top of page
4k-HD-Background-For-Desktop-25_edited_edited.jpg

Privacy Notice

Shockwave Therapy London Clinic Limited (trading as The Shockwave Therapy Clinic)

Last updated: 24 October 2026

This notice explains how we collect, use, share and protect your personal information when you visit our website, contact us, book or receive treatment. We’ve written it in plain English. If anything is unclear, please get in touch using the details below.

1. Who we are

We are Shockwave Therapy London Clinic Limited, a private limited company registered in England and Wales, company number 16867875. We trade as The Shockwave Therapy Clinic. We are the data controller for the personal information described in this notice. This means we decide how and why it is used.

  • Registered office: First Floor Copper House, 88 Snakes Lane East, Woodford Green, Essex IG8 7HX

  • Clinic (where treatment takes place): 102 Larkshall Crescent, Highams Park, London E4 6NS

  • Email: shockwavetherapyclinic@gmail.com

  • Phone: 07807 333 469 (Rich Pearson) or 07929 255 206 (Cher Pearson)

  • Directors: Rich Pearson and Cher Pearson

  • ICO registration number: ZC141493. We are registered with the Information Commissioner’s Office as a data controller.

Who to contact about data protection: Rich Pearson, Director. You can contact Rich about anything in this notice using the email address or phone numbers above.

We have not appointed a Data Protection Officer. Rich Pearson is responsible for data protection at our clinic.

2. The information we collect

Information you give us

  • Contact details: name, email address, phone number and home address.

  • Booking and enquiry details: why you are contacting us, preferred appointment times, and messages you send through our website contact form, by email, phone, WhatsApp or social media.

  • Health information: your medical history, symptoms, the condition you want help with, medications, test results or letters you share with us, questionnaires (for example the IIEF-5 questionnaire for erectile dysfunction), consultation and treatment notes, consent forms, and photographs taken for clinical purposes (for example before and after skin treatment). Our patient record and consent forms are completed online using Jotform.

  • Other personal details: date of birth, gender, GP details, emergency contact and, where relevant to your treatment, information about your sex life or sexual health.

  • Payment information: payments you make and invoices we send. Card payments are taken in the clinic on Tyl by NatWest card terminals, and payments are received into our NatWest business bank account. We do not see or store your full card number.

  • Feedback and reviews: testimonials, reviews and survey responses you choose to give us.

Health information and information about your sex life are “special category” data under UK data protection law. We treat it with extra care (see section 3).

Information we collect automatically when you use our website

  • Device and usage information: IP address, browser and device type, pages visited, how you arrived at our site, and actions such as clicking our phone, email or WhatsApp links or submitting a form.

  • Cookies and similar technologies: we only use non-essential cookies (analytics, advertising and embedded video/maps) if you agree to them through our cookie banner. See our Cookie Policy.

Please be aware that the pages you visit on a health website (for example our erectile dysfunction or pelvic pain pages) could reveal something about your health. That is one reason we only use analytics and advertising cookies with your consent. We never use the health information you give us for advertising.

Information from other people

  • Your GP, consultant or other healthcare professional if they refer you or send us information with your agreement.

  • Someone booking on your behalf, such as a family member. They should tell you they are doing this.

  • Social media and review platforms (Facebook, Instagram, TikTok, YouTube, LinkedIn and Google) when you message us or interact with our pages or reviews. We exchange messages with patients by WhatsApp, Facebook and Instagram messages, and email.

Do you have to give us your information?

You don’t have to give us information to browse our website. To book and receive treatment, we need your contact details and relevant health information. We are required to assess you safely before treatment, so if you don’t provide this information we may not be able to treat you. Giving a testimonial and accepting non-essential cookies are always optional.

3. How we use your information and our lawful bases

Data protection law requires us to have a lawful basis for each use of your information.

  • Answering your enquiry (contact form, phone, email, WhatsApp) and arranging appointments: Taking steps at your request before entering a contract (Art 6(1)(b))

  • Assessing, treating and caring for you, and keeping clinical records: Performing our contract with you (Art 6(1)(b)), and our legitimate interest in keeping accurate records for patient safety and to deal with any complaint or claim (Art 6(1)(f)). We also keep records in line with our professional responsibilities as members of the ARA, our professional body.

  • Taking payment, issuing invoices, keeping accounts: Contract (Art 6(1)(b)); legal obligation under tax and company law (Art 6(1)(c))

  • Appointment reminders and follow-up about your care: Contract (Art 6(1)(b)) and our legitimate interest in providing safe, joined-up care (Art 6(1)(f))

  • Running and securing our clinic and website, handling complaints and legal claims: Legitimate interests (Art 6(1)(f)): running a safe, secure business and protecting our legal position

  • Website analytics (Google Analytics 4): Your consent through our cookie banner (Art 6(1)(a)); you can withdraw it at any time

  • Advertising measurement (Google Ads conversion tracking): Your consent through our cookie banner (Art 6(1)(a)); you can withdraw it at any time

  • Using your testimonial, review, name, photographs or video on our website or social media: Your consent (Art 6(1)(a)), plus your explicit consent for anything that reveals your health (see below). You can withdraw it at any time

We do not send newsletters or marketing emails.

Special category (health) data

When we use your health information we also rely on these conditions in UK GDPR Article 9 and the Data Protection Act 2018:

  • Article 9(2)(h): health care. Processing that is necessary for medical diagnosis and the provision of health care or treatment, together with the condition in the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2 (health or social care purposes). Under section 11 of the Data Protection Act 2018, this must be done by or under the responsibility of a health professional, or another person who owes a duty of confidentiality under law. Everyone at our clinic who sees your health information is bound by a duty of confidentiality. Rich and Cher Pearson are both registered with the ARA, our professional body.

  • Article 9(2)(f): legal claims. Where needed to establish, exercise or defend legal claims, for example if there is a complaint or claim about your treatment.

  • Article 9(2)(a): your explicit consent. We ask for this before we use any health-related information, clinical photograph or testimonial that reveals your condition for marketing or publicity.

We do not use your health information for marketing. We do not make decisions about you using purely automated means, including profiling.

Testimonials, reviews, photographs and video

  • We will only use a testimonial, before-and-after photograph or video of you if you have given us your consent. We keep a record of that consent, for example the message in which you gave it. Giving or refusing consent does not affect your care.

  • We only use your testimonial, photographs or video in the way you agreed to, for example first name only, initials or anonymously, and on the places you agreed to (such as our website, Google, Facebook, Instagram, TikTok or YouTube).

  • We will not show your face or anything that identifies you unless you specifically agree.

  • You can withdraw consent at any time. We will then remove the content from our website and our own social media accounts within 14 days of your request. Please be aware that we can’t recall copies that other people have already shared or saved.

  • Reviews you post yourself on Google or other platforms are controlled by those platforms. You can edit or delete them there.

4. How we keep your information safe

  • Clinical records are kept confidential and are only accessed by the practitioners treating you and staff who need them.

  • Our records are kept digitally. We do not keep paper patient records. Patient record and consent forms are completed online through Jotform and are held in password-protected accounts that only authorised clinic staff can access.

  • Please don’t send detailed medical information through our website contact form or social media messages. Please share it at your consultation, or by a method we agree with you.

  • WhatsApp messages are end-to-end encrypted in transit, but they are stored on our devices and backed up. We use WhatsApp on passcode-protected Android phones, and our chats are backed up to Google Drive. If you prefer, we can talk by phone instead.

5. Who we share your information with

We never sell your personal information. We only share it where needed.

Service providers and other organisations we use:

Some of these organisations process information on our behalf (as “processors”). Others, such as Meta, NatWest and our professional advisers, may also use information as separate controllers under their own privacy notices.

  • Wix.com (Wix.com Ltd, Israel, and its group companies). Hosts our website and website contact form. We do not use Wix to send patient invoices or to hold patient records.

  • Google (Google Ireland Ltd / Google LLC):

    • Email: our clinic email account (shockwavetherapyclinic@gmail.com) is provided by Google’s Gmail service.

    • Google Drive: backups of our WhatsApp chats.

    • Google Analytics 4: website statistics, only if you accept analytics cookies.

    • Google Ads: measuring whether our adverts lead to enquiries, only if you accept advertising cookies. If you submit an enquiry form and have accepted advertising cookies, a scrambled (hashed) version of the contact details you enter, such as your email address or phone number, may be shared with Google Ads to measure this (“enhanced conversions”). Google receives only the hashed version, not the readable details.

  • Meta Platforms (WhatsApp, Facebook and Instagram): if you message us on WhatsApp, Facebook or Instagram. We use the WhatsApp Business app. Meta processes these messages under its own terms and privacy policy.

  • Metricool: used to schedule and analyse our social media posts. It does not receive patient records. If you comment on or message our social media accounts, your public username and message may be visible in Metricool.

  • Jotform (Jotform Inc.): our online patient record, health questionnaire and consent forms.

  • Tyl by NatWest and NatWest business banking (NatWest Group): Tyl provides our card terminals and processes card payments, and NatWest provides our business bank account. They handle payment information as regulated financial service providers under their own privacy notices.

  • Our accountant and professional advisers: our accountant, Ruddocks & Co of Woodford, for accounts and tax, and other professional advisers, such as solicitors, where needed.

We do not use a separate online booking system.

Providers that process information on our behalf may only use it to provide their services to us, under the terms of their contracts with us.

Organisations that act as separate controllers: if you watch an embedded YouTube video or use the Google Map on our website, Google collects information under its own privacy policy. We load these only after you agree to the relevant cookies.

Other healthcare professionals: your GP or another clinician where you ask us to, where it’s needed for your care and you agree, or where there is a serious risk to you or others.

Legal and regulatory bodies: where the law requires us to, for example a court, the police, HMRC, or a professional or regulatory body, or to protect someone’s vital interests.

Insurers: our own professional indemnity insurer if there is a claim. We don't deal with health insurers directly.

If our business is sold or restructured, the buyer would receive records so your care can continue, under the same protections.

6. International transfers

Some of our service providers, including Wix, Google, Meta, Jotform and Metricool, may store or access personal information outside the UK, for example in the USA or the European Economic Area (EEA).

Where our providers process data outside the UK, we rely on appropriate safeguards, such as UK adequacy regulations (which cover the EEA and some other countries), the UK-US Data Bridge for certified US companies, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

You can ask us for more details about these safeguards.

7. How long we keep your information

We only keep information for as long as we need it:

  • Adult clinical records (consultation notes, treatment records, consent forms, clinical photographs): 8 years after your last treatment

  • Records relating to anyone under 18: We do not treat anyone under 18. If we ever hold clinical records relating to someone who was under 18 at the time, we keep them until their 25th birthday (or 26th if they were 17 at the end of treatment), or 8 years after the last treatment, whichever is longer

  • Enquiries that don’t lead to an appointment: 12 months from the last contact

  • Payment and accounting records: 6 years from the end of the financial year they relate to (HMRC and company law)

  • Testimonials and marketing photographs/video: Until you withdraw consent

  • Records of testimonial and photo consent: For as long as the content is published, plus 6 years

  • Website analytics data (Google Analytics): 14 months

  • WhatsApp and social media messages: 12 months, then deleted from our devices and accounts. Anything clinically relevant is copied into your clinical record first

  • Cookies: See our Cookie Policy

When information is no longer needed, we securely delete it.

8. Your rights

You have the right to:

  • Be informed about how we use your information (this notice).

  • Access the information we hold about you (a “subject access request”). This is usually free and we will respond within one month.

  • Correct information that is wrong or incomplete.

  • Erase your information. We may need to keep clinical and financial records for the periods above, for legal and safety reasons.

  • Restrict how we use your information in certain circumstances.

  • Object to us using your information based on our legitimate interests, and to direct marketing at any time.

  • Data portability: receive information you gave us in a commonly used format, where we rely on consent or contract.

  • Withdraw consent at any time, for example to cookies, marketing or testimonials. This doesn’t affect anything we did before you withdrew it.

  • Not be subject to decisions based solely on automated processing. We don’t make any.

To use any of these rights, email shockwavetherapyclinic@gmail.com, call us, or speak to us at the clinic. We may need to check your identity before releasing information.

9. Complaints

If you’re unhappy with how we have handled your information, please contact us first so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:

  • Website: ico.org.uk/make-a-complaint

  • Phone: 0303 123 1113

  • Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

10. Cookies

Our website uses essential cookies to work properly. We only set analytics cookies (Google Analytics), advertising cookies (Google Ads) and embedded content cookies (YouTube and Google Maps) if you click Accept All or switch them on in the banner settings and click Save Settings. If you click Deny, they are not set. You can change your choice at any time using the small privacy (fingerprint) icon at the bottom left of every page. Full details are in our Cookie Policy.

11. Children

Our website and services are not aimed at children. The minimum age for treatment is 18, so we do not treat anyone under 18. If we find that we hold information about someone under 18 by mistake (for example an enquiry), we will delete it unless we need to keep it for a legal reason.

12. Links to other websites

Our site links to other websites and social media platforms (for example Google, Facebook, Instagram, TikTok, YouTube, LinkedIn and WhatsApp). They have their own privacy policies, and we are not responsible for how they use your information.

13. Changes to this notice

We review this notice regularly and will update it if the way we use your information changes. The date at the top shows when it was last updated. If we make important changes, we will let our patients know.

bottom of page