MENU

Order Certificate

Legal Information

How we handle your information, what cookies we use, and the terms that apply when you order from us.

Privacy Notice — last updated 30 August 2026

Who we are

The Healthify is a trading name of Golden Acorn Ltd, a company registered in England and Wales under company number 12030489, with its registered office at 20–22 Wenlock Road, London N1 7GU.

We issue Medical Certificates of Good Health for long-stay visa and relocation applications. Golden Acorn Ltd is the data controller for the information described in this notice.

We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER].

Contacting us about your data

Email admin@thehealthify.co.uk or call +44 (0) 7597 630941, Monday to Saturday, 7am to 7pm. You can also write to us at the registered office above.

The information we collect

We only collect what we need to arrange your consultation, issue your certificate and meet our professional and legal obligations.

Information you give us

  • Your name, date of birth, address, email address and telephone number
  • Your passport or identity document details, where we need to verify who you are
  • Your destination country and the type of visa or permit you are applying for
  • The delivery address for your certificate

Health information

  • Your medical history and current health, as discussed during your consultation
  • Details of any medication, treatment or diagnoses relevant to the certificate
  • Test results or supporting evidence you send us, where your destination requires them
  • The clinical notes our GP makes during and after your consultation
  • The certificate itself and any related correspondence

Health information is special category data under the UK GDPR. We treat it with the same confidentiality as any other medical record.

Information collected automatically

  • Your IP address, browser type and device information
  • Pages you visit on our website and how you arrived there
  • Information collected through cookies, where you have consented. The Cookies tab above explains this in full.

Payment information

Payments are processed by Stripe. Your card details are entered directly with Stripe and are never seen or stored by us. We receive only confirmation that a payment succeeded, along with the amount and a transaction reference.

Why we use it, and our lawful basis

What we use it forLawful basis
Arranging and carrying out your GP consultation, and issuing your certificate Performance of a contract with you (Article 6(1)(b)). For health information, the provision of health care and treatment (Article 9(2)(h))
Verifying your identity Legal obligation and our legitimate interest in preventing fraud (Article 6(1)(c) and 6(1)(f))
Taking payment and issuing receipts Performance of a contract and legal obligation (Article 6(1)(b) and 6(1)(c))
Keeping clinical records Legal obligation and professional duty (Article 6(1)(c)). For health information, the management of health care services (Article 9(2)(h))
Responding to your enquiries Our legitimate interest in answering people who contact us (Article 6(1)(f))
Understanding how our website is used Your consent (Article 6(1)(a))
Sending marketing emails, if you have asked for them Your consent (Article 6(1)(a))

We do not sell your data. We do not share your medical information with advertisers, data brokers or any third party for marketing purposes, and we never will.

Who we share it with

We share your information only where it is necessary to deliver the service you have asked for, or where the law requires it.

  • The GP who carries out your consultation. Our doctors are registered with the General Medical Council and are bound by the same duty of confidentiality as any NHS or private practitioner.
  • Stripe, our payment processor, for the purpose of taking payment.
  • Royal Mail, to deliver your certificate. They receive your name and delivery address only.
  • The Apostille Service, if you ask us to arrange apostille legalisation or sworn translation. They receive only the documents and details needed for that service.
  • Our IT and hosting providers, who may have incidental access while maintaining our systems. They act on our instructions and are bound by written confidentiality terms.
  • Regulators, courts or law enforcement, where we are legally required to disclose information.

We will not disclose your medical information to an embassy, consulate, employer or family member without your explicit consent, other than through the certificate you have asked us to produce.

Transfers outside the UK

Some of our service providers process data outside the UK. Where that happens, we rely on adequacy regulations or on standard contractual clauses approved for use in the UK, so that your information keeps the same protection it has here.

How long we keep it

We keep clinical records, including your consultation notes and certificate, for 10 years from the date of our last contact with you. This reflects accepted practice for private medical records in the UK and allows us to respond to any later query, complaint or claim.

Financial records are kept for six years, as required by HMRC. Enquiries that do not lead to an order are deleted within 12 months. Marketing consents are kept until you withdraw them.

Keeping it secure

We take appropriate technical and organisational measures to protect your information against loss, misuse and unauthorised access. These include encrypting data in transit and at rest, restricting access to those who need it for their work, requiring multi-factor authentication on accounts that hold personal data, maintaining backups, and keeping written confidentiality agreements with everyone who handles your information.

We review these measures regularly. If a breach occurs that is likely to risk your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and tell you directly where required.

Your rights

Under the UK GDPR you have the right to:

  • Access the personal data we hold about you, and receive a copy
  • Rectification of anything inaccurate or incomplete
  • Erasure in certain circumstances, though we may need to keep clinical records for the retention period above
  • Restriction of how we use your data while a query is resolved
  • Portability, receiving your data in a structured, commonly used format
  • Object to processing based on our legitimate interests
  • Withdraw consent at any time, where consent is the basis we rely on

To exercise any of these, email admin@thehealthify.co.uk. We will respond within one month. There is no charge, and we may ask you to confirm your identity first.

Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Complaints about clinical care are covered under the Terms & Conditions tab.

Children

Our service is intended for adults. Where we issue a certificate for someone under 18, we do so only with the consent and involvement of a parent or legal guardian, who must be present for the consultation.

Changes to this notice

We update this notice as our service changes or the law develops. The date at the top shows when it was last revised. Where a change materially affects how we use your information, we will tell you directly.

Order Certificate
Order Certificate