process

We process information used to create and secure accounts, find clinics, request and manage bookings, record Care Balance contributions and reservations, reconcile Stripe payments, operate provider accounts, answer support requests and maintain security and audit records.

A customer's reusable health profile and booking-specific health forms may include symptoms, medication, pregnancy, contraindications and treatment history. Treatment records may include the practitioner's notes and an image of handwritten notes. Payment card details are collected and processed by Stripe; Colonic Club stores the payment reference, status and amount rather than full card details.

The practitioner onboarding journey asks for a name, clinic or business name, email address, acquisition route and declaration of a current accepted professional route and appropriate insurance. Phone, website and town or postcode are optional. A membership reference is optional for an ARCH or RICTAT declaration; an applicant asking Colonic Club to consider another professional route must name that route. We store the declaration as the auditable onboarding credential and, for a member-specific offer, store the waiver request and its verification outcome. If a website is supplied, we may privately extract profile suggestions for the practitioner to review, edit, accept or reject. We also process clinic locations, invited team contact details and roles, public profile text and images, services, prices, availability, separately required evidence, agreement records and Stripe recipient-onboarding status. Bank-account and identity verification details are entered on Stripe's hosted pages rather than ordinary Colonic Club forms. Customer launch notifications ask for an email address and optional town or postcode.

If you choose Use my current location, your browser asks for permission and sends an approximate location to Colonic Club only long enough to find the nearest UK postcode. We do not save those coordinates. The postcode lookup is provided by Postcodes.io; only the resulting postcode is placed in the search box, and you can change it before searching.

The optional appointment-logistics field is limited to arrival, access and timing information. Customers are told not to enter health, symptom, medication or clinical information there; likely clinical content is rejected and must be supplied through the encrypted, booking-scoped health form instead.

Provider booking-operation notes are likewise limited to scheduling, access and administrative actions. Therapists are directed to the protected health-form review and their clinic clinical record for clinical reasoning or health information.

Who is responsible and how to contact us

Colonic Club is responsible for deciding how personal information submitted to the platform is used for platform purposes. The business responsible for those platform purposes is: WeBoost Ltd trading as Colonic Club (company number 08554565), registered office 5 Hanselin Court, Gedling, Nottingham, England, NG4 3LS.

Privacy questions and rights requests can be sent to hello@colonicclub.com. You can ask hello@colonicclub.com for our current data-protection registration details.

Why we use the information

We rely on contract, or steps requested before a contract, to create an account, operate Care Balance, take a booking, collect and reconcile payment, manage changes and provide customer support. Information needed for these journeys is contractual: without the required contact, booking, payment and appointment information, we may be unable to open the account, process the payment or provide the requested booking service.

We rely on legal obligation where tax, accounting, consumer, data-protection or regulatory law requires a record. We rely on legitimate interests for proportionate account security, fraud prevention, service improvement, complaint handling and the defence of legal claims, after considering the person's rights and reasonable expectations.

We use therapist application details to take requested steps towards a provider agreement and to assess eligibility. Clinics use booking and clinical information for their independent treatment, safety and record-keeping responsibilities.

Optional public-site analytics and optional news or marketing emails rely on separate consent. Withdrawing consent does not affect earlier lawful processing and does not remove a launch-notification request or therapist application unless the person also asks us to delete it and no overriding retention reason applies.

Health information

Health information is special-category personal data. For Colonic Club's customer-controlled profile and booking-share functions, we use the requested platform service under UK GDPR Article 6 and ask for explicit consent under Article 9. We ask for a separate clear statement before saving a reusable profile and another clear, booking-specific action before sharing a copy. The treating clinic records its own lawful basis and special-category condition for clinical care and records. A therapist—not an automated rule—makes every suitability decision.

The reusable profile is private to the customer. When the customer authorises sharing for a booking, the system creates a versioned copy for the active practitioner assigned to that exact appointment. A clinic owner qualifies only when they are that assigned practitioner. Clinic staff, other practitioners and platform administrators cannot read the clinical content merely because of their role. A separate customer choice may permit clinic-authorised staff to view an appointment questionnaire and prepare notes, without changing answers or clinically approving treatment. Updating the reusable profile later does not silently change an earlier booking copy.

Health answers and treatment records are encrypted in storage, excluded from public analytics and ordinary emails, and protected by access logs. A customer may choose not to create a reusable profile. A clinic may still require an appointment health form before treatment for safety. Withdrawing a booking share stops future access where the system permits it, but may mean the appointment cannot go ahead and does not require deletion of a record that must lawfully be retained.

Information received from other sources

Clinics and practitioners supply profile, location, service, availability, qualification, insurance, professional-route and team information. Colonic Club may verify a stated membership or registration against the relevant professional source. That verification does not imply the organisation endorses Colonic Club. Stripe supplies payment and payout status; connected calendars supply busy-time information; security and hosting suppliers provide service and access logs. We use each source only for the platform, verification, payment, availability, security or legal purpose described in this policy.

Sharing, storage and international transfers

Access to ordinary account, booking and payment information is limited to authorised clinic users, Colonic Club personnel and suppliers needed to host, secure and operate the service. Clinical content has the narrower assigned-practitioner boundary described above. Suppliers include Vercel for hosting and private file storage, Neon for database services, Stripe for payments, Resend for service emails and Postcodes.io for a postcode returned from optional location search. Optional Google Analytics and Vercel Web Analytics are limited to consented public-site activity and excludes signed-in and health routes.

We do not sell personal information, disclose health information for advertising or make a health form available to every clinic. Where a supplier processes information outside the UK, we use an applicable UK transfer safeguard, such as an adequacy regulation or approved contractual protections, and keep a record of the assessment. A copy or summary of the relevant safeguard can be requested from hello@colonicclub.com.

Retention, rights and complaints

We keep information only for as long as its purpose, the relevant contract, clinic clinical-record duty, tax/accounting requirement, complaint, security investigation or legal claim requires. Abandoned health drafts are normally deleted or anonymised after 30 days. Submitted forms and treatment records follow the approved clinic and insurance retention schedule, with access restricted throughout. Legal holds pause deletion only for the affected record and reason.

Appointment logistics are restricted to the booked clinic team and retained with the booking record under the booking, financial, complaint and legal retention schedule. They are not used for marketing or copied into analytics or ordinary email content.

Waitlist and launch-notification information is kept only while it is needed to operate and review the launch process and will normally be deleted or anonymised within 24 months of submission, unless the person asks for earlier deletion or a legal, security or dispute reason requires longer retention. Optional marketing records are kept until consent is withdrawn or the contact is no longer needed.

People can ask for access, correction, deletion, restriction, portability or objection where the relevant UK data-protection right applies. They can withdraw consent at any time by emailing hello@colonicclub.com.

We do not use solely automated decision-making to decide whether treatment is suitable. A person who is unhappy with our response can complain to the UK Information Commissioner's Office. Contacting Colonic Club first gives us an opportunity to resolve the concern.

Your right to object

You have an absolute right to object to direct marketing at any time. You may also object where we rely on legitimate interests; we will stop unless we can show a compelling lawful reason to continue or the information is needed for a legal claim. Use the unsubscribe route in an optional marketing email or contact hello@colonicclub.com.