NHS Privacy Notice – Your Menopause

Harley Street at Home
Version 1.2 | December 2025
(Updated to reflect platform, hosting, suppliers, and data-handling processes confirmed by technical lead.)

1. Purpose of this Privacy Notice

This Privacy Notice explains how Harley Street at Home (“we”, “us”) processes personal data for patients accessing the Your Menopause community under an NHS-funded pilot or commissioning arrangement.

We are committed to protecting your privacy and complying with the UK GDPR and Data Protection Act 2018.

2. Who We Are

Harley Street at Home
Melrose, Chapel Lane, Pirbright, Woking, Surrey, GU24 0JZ

Email (general support): support@harleystathome.com
Email (data protection): nigel@nigeldenby.co.uk

Data Protection Lead / DPO: Mr Nigel Denby
ICO Registration: ZC042237

Data Controller: Harley Street at Home
Data Processor: Circle (community platform provider)

Additional processors are listed in Section 6.

3. What Data We Collect

Depending on how you sign up, we collect:

When accessing via the NHS pilot link or website:

• First name
• Last name
• Email address
• Practice name (only for some NHS signups)

Inside the community:

• Name
• Email address
• Interests or topics you choose to follow
• Interactions inside the community (e.g., posts, comments, event attendance)

Optional information:

• Menopause-related interests
• Menopause stage (only if you choose to provide it)

We do not request or require clinical information or medical records.

You may voluntarily share health-related details in posts or comments. This is optional and can be edited or deleted by you at any time. These details are not used for clinical purposes and do not form part of any NHS health record.

4. How We Use Your Data

We use your information to:

• Create and manage your secure community account
• Provide access to non-clinical, expert-led menopause information
• Offer peer and educational support
• Deliver live events, group sessions and community interactions
• Monitor engagement (anonymous and aggregated)
• Report pilot outcomes to the NHS
  • No identifiable data is shared with commissioners

Your Menopause is a non-clinical service.
We do not diagnose, treat, or provide personalised medical advice.

5. Legal Basis for Processing

For NHS-funded access, our legal bases are:

Public Task (Article 6(1)(e))
Processing is necessary for the performance of a task carried out in the public interest under an NHS commissioning arrangement.

Legitimate Interests (Article 6(1)(f))
To operate a safe and supportive community, ensure platform security, and improve our non-clinical service.

Consent (Article 6(1)(a))
Used only where required, such as for newsletters or optional marketing.

6. Who We Share Your Data With

We only share personal data with authorised providers who support this service:

Active Platforms and Technical Providers

• Circle – community platform hosting
• Stripe – secure payment provider (if applicable)
• Postmark – transactional email delivery
• NameCrane – hosting for harleystathome.com
• Hetzner (Germany) – secure VPS hosting for the NHS signup script
  • logs retained up to 14 days, then auto deleted
  • no personal data stored persistently
• Plausible – privacy-focused web analytics (no cookies, no tracking of individuals)

Legacy systems being decommissioned (may hold historic data)

• Mailchimp
• Memberstack

We only share anonymous and aggregated statistics with NHS commissioners to evaluate the pilot.
We do not share identifiable information with the NHS.
We never sell your data.

7. International Transfers

Circle hosts data in the United States.

Where personal data is transferred outside the UK, Circle uses:

• Standard Contractual Clauses (SCCs)
• Appropriate additional safeguards

to ensure protection in line with UK GDPR requirements.

8. How Long We Keep Your Data

For NHS pilots, we keep your information:

• For the duration of the pilot, and
• Up to 12 months after the pilot ends, unless you request deletion sooner.

Anonymous engagement data may be kept for longer as it does not identify you.

9. Your Rights

You have the right to:

• Access your information
• Request corrections
• Request deletion of your account
• Object to processing
• Withdraw consent (where applicable)
• Request data portability

To exercise your rights, email: support@harleystathome.com
We will respond within the required legal timescales (normally 1 month).

10. Data Security

We use a combination of technical and organisational measures, including:

• Encrypted hosting and secure servers
• Multi-factor authentication for staff
• Role-based access controls
• Regular access logs and security reviews
• Admin-only visibility of member directories
• Automated log deletion (Hetzner VPS)
• Secure cloud tools (e.g., Google Workspace, Zoom)
• Moderation and safeguarding processes

We follow NHS data protection expectations for non-clinical digital wellbeing services.

11. Contact and Complaints

General support:
support@harleystathome.com

Data protection concerns:
Nigel Denby – Data Protection Lead
Email: nigel@nigeldenby.co.uk

If you are not satisfied, you may contact the Information Commissioner’s Office (ICO):
Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113