New Leaf Health Privacy Policy

Policy last updated: 28/07/2026

We at New Leaf Health Ltd are committed to protecting and respecting your privacy. This policy, together with any other documents referred to within, sets out the basis on which we will process any personal data that we collect from you. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

For the purpose of the Data Protection Act 2018 (Act) / EU General Data Protection Regulation 2016 (GDPR), the data controller is New Leaf Health Ltd Mill House, High Street, Kinver, DY7 6ER.

All of our services and website content are directed at UK adults over the age of 18.

This policy is divided into two separate sections: the first section is for wellbeing buyers who will typically use our website https://newleafhealth.co.uk to browse our services. The second section is for end-users, who engage with our services delivered in the workplace, and may use our online booking platform at https://booking.newleafhealth.co.uk.

Our Contact Details

Name: New Leaf Health Ltd

Address: Mill House, High Street, Kinver, DY7 6ER

Telephone: 01384 877 855

Email: enquiries@newleafhealth.co.uk

Company Registration Number: 5684654

ICO Registration Number: ZC142550

Section 1 – For Wellbeing Buyers

This section is for the people who buy our services on a business-to-business basis and will mostly interact with the website https://newleafhealth.co.uk.

1.1 What Information we Collect from You

We currently collect and process the following information:

• Your contact details (including full name, place of work, work email address and work phone number).
• Your correspondence with us.
• Your browsing activity on our website.

1.2 How and Why we use Your Information

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• You enquire with us via email, telephone, or through a form on our website.
• You download an asset through a form on our website.
• You purchase one of our products or services.

We also receive personal information indirectly, from the following sources in the following scenarios:

• From third-party websites that promote our services (such as Mental Health First Aid England, or CPD) when you enquire or register with them regarding one of our services.
• From third-party marketing agencies as part of a wider list for the purpose of marketing.

We use the information in order to:

• Provide you with information on our services and products.
• Facilitate and fulfil the services that we have sold to you.
• Process your purchases through our website (for online orders).
• Contact you for marketing purposes (see 1.6 for full details).
• Contact you for feedback purposes.
• Suppress your contact details to prevent us from contacting you again in the future, if you have requested that we don’t contact you.

1.3 Our Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

• Performance of a contract. Where you have purchased a service from us, we process your details to fulfil that order and provide the service.
• Consent. When signing up for information we rely on your consent and your explicit consent for health information. You are able to remove your consent at any time. You can do this by contacting enquiries@newleafhealth.co.uk.
• We have a legitimate interest and are contacting you on a work email address for business purposes.

Where we contact you by email for marketing purposes, we ensure this complies with the Privacy and Electronic Communications Regulations (PECR), including reliance on the corporate subscriber exemption where applicable. You will be able to opt out of marketing communications at any time by using the unsubscribe link in our email footer, or by contacting enquiries@newleafhealth.co.uk.

1.4 How we Store and Protect Your Information

Your information is securely stored on our systems and is protected from outside and unauthorised access by appropriate organisational and technical measures.

• We retain your contact details from enquiries for a maximum of 5 years, to assist in any future enquiries you may make. At this point, your contact details (name and email address) will be removed from our databases, wherever possible.
• When you become a client, we retain your contact details for the duration of our business relationship and for 7 years afterwards, after which we will review and delete information. We will retain any records or correspondence relating to services you have undertaken with us, and we will keep general information on the company and the services undertaken.
• For data we have acquired via third-party marketing agencies for marketing purposes, we will retain your contact information for a maximum of 3 years, or for the length of time specified by the supplier (usually no more than 24 months). We will then delete your information from our system. We may, however, obtain your information again via the third-party marketing agency.
• In instances where you have requested that we no longer contact you, we will keep a copy of your email address only for the purpose of suppression, to allow us to screen against any data we may acquire from third-party marketing agencies, in order to prevent us from unintentionally re-acquiring your personal data and contacting you.

We may also retain specific information only necessary for the following reasons:

• If there is an unresolved issue relating to your account, such as an outstanding invoice on your account;
• If necessary for its legitimate business interests, such as fraud prevention;
• If we are required to by applicable law; and/or
• In aggregated and/or anonymised/pseudonymised form.

1.5 Who we Share Your Information With

We may contact you via email to invite you to review any services and/or products you received from us in order to collect your feedback and improve our services and products. To facilitate this, we use an external company, Trustpilot A/S (“Trustpilot”), to collect your feedback. We will share your name, email address and a reference number with Trustpilot for the purpose. For information about how Trustpilot processes your personal data, please see their Privacy Policy. Trustpilot will act as a processor for your data. Our lawful basis for this data processing is legitimate interest.

1.6 Marketing Communications and Your Choices

You have the opportunity to opt in to marketing communications via forms on our website. If you do this, you will be added to our database and will begin receiving emails from our system. You can opt out from these communications at any time using the unsubscribe links in the email footer.

If you provide your details via our website and don’t opt in to marketing communications[LC1] [BG2] [LC3] , depending on the download you have requested, you may receive a small number of explanatory emails to support the use of the download materials. For example, follow up emails after downloading our Workplace Wellbeing Calendar. You can opt out from these explanatory communications at any time using the unsubscribe links in the email footer.

If you are an active New Leaf Health client (i.e. you have purchased one of our services), you will automatically receive regular client-focused marketing updates from us. You can opt out from these communications at any time using the unsubscribe links in the email footer.

We may contact you as part of a third-party marketing campaign using data licensed from third-party marketing agencies under the basis of legitimate interest in our services. You can opt out from these communications at any time using the unsubscribe links in the email footer.

If you unsubscribe from marketing emails, you will still receive notification emails about access to our services (such as appointment reminders), your account and website availability as these are essential to your use of our services.

We screen out individuals, sole traders, and partnerships when exercising legitimate interest, as this purpose doesn’t apply.

1.7 Cookies and Website Tracking

Our primary website https://newleafhealth.co.uk uses cookies and tracking features for marketing purposes, which includes identifying you as a returning user by your IP address.

Non-essential and marketing cookies are not activated until you explicitly consent using the cookie banner displayed when you visit our website. If you have opted-in and wish to revoke your consent, you can do so by visiting our Cookie Policy, located in the footer of our website.

Please visit our Cookie Policy for more information.

Section 2 – For Service Users

This section is for the end-users who will interact with our services in their workplace and will likely use our online booking tool at https://booking.newleafhealth.co.uk.

2.1 What Information we Collect from You

We collect data necessary for your use of our online booking platform, including:

• Your full name
• Your email address (work or personal, whichever is provided by you)
• A password that you choose[LC4] [BG5]  (stored with encryption, accessible only to you)

This data is automatically linked to data about your company, including:

• The company name
• The location of the company or this site where you will attend our service(s)

2.2 How and Why we Use Your Data

The data collected to use the online booking platform will be used to create your account and to administrate the booking of an appointment at one of our events or services.

We will send you emails to remind you about your appointment, and also to notify you about you when your health data is ready to view (if applicable). These are not marketing emails and do not contain an unsubscribe link, as they are transactional emails that allow us to deliver our services properly.

Following your booking, we will use your email address to send you an invite to review us on Trustpilot, unless your company has opted out of this. You can ignore this email if you don’t wish to take part, and you won’t receive any further invites.

Additionally, you have the option to opt-in to receive marketing emails, which you are able to opt out of at any time using the unsubscribe link in the footer of an email, or by emailing enquiries@newleafhealth.co.uk.

2.3 Special Category (Health) Data – What we Collect and Why

If you are participating in a service that collects health data, we may collect some or all of the following data:

• Age
• Sex
• Whether you smoke or vape
• Blood pressure, plus resting heart rate
• Body fat percentage
• Muscle mass
• Visceral fat rating (the dangerous fat that surrounds internal organs)
• Body water score
• Height and BMI
• Metabolic rate (how your body uses energy)
• Metabolic age (how your metabolic rate compares to the average for your age)
• Cholesterol levels
• Blood glucose levels
• Vitamin D levels
• Blood iron levels

We store this data pseudonymised in every instance possible. This means that it is stored separately from any data that might identify you as an individual. Please see section 2.5 for information about how exactly your data is stored and protected.

2.4 Our Lawful Basis for Processing

Under the UK GDPR, our lawful basis for processing your standard personal data (such as booking details) is Consent under Article 6(1)(a).[LC6] [BG7] 

Because we also collect health metrics, which are classified as Special Category Data, we rely on Explicit Consent [LC8] [BG9] under Article 9(2)(a) of the UK GDPR to process this information.

This comes in three forms:

• When you use your own data to sign up voluntarily to our online booking system as part of an event in your workplace.
• When you give explicit consent to participate in the collection of health information at the point of testing, if you are taking part in one of these events.
• When you opt in to receive marketing emails from us.

Additionally, the email address for a review invitation that we send to Trustpilot is processed under legitimate interest for marketing purposes, as you have participated in one of our events or services.

2.5 How we Store and Protect Your Information

Your contact data is stored on our online booking platform at https://booking.newleafhealth.co.uk. We only collect relevant data, and it is stored in a separate database from your company’s data.

Your health data is collected separately from your contact information, and may be collected differently, depending on the nature of the event you attend:

• Written down on paper
• Entered into a spreadsheet on a computer
• Entered into a form linked to your booking on our online booking platform

Health data is always collected in a way that it is never stored directly against your name or information that may identify you personally.

Where the data is entered into the form linked to your booking, data is collected via Zoho Forms and is stored in an online database on their servers, which we access. This data is also stored in a unique database on our booking platform and is linked to your name via an encrypted identifier. This data is then held on your personal account, which is only accessible by you using your email address and password.

New Leaf Health staff, practitioners, and managers or colleagues at your company have no access to your personal health data.

For clarity, your personal health data is only visible to you when you log in to the online booking platform.

2.6 Who We Share Your Information With

As part of the user hierarchy on our online booking system, your contact details and appointment details (name, email address, booking time, booking location) will be visible to:

• New Leaf Health staff
• New Leaf Health practitioners
• Managers/company admins from your workplace that have been granted access by New Leaf Health for the purpose of administrating bookings.

Your personal health data will be collected by a New Leaf Health practitioner at the point of testing and will be discussed directly with you at the time. We do not retain records for any follow-up discussions, and you can opt out of data collection at the start of your testing.

The personal health data we collect is stored anonymously and aggregated in order to provide your company with an overview of health statistics in your organisation.

This data is only separated and reported by sex, and no other identifiable information.

Where we feel that aggregated data still may pose a risk of being tied to individuals (for example, where there are only a handful of people listed under one sex), we will not separate the data based on sex to ensure anonymity.

We also share your email address with Trustpilot in order to invite you to leave us a review on their platform.

2.7 How Long We Keep Your Information

Your account on our online booking platform will be kept live for a minimum period of 36 months from the date of the last event your participated in. This is to allow for consistency of data, should you take part in a future event, and allowing you to view your health data results, should this be collected.

After 36 months of inactivity on your account, or if your organisation does not book another event or service requiring use of the platform within those 36 months, your profile and data on the online booking system will be securely deleted.

If you would like to request deletion of your profile, please contact enquiries@newleafhealth.co.uk.

Closing Section (Applicable to All Users)

3.1 International Data Transfers

We store and process data on a number of different platforms that hold data in different places, sometimes outside of the UK. Where this involves providers in the European Economic Area, these transfers are covered by the UK’s data protection adequacy regulations. Where this involves providers in the United States, we ensure appropriate safeguards are in place, such as their certification under the UK extension to the EU-US Data Privacy Framework. Below is a full list of platforms:

• Zoho One (CRM and Marketing) – EU data centre.
• Microsoft SharePoint/Outlook – EU data centre, routed via US, certified under the EU-US DPF.
• Trustpilot (service reviews) – EU data centre.
• IONOS (website hosting) – EU data centre.
• Mailchimp (Email Marketing) – US data centre, certified under the EU-US DPF.
• Google Analytics – US data centre, certified under the EU-US DPF.
• Online Booking Platform – UK data centre.

3.2 Your Data Protection Rights

Under data protection law, you have rights including:

• Your right of access – You have the right to ask us for copies of your personal information.
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
• Your right to withdraw consent – You have the right to withdraw consent for the processing of your personal data at any time.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at enquiries@newleafhealth.co.uk if you wish to make a request.

3.3 Automated Decision Making

We do not make automated decisions that have legal or significantly affecting consequences for you. Any recommendations we make based on your health metrics will always be given by a human directly.

We do automatically screen out individuals on our website who enter a personal email address (using Gmail, Hotmail, Yahoo etc.), as we interpret these to be individuals and not belonging to an organisation.

3.4 How to Complain

We do not have a Data Protection Officer, as under ICO rules, the way we process data means a DPO isn’t required. We have conducted an internal DPO Necessity Assessment for this, which is available to review upon request (using the details below).

We do, however, have people responsible for updating and enforcing our Privacy Policy.

If you believe we have not handled your personal data in accordance with data protection legislation, please raise your concern with us first. We are committed to reviewing and responding to your complaint. You can make a complaint to us at:

Name: New Leaf Health Ltd

Address: Mill House, High Street, Kinver, DY7 6ER

Telephone: 01384 877 855

Email: enquiries@newleafhealth.co.uk

We will acknowledge your complaint within 30 days and provide a full response, following our investigation, without undue delay.

If you are dissatisfied with our response, you may refer your complaint to the Information Commissioner’s Office (ICO), the UK’s independent data protection supervisory authority:
Website: www.ico.org.uk 
Telephone: 0303 123 1113 
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

You may contact the ICO at any time, but we encourage you to contact us first as many concerns can be resolved quickly and informally.