WellDrop Privacy Policy

1. Introduction

WellDrop Ltd ("WellDrop", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what information we collect, why we collect it, how we use it, and your rights under UK data protection law, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

WellDrop Ltd is the data controller for personal data processed through the Platform and website.

We are registered with the Information Commissioner's Office (ICO). Registration number: ZC127005.

If you have any questions about this policy, contact us at privacy@welldrop.co.uk.

2. Who This Policy Applies To

• Customers: people who use the WellDrop app to browse and book beauty and wellness treatments.

• Practitioners: practitioners and trainees who list treatments and receive bookings through WellDrop.

• Website visitors: anyone who visits welldrop.co.uk, including people who join our waiting list.

3. What Data We Collect

3.1 Waiting List and Website Visitors

If you join our waiting list, we collect your email address, your name (if you give it), the date and time you signed up, and whether you ticked the marketing box.

If you join as a practitioner, we also collect the treatments you offer, your training or qualification status, and your Instagram handle (if you give it). We use these to manage the waiting list and to contact you about joining WellDrop, on the basis of our legitimate interests.

3.2 Customers

When you create an account, we collect:

• your name, email address and phone number (if given);

• your password, stored in encrypted form so that we never see it in plain text;

• your profile photo (optional) and the treatment categories you choose.

When you make a booking, we collect:

• booking details (treatment, date, time and Practitioner);

• payment information, which is processed by Stripe (we do not store your full card number);

• your transaction, cancellation and refund history, and any unpaid amounts.

When you use the app, we collect:

• location data, only when you use the map or distance features and only if you allow it on your device;

• your device type, operating system and app version;

• usage data, such as screens visited and treatments saved or booked.

3.3 Health Information

If a treatment needs a health or consultation form, we collect the health information you provide, such as medical conditions, allergies, medication, pregnancy and skin conditions, and any photos you upload with the form. Photos are only used with your separate photo consent. Health information is "special category data". We process it on the basis of your explicit consent, which you give when you complete the form (UK GDPR Article 9(2)(a)). You can withdraw that consent, but if you do, the Practitioner may not be able to carry out the treatment.

Only you and the Practitioner treating you can see your form. Authorised WellDrop staff can see it only where needed for support, disputes or legal reasons, and that access is logged. WellDrop does not review health forms or give medical advice. We keep health forms for 1 year after your last treatment and then delete them securely, unless the law requires us to keep them longer.

3.4 Practitioners

When you create a Practitioner account, we collect:

• your name, trading name, email address, phone number, business address and treatment location;

• your treatment categories and description, and whether you are a trainee;

• evidence of your insurance and any registration or licence;

• your identity and bank details, which are collected and held by Stripe Connect (we do not store your bank details);

• your listings, bookings and payout records.

3.5 Disputes and Messages

If you report an issue, raise a dispute or contact us, we collect your messages, any photos you send, and the details of the dispute and its outcome.

Reports and blocks. If you report content or block another user, we keep a record of it: who made it, who and what it concerns, the reason, any details you add, and when it was made. We use this to protect people using WellDrop, review reports and enforce our terms, based on our legitimate interests. We never tell the reported user who reported them. We delete reports 2 years after we close them, and keep blocks until you remove them or either account is deleted.

4. How We Use Your Data and Our Legal Basis

Purpose: Running the Platform, taking bookings and managing your account
Legal basis: Performance of a contract

Purpose: Taking the Booking Fee, Deposit and Balance, issuing refunds and paying Practitioners
Legal basis: Performance of a contract

Purpose: Sending booking confirmations, payment reminders and service messages
Legal basis: Performance of a contract

Purpose: Chasing unpaid amounts (email and in-app notices on day 1, day 3 and day 7) and blocking new bookings while an amount stays unpaid after 7 days
Legal basis: Legitimate interests (making sure Practitioners are paid and preventing repeated non-payment)

Purpose: Handling disputes, complaints and chargebacks
Legal basis: Legitimate interests and, for any health form used, establishing, exercising or defending legal claims (UK GDPR Article 9(2)(f))

Purpose: Processing health forms
Legal basis: Explicit consent (Article 9(2)(a))

Purpose: Recording Practitioners' self-certification of insurance, training and licences, and asking for evidence after a complaint
Legal basis: Legitimate interests (running a lawful marketplace and protecting Users)

Purpose: Sending marketing emails
Legal basis: Your consent, given by ticking the opt-in box. Customers who have booked may also get emails about similar WellDrop services, if they did not opt out when booking (the "soft opt-in").

Purpose: Showing treatments near you and relevant to your preferences
Legal basis: Legitimate interests

Purpose: Sharing a home-based Practitioner's address with a booked Customer
Legal basis: Contract (to let the Booking go ahead) and the Practitioner's approval for that Booking

Purpose: Analytics and improving the Platform
Legal basis: Your consent (see section 10)

Purpose: Fraud prevention, accounting and responding to lawful requests
Legal basis: Legal obligation and legitimate interests

Every marketing email includes an unsubscribe link. Under PECR, we treat sole traders and partnerships in the same way as individuals.

5. Location Data

We only access your location when you use location-based features such as the map or the distance filter. You control location access in your device settings and can change it at any time. We do not track your location in the background.

6. How We Share Your Data

With Practitioners. When you book, we share your name, booking details and (where the treatment needs it) your health form with your Practitioner. They need this to provide your treatment safely. We do not share your payment details with Practitioners.

With Customers. We show Customers a Practitioner's trading name, listings, trainee status and ratings. For salons, studios and training centres, we show the full address. For home-based Practitioners, we show only the area (such as the postcode district) until the Practitioner approves sharing their full address for a specific Booking. We then share it only with that Customer. We use the full address to calculate approximate distance, but we never show it in search results or on maps.

With Stripe. Stripe processes payments and Practitioner payouts. See stripe.com/gb/privacy.

For disputes and chargebacks. If you raise an issue or a chargeback, we may share your booking and payment records, timestamps, messages and, where relevant to the dispute, your health form with the Practitioner, Stripe and your card issuer to resolve it.

With service providers. We use the providers listed in section 7. They process data only on our instructions and under a written contract.

With law enforcement or regulators, where the law requires it or to protect the safety of our Users or others.

In a business transfer. If WellDrop is sold or merged, your data may transfer to the new owner, and we will tell you before this happens.

We do not sell your personal data, and we do not share it with advertisers.

7. Our Service Providers and International Transfers

Provider: Supabase
What they do: Database
Data involved: All account, booking, practitioner and health-form data, including photos
Where the data is processed: EU – Ireland (AWS eu-west-1)
Safeguard for transfers outside the UK: UK adequacy regulations for the EEA

Provider: Emergent
What they do: Hosts the app's backend, which has full read access to the database. Health forms pass through it but are stored only in our database
Data involved: All data held in the database, including health forms
Where the data is processed: App hosted in the US. Emergent and its subprocessors also process data in the EU and India
Safeguard for transfers outside the UK: The UK Addendum to the EU Standard Contractual Clauses (Emergent's DPA)

Provider: Stripe
What they do: Payments, refunds and practitioner payouts (Stripe Connect). Stripe does not receive health data
Data involved: Name, email, card and payment details, payout and identity data
Where the data is processed: UK, EEA and US (Stripe, LLC)
Safeguard for transfers outside the UK: The UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU Standard Contractual Clauses as fallback (Stripe's DPA and Data Transfers Addendum)

Provider: Resend
What they do: Transactional email (booking confirmations, reminders and payment links). Emails do not include health information
Data involved: Name, email address, email content
Where the data is processed: Sending: EU (Ireland). Account data, metadata and logs: US
Safeguard for transfers outside the UK: UK adequacy regulations for the EU; for the US, the UK Addendum to the EU Standard Contractual Clauses (Resend's DPA), with the UK Extension to the EU-US Data Privacy Framework as an extra safeguard

Provider: Hostinger
What they do: Business email (info@, privacy@ and angharad@)
Data involved: Emails you send us and our replies
Where the data is processed: Europe or North America
Safeguard for transfers outside the UK: UK adequacy regulations for the EEA; for other countries, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (Hostinger's DPA)

Provider: Wix
What they do: Hosts our website and its forms (such as the waiting list)
Data involved: Details you enter in website forms, and website usage data
Where the data is processed: Israel, with some processing by Wix's suppliers in other countries
Safeguard for transfers outside the UK: UK adequacy regulations for Israel; for other countries, the EU Standard Contractual Clauses or another approved safeguard (Wix's DPA)

Provider: Cloudflare
What they do: Runs our domain's DNS and sits in front of our website to deliver it and protect it from attacks
Data involved: Visitors' IP addresses and website request data. Email does not pass through Cloudflare
Where the data is processed: Global network, including the US
Safeguard for transfers outside the UK: The EU-US Data Privacy Framework and its UK Extension, as set out in Cloudflare's DPA

We do not allow providers to use your data for their own purposes. Health forms are held only in our database and are not included in emails.

You can ask us for more information about these safeguards, or a copy of them, by emailing privacy@welldrop.co.uk.

8. Data Retention

Data: Waiting list details
How long we keep it: Until you unsubscribe, or until you create an account at launch

Data: Customer and practitioner account data
How long we keep it: While your account is open, plus 2 years after you close it

Data: Health forms
How long we keep it: 1 year after your last treatment

Data: Home-based Practitioner's address shared for a Booking
How long we keep it: Hidden from the Customer's app 7 days after the appointment. The booking record is kept under the rules above

Data: Booking, payment and payout records
How long we keep it: 7 years, for financial and legal compliance

Data: Records of unpaid amounts and booking blocks
How long we keep it: Until the amount is paid or written off. The booking and payment record itself is then kept for 7 years

Data: Dispute and chargeback records
How long we keep it: 2 years after the dispute is closed

Data: Marketing preferences
How long we keep it: Until you opt out or ask us to delete them

Data: Support messages
How long we keep it: 3 years

Data: Reports and blocks
How long we keep it: Reports: 2 years after closing. Blocks: until removed or either account is deleted

When we no longer need data, we delete it securely or anonymise it.

9. Data Security

We use measures including:

• encryption in transit (TLS);

• encrypted password storage;

• role-based access controls, including restricting health forms to you and your Practitioner, with logged staff access only where needed for support, disputes or legal reasons;

• regular security reviews.

If a data breach is likely to put your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay where required.

10. Cookies and Similar Technologies

The website uses essential cookies so that it works. We use analytics cookies and similar technologies on the website and in the app only with your consent. You can accept or reject non-essential cookies, and change your choice at any time. We do not use advertising cookies.

11. Your Rights

Under UK data protection law, you have the right to:

• access your personal data;

• have inaccurate data corrected;

• have your data erased;

• restrict how we use your data;

• data portability;

• object to processing based on legitimate interests, and to direct marketing at any time;

• withdraw consent at any time (this does not affect processing that took place before).

To use any of these rights, email privacy@welldrop.co.uk. We will reply within one month. We may need to verify your identity, and there is no charge.

12. Children

WellDrop is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you think we have, contact privacy@welldrop.co.uk and we will delete it.

13. Changes to This Policy

We will tell you about material changes by email or in-app notice. The date at the top shows when this policy was last updated.

14. Complaints

If you are unhappy with how we have handled your data, please contact us first at privacy@welldrop.co.uk. You also have the right to complain to the ICO:

Information Commissioner's Office
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Contact

WellDrop Ltd
Company Number: 17165925
Registered Office: 5 Brayford Square, London, England, E1 0SG
Email: privacy@welldrop.co.uk
Website: welldrop.co.uk