Privacy Notice

Last updated: August 12, 2026

Who we are

Naya Health Limited ("Naya Health", "we", "us", "our") is a private healthcare provider registered in England and Wales under company number 16542212, with our registered office at 25 Bedford Square, London WC1B 3HH. Our clinical services are delivered at our flagship clinic at Until Marylebone, 1A Orchard Street, London W1H 6HJ, and other local and international locations, where regulated activities are carried out under the Care Quality Commission (CQC) registration held by Until; Until does not have access to your patient records, and Naya Health is the sole data controller of the personal and health information described in this notice.

Being the data controller means we are responsible for deciding how and why your information is used. We are registered with the Information Commissioner's Office (ICO), registration number ZB961535.

Our Data Protection Lead is Daniel Honeywell. For any questions about this notice or your personal information, contact admin@wearenaya.com or write to us at the address above.

Who this notice covers

This notice explains how we handle personal information about visitors to our website, people who enquire about our services or book a discovery call, and patients who receive care from us. Because we are a healthcare provider, some of the information we hold is health information, a "special category" of data that receives extra protection under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The information we collect

Information you give us directly:

Contact and identity details: your name, date of birth, address, phone number and email address, provided when you enquire, book a discovery call or register as a patient.
Health information: information about your symptoms, conditions, medical history, medication and previous treatment that you share with us when enquiring, during discovery calls, in questionnaires, and during assessment and treatment. This includes clinical records, consultation notes, treatment records and outcome measures (including NayaScore™ data).
Next of kin and GP details: emergency contact information and, where you provide them, your GP's details.
Payment information: billing details and payment confirmations. Card payments are handled by our payment processors; we do not store full card numbers.
Correspondence: the content of emails, messages, contact-form submissions and calls with us

Information we collect automatically:

Usage data: when you use our website we collect technical information such as your IP address, browser and device information and how you interact with the site, using cookies and similar technologies (see "Cookies" below).

Information from third parties:

With your knowledge, we may receive information from your GP, a referring clinician or another healthcare provider involved in your care, and from our booking, platform and payment providers who collect information on our behalf.

How we use your information and our legal grounds

UK GDPR requires us to have a lawful basis for using your personal information, and an additional condition for health information. The table below sets out our purposes and the legal grounds we rely on.

Purpose

Responding to enquiries and arranging discovery calls

Personal information used

Contact details; information you share about your health and treatment history

Lawful basis

Art. 6(1)(b): steps taken at your request before entering into a contract. For health information: Art. 9(2)(h): provision of health care, together with Sch. 1, Part 1, para. 2 of the Data Protection Act 2018.

Providing assessment, consultations and rTMS treatment; maintaining your medical record; measuring outcomes (NayaScore™)

Identity and contact details; medical and treatment records; assessment and outcome data

Art. 6(1)(b): performance of our contract with you; Art. 6(1)(c): the legal and regulatory obligations that apply to the delivery of regulated healthcare services. For health information: Art. 9(2)(h) and DPA 2018 Sch. 1, Part 1, para. 2 (health care), processed by or under the responsibility of professionals owing a duty of confidentiality.

Communicating with you about appointments, results and aftercare

Contact details; relevant clinical information

Art. 6(1)(b): performance of our contract. For health information: Art. 9(2)(h) as above

Taking payment and keeping accounts

Billing details; payment confirmation (we do not store full card details)

Art. 6(1)(b): performance of our contract; Art. 6(1)(c): legal obligation (tax and accounting law).

Sending marketing emails and our newsletter

Name and email address only. We do not use your health information for marketing

Art. 6(1)(a): your consent, which you
may withdraw at any time.

Improving our website and services; analytics

Usage data collected via cookies and similar technologies

Art. 6(1)(f): our legitimate interests in operating and improving our services; consent for non-essential cookies (PECR).

Understanding how well our treatments work; evaluating, developing and improving our services; service audit and research; and reporting on our services

Clinical and treatment records, assessment and outcome data,questionnaire responses, and information shared during discovery calls and consultations. Wherever possible we use anonymised or aggregated information from which you cannot be identified

Art. 6(1)(f): our legitimate interests in understanding and improving the care we provide. For health information: Art. 9(2)(h) and DPA 2018 Sch. 1, Part 1, para. 2 (management of health care services), processed by or under the responsibility of professionals owing a duty of confidentiality; and, where the work amounts to research or statistical analysis, Art. 9(2)(j) and DPA 2018 Sch. 1, Part 1, para. 4, subject to the safeguards in section 19 of that Act.

Responding to complaints; establishing or defending legal claims; safeguarding

Relevant records, which may include clinical records

Art. 6(1)(c) or 6(1)(f); for health information, Art. 9(2)(f): legal claims, or Art. 9(2)(h)/(b) as applicable

Emergencies

Relevant clinical information

Art. 6(1)(d) and Art. 9(2)(c): protecting vital interests where you are unable to consent.

Using your feedback or testimonial publicly

Testimonial content and any identifying details you agree to

Art. 6(1)(a) and Art. 9(2)(a): your explicit consent, obtained separately in writing.

A note on health information: as a healthcare provider we rely on the "provision of health care" condition, not on your consent, to process the health information needed to assess and treat you. This is deliberate: it means your care does not depend on a consent tick-box, and your clinical record remains intact and accurate. Your consent to the treatment itself is always sought separately as part of good clinical practice, and you remain free to decline or stop treatment at any time.

A note on anonymised information: we also use information about our patients in anonymised or aggregated form, from which no individual can be identified, to understand how well our treatments work, to plan and develop our clinics, and to report on our services to our partners, funders and regulators. Once information has been anonymised in this way it is no longer personal information, so the rights described below do not apply to it.

Confidentiality

Your health information is handled by, or under the responsibility of, clinicians and staff who are bound by professional and contractual duties of confidentiality.

Who we share your information with

We never sell your personal information. We share it only where necessary, with:
• Our clinical team and, where relevant to your care, the specialist clinicians we partner with (for example in psychology, neurology or nutrition), under duties of confidentiality;
• Your GP or other healthcare providers: normally only with your agreement, unless we are required to share information by law or there is a serious risk to your or someone else's safety;
• Service providers who support our business, such as our website and e-commerce platform, appointment and booking systems, clinical record systems, IT and cloud-storage providers, call recording and transcription providers, and payment processors, under contracts that require them to protect your information and use it only on our instructions;
• Specialist consultants and analysts we engage to help us evaluate, develop and improve our services, who work only on our instructions and under confidentiality obligations equivalent to those owed by our clinical team;
• Our regulators and authorities where required, including the CQC and the ICO;
• Our insurers, and professional advisers such as lawyers and accountants, where necessary;
• Emergency services, where necessary to protect your vital interests.

International transfers

Some of our service providers process data outside the UK. Where they do, we make sure your information receives an equivalent level of protection, either because the country has been assessed as adequate by the UK Government, or through approved safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep your information

• Clinical records: in line with healthcare records-management guidance, we keep patient records for a minimum of 8 years from the conclusion of treatment, and longer where guidance or law requires (for example, certain mental health records may be kept for up to 20 years).
• Enquiries and discovery-call records where you do not become a patient: up to 12 months, unless you ask us to delete them sooner, or up to 3 years where you have told us we may use them to help us understand and improve our service.
• Financial records: 6 years plus the current financial year, as required by tax law.
• Marketing data: until you unsubscribe or withdraw consent.

When information is no longer needed, t is securely deleted or anonymised.

Security

We use appropriate technical and organisational measures to protect your information, including access controls, encryption in transit, staff confidentiality obligations and contracts with our suppliers. If a breach ever put your rights at high risk, we would inform you and the ICO as required by law.

Your rights

Under UK GDPR you have the right to:
• access a copy of the personal information we hold about you (a "subject access request"), including your clinical records;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information, though please note we are usually required to retain clinical records for the periods described above;
• ask us to restrict how we use your information, or object to uses based on our legitimate interests;
• receive certain information in a portable format;
• withdraw consent at any time where we rely on it (for example, marketing); this will not affect your care;
• not be subject to solely automated decisions with legal or similarly significant effects; we do not make such decisions.

To exercise any of these rights, contact admin@wearenaya.com. We will respond within one calendar month. We may need to verify your identity first. Exercising your rights is free of charge.

Complaints

If you are unhappy with how we have handled your information, please contact us first at admin@wearenaya.com so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Cookies

Our website only uses cookies that are essential to make it work, for example to remember your session during checkout. We do not use cookies for analytics or advertising, so no cookie consent banner is needed. If this changes in future, we will update this notice and put a consent banner in place before any non-essential cookies are used. For details of the essential cookies used by our platform provider, see www.shopify.com/legal/cookies.

Children

Our services are for adults aged 18 and over, and our website is not directed at children. We do not knowingly collect children's information; if you believe a child has provided us with personal information, please contact us and we will delete it.

Changes to this notice

We may update this notice from time to time. We will publish the updated version on this page and, where changes are significant, take reasonable steps to bring them to your attention.