Privacy Policy

Who we are

Southampton Travel Vaccines is the controller of personal information used to provide this website and our travel-health services. You can contact us at [email protected] or through the contact page.

Information we collect

We collect identity and contact details, date of birth, sex at birth, account and security information, appointment details, orders, payments and communications.

To assess and provide care, we collect health information such as medical history, medicines, allergies, vaccination history, pregnancy or breastfeeding information, travel itinerary and clinical notes. Health information is special category data.

We may also collect technical and security information associated with use of the website, such as IP address, device or browser information, authentication events and necessary cookies. If you accept optional cookies, we also collect information about how you use our public web pages, as described under Cookies.

Where information comes from

Most information comes directly from you. Information may also be added by authorised staff and clinicians during care, received from somebody authorised to act for you, or generated through appointments, orders, payments and communications with the service.

Why we use information

We use personal information to create and secure accounts, arrange appointments, assess clinical suitability, provide and document care, manage orders and payments, communicate with you, answer enquiries, prevent misuse, meet regulatory duties and improve service operation.

Our Article 6 lawful bases may include performance of a contract, compliance with legal obligations and our legitimate interests in operating and securing the service and providing effective administration. Where we process health information for care, we rely on the applicable Article 9 condition for health or social care delivered by or under the responsibility of a health professional. Where consent is the appropriate basis for a separate optional activity, you may withdraw it.

We use optional advertising and analytics cookies only with your consent, to measure how our advertising performs and to understand and improve how people use our website.

Who we share information with

We share information only where necessary with authorised clinicians and staff, participating pharmacy locations, payment providers, website and database hosting providers, email and communications providers, professional advisers, regulators and public authorities, or emergency services where required.

Current service providers include Railway for application hosting, Supabase for database infrastructure, Resend for email delivery and Trust Payments for payment processing. Each receives only the information needed for its role.

If you accept optional cookies, Google receives information about your visit through Google Ads and Microsoft receives information about your visit through Microsoft Clarity. We do not send health information to these services.

International transfers

Some technology suppliers may process information outside the United Kingdom. Where this occurs, we use an applicable adequacy regulation or appropriate safeguards such as contractual protections, and assess the protection available for the information.

How long we keep information

We keep clinical records for the period required by applicable healthcare, professional, indemnity and legal requirements. Account, appointment, order, payment and communication records are retained for as long as needed for the service, legal obligations, dispute handling, fraud prevention and establishment or defence of legal claims.

When information is no longer required, it is deleted or anonymised securely. Retention may differ where a legal hold, safeguarding concern or regulatory requirement applies.

Your rights

Depending on the circumstances, you may have rights to access your information, correct it, request erasure or restriction, object to processing, receive portable data and withdraw consent where consent is the lawful basis. Some rights are limited where records must be retained or processing is required for care or by law.

To exercise a right, contact [email protected]. We may need to verify your identity before acting.

You may complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the opportunity to address your concern first.

Automated recommendations

The website may use answers and itinerary details to organise or highlight possible travel-health recommendations. These outputs support, but do not replace, clinician review and are not used alone to make a legal or similarly significant decision about you.

Security and account protection

We use technical and organisational safeguards designed to protect information, including access controls, authentication, encryption and monitoring. No internet service can guarantee absolute security, so tell us promptly if you suspect unauthorised account access.

Cookies

We use cookies and similar storage that are necessary for authentication, security and core website functions. These are always active because the website cannot work properly without them.

With your consent, we also use optional advertising and analytics cookies. When you first visit, we ask whether you accept or decline them, and we store your choice on your device. Optional cookies are not set unless you accept.

You can change or withdraw your choice at any time using Cookie settings at the bottom of any page, or by contacting [email protected].

• Google Ads (Google): measures visits and bookings that come from our adverts. Until you accept, Google Ads runs in a restricted mode that does not set advertising or analytics cookies.
• Microsoft Clarity (Microsoft): records how visitors use our public pages, such as clicks, scrolling and pages viewed, so we can improve the website. It loads only after you accept. Text you type is masked, and account, assessment, booking and payment pages are hidden from its recordings.

Children

Online patient account registration is restricted to people aged 18 or over. Information about a child may only be handled through an appropriate adult and clinical process where the service permits it.

Policy changes

We may update this policy as services, suppliers or legal requirements change. The current version and effective date will be published here, and material changes will be brought to users' attention where appropriate.