Legal
What we collect, why we hold it, who sees it, and what you can ask us to do with it.
Draft, awaiting legal review. This wording is a working draft prepared to complete the page. It must be reviewed and approved by Peptide MD’s legal advisor before launch.
Last updated
31 July 2026
Peptide MD provides private medical consultations about peptide therapy. For the purposes of UK data protection law, Peptide MD is the data controller for the information described in this policy.
If you booked through a partner company’s website, that company is a separate controller for the booking and payment information it holds about you. This policy covers only what Peptide MD holds.
We collect the minimum needed to run your appointment and the doctor’s record of it.
For your appointment and the clinical record, our lawful bases are the contract between us and, for health information, the provision of healthcare under Article 9(2)(h) UK GDPR.
For analytics we rely on your consent, which you can withdraw at any time.
We share your information only with the organisations needed to deliver the service: our scheduling provider, our payment provider, our email provider, and our hosting and infrastructure providers. Each is bound by contract and processes data only on our instructions.
We do not sell your data, and we do not share your health information with partner companies. A partner sees that an appointment took place and its status, never what was discussed or what you wrote on the intake form.
Clinical records are retained in line with UK medical record-keeping guidance. Booking and payment records are kept for as long as required for accounting and tax purposes. Analytics data is retained for a shorter period.
When a retention period ends, information is deleted or irreversibly anonymised.
Data is stored on servers within the UK or European Economic Area. Where a provider processes data outside that area, the transfer is covered by an adequacy decision or by standard contractual clauses.
Under UK GDPR you have the right to:
Data is encrypted in transit and at rest. Access is restricted to the people who need it to do their job, and access to clinical information is limited to the doctor and to authorised Peptide MD staff.
For any question about this policy, or to exercise any of the rights above, email hello@peptidemd.co.uk. We respond within one month.
Questions about this document? Contact us.
