Website privacy notice

Who is responsible and how to contact us

OM CLINIC LTD T/A Willoway Medical Clinic is the controller for the website enquiry, account, learning and membership information described here. Company registration number: 15461646. ICO registration reference: ZB831968.

For a privacy question, request or complaint, write to Willoway Medical Clinic, Willow Lodge, Newall Road, Bowerhill, Melksham, Wiltshire, SN12 6XH, or text/WhatsApp 07519 461700 (text / whatsapp only — no calls) asking for the appropriate privacy contact. Do not send identity documents, medical records or other sensitive evidence through a general message; we can arrange a suitable way to verify a request.

An ICO registration reference does not certify this website or its security. The clinic postal address above is a contact address; it is not presented as a verified registered-office address.

Website enquiries and V300 requests

The enquiry form saves your name, email, chosen service area, message and the time you acknowledge the privacy information and request a reply. V300 requests also include your profession, university, intended intake date, required supervised hours and supplied university requirements. Professional expressions of interest can include profession, regulator, area, practice setting and brief experience.

The details are saved for authorised Willoway administrators to review and respond; submitting the form does not itself send an automated email, confirm an appointment or enrol you. Fields marked required are needed to process that request. You can instead ask an initial, non-sensitive question using our text/postal contact details.

Please keep symptoms, diagnoses, medication details, test results, photographs, patient identifiers and confidential documents out of this form. A service interest may still be sensitive. We do not use enquiry topics to infer your health, assess treatment eligibility or target marketing. If a request needs clinical information, arrange an appropriate clinical channel and the applicable care privacy information with Willoway first.

Individual accounts and student learning

Sign-in supplies an account identifier, available name/email and login-provider information. Account creation/update and last sign-in times are recorded. Course administration saves individual access permissions, enrolment dates, completed lessons and relevant payment-provider references. Access may be granted by an authorised owner or verified test-checkout event, not by merely creating a login.

RADIESSE training additionally records your declared professional name, email, regulator, registration number and declaration timestamp, together with assessment answers, attempts, scores and theory progress. These declarations are not automatic professional-register verification. The course does not submit those records to a separate Google Form. Do not enter patient details in training records.

Network registration and Partner Hub records

Willoway Medical Network registration records account/email, professional name, profession, regulator, declared registration number, area, setting and the relevant acknowledgement/terms version. Membership administration can hold approval/suspension status and payment-provider identifiers. Registration and payment do not themselves authorise clinical practice or grant NEXUS access.

The Partner Hub stores governance-document metadata/versions, reading acknowledgements, training rows and access-audit metadata. Routine personal contracts/HR resources are limited to their named partner and authorised owner; shared resources require individual approval. Administrators upload/publish documents; partners view them read-only and cannot upload or download through the portal. Viewing controls cannot prevent every screenshot or determined extraction.

This Hub is not a patient-record, identity/DBS, occupational-health, bank or payroll system. Do not upload those records. Any future use for more sensitive personnel information requires a separate review and appropriate notice.

Why information is used and the proposed lawful bases

The following website-specific bases are proposed for clinic confirmation; they are not a substitute for the clinic documenting its actual processing and any necessary legitimate-interests assessment.

• General non-sensitive enquiries: legitimate interests in answering questions you initiate and administering the clinic. Where you ask us to take steps towards your own service contract, those necessary steps can instead rely on the contract basis.
• Providing an agreed learning/service account and its necessary learning or membership administration: performance of the agreement with you, or requested steps before it. Where the agreement is with your business rather than you personally, account/contact administration is based on legitimate interests in delivering that relationship, not an assumed personal contract.
• Account access controls, proportionate security checks, abuse prevention, governance-resource acknowledgements and administrative audit records: legitimate interests in keeping the service secure and managing authorised access. Any specific legally required record must rely on the applicable legal obligation, not a blanket claim that all records are legally required.
• Optional marketing, if introduced: a separate lawful channel-specific permission and delivery process. The current site has no live patient-marketing sender. An enquiry acknowledgement, booking, course payment or clinical consent is not marketing permission.

Recipients, external services and technical information

Authorised Willoway staff can access the records necessary for their role. The Manus website platform and its hosting, delivery, database, storage and authentication providers process information needed to run the website. Infrastructure receives technical information such as IP address, browser/request details and access/security logs. Provider log retention and processor arrangements require clinic confirmation; we do not promise that every platform log is anonymous.

Stripe hosts the website’s test checkout and receives the information needed for that process. Willoway’s application stores relevant customer/checkout/payment identifiers and access state, not card numbers, security codes or card expiry dates. Do not enter real card details into test checkout.

ANS appointment booking opens a separate website. Booking and clinical information are handled under the applicable clinic/ANS arrangements and care notice, rather than imported into this website. AlumierMD shopping opens its UK store with Willoway’s clinic code; its customer accounts, checkout, delivery, returns and privacy information apply separately. The Willoway site does not receive skincare order or card details through that link.

The website currently requests its typeface from Google Fonts and serves assets through hosting/CDN services; those providers receive the technical data needed to deliver them. Maps, social links and text/WhatsApp are external services opened only when you choose the relevant link. Their own privacy information also applies. Information may be disclosed to professional advisers or authorities where necessary and lawful, rather than shared for unrelated advertising.

Hosting locations and international transfers — confirmation outstanding

UK-only hosting has not been confirmed. Provider/subprocessor locations, applicable transfer mechanisms and access to the relevant safeguards remain operational review items for Willoway. This page does not claim that a UK adequacy decision, standard contractual clauses or another safeguard has already been verified for this deployment.

Ask Willoway for the confirmed hosting/recipient and transfer information before submitting sensitive information or arranging an expanded use of the portal. Provider contracts and this section must be completed before the clinic represents this notice as a complete operational notice; clinical records remain disabled in NEXUS.

How long information is kept

The proposed retention criteria are the time needed to answer and close an enquiry; the duration of an agreed account, learning or membership relationship; any specific legal, professional or accounting obligation that actually applies; and a proportionate period needed to resolve a complaint or legal claim. Different categories need different decisions. Unnecessary information should be deleted or anonymised rather than kept indefinitely for possible future marketing.

A fixed clinic-approved schedule and provider backup/log retention arrangements have not yet been supplied. This website does not run an automatic enquiry/account deletion schedule, and it does not promise deletion after an invented number of days. The clinic must implement and maintain its operational review/deletion process; contact Willoway for the applicable period or to make a rights request.

Cookies and browser storage

The application uses webdev_app_session to keep you signed in. It is a secure, HTTP-only cookie with an expiry of up to 365 days; signing out clears the application cookie. A __Host-oauth_state security cookie binds a sign-in request to your browser and lasts up to 10 minutes or is cleared on callback. These support requested login/security functions, not advertising.

Embedded login may also use a platform-supplied token in session storage under manus-cookie, and the selected return workspace is temporarily stored as willoway-login-return. Logging out clears the mirrored token. Interface preferences may be remembered locally where the relevant control is used; the application no longer writes a persistent copy of your account profile to local storage and clears its former manus-runtime-user-info cache when loaded.

Willoway’s application code does not install an advertising pixel or a non-essential analytics tracker. Hosting/authentication/external services may have their own storage or processing; this is not a guarantee that every third-party mechanism is cookie-free. Any future non-essential tracking needs its own accurate disclosure and applicable permission/objection controls before activation. Browser settings can clear or block storage, but blocking necessary login storage can prevent sign-in.

Private wellbeing tools and NEXUS demonstrations

BMI measurements, adult ADHD screening answers/results and dinner-planner choices stay in the open browser page and are not submitted to Willoway or linked to a student account. Refreshing/leaving the relevant page clears that page’s state. The adult screener is not a diagnosis or referral.

Willoway NEXUS Clinical treatment maps, fictional patients/appointments/notes, financial examples and marketing previews use synthetic page-memory data only. No real patient import, clinical-record submission, real financial-data import or outbound marketing is enabled. Signed-in clinic role assignments and any access-audit metadata are separate account administration, not a grant of patient access by opening a demo.

Private adult ADHD pre-screening

Your answers and result stay in this page’s temporary browser memory. They are not saved, sent to Willoway, added to your enquiry or used to create a clinical record. Reset or reload this page to clear them. Do not send answers or health details through the general enquiry form, text or WhatsApp.

Application support enquiries

Use the general enquiry form for availability, format and fees only. Do not send children’s names, diagnoses, screening answers, medical or school reports, National Insurance/NHS numbers, benefit letters or other sensitive documents. If we agree to work together, confidential evidence-sharing arrangements will be discussed separately.

An enquiry about DLA, PIP or EHCP support does not submit an official application. Keep child names, reports and other sensitive material out of the general website form.

Your information rights

Depending on the circumstances and lawful basis, you can request access, correction, erasure, restriction and portability of your personal information. Where consent is genuinely relied on, you can withdraw it without affecting the lawfulness of earlier use. Some information may need to be retained for a valid obligation or claim; we will explain a relevant limitation rather than promise that every record can always be deleted.

Contact Willoway using the postal or text/WhatsApp details above. We may need proportionate identity verification and will explain a suitable channel. Requests must be handled without undue delay and within the applicable statutory time limit; you do not need to buy a service or use a student account to raise a privacy concern.

Your right to object

You can object to processing based on legitimate interests on grounds relating to your particular situation. You can object to direct marketing at any time; that objection is not subject to a balancing test. Website enquiries are not added to a live patient-marketing list. Ask Willoway to stop the relevant contact or explain any continuing lawful use.

Complaints and automated decisions

You can raise a concern with Willoway and also complain directly to the Information Commissioner’s Office (ICO), the UK data-protection regulator. You do not have to complete a clinic complaint before approaching the ICO.

The website does not make automated clinical eligibility decisions or profile visitors by health. Learning quizzes and payment/entitlement checks automate routine scoring/access state, not a clinical competence, professional-registration or patient-treatment decision. Contact Willoway if an account/access result needs review.

Message Willoway

07519 461700 · Text / WhatsApp only — no calls

Find Willoway