Last Updated: 28 July 2026
The Body Composition Clinic (“BCC”, “we”, “us”, “our”) is a remote, clinician-led medical weight management service operating in the United Kingdom.
The Body Composition Clinic is a trading name of Pharmelle Ltd company no. 17205229, registered office 75 Harley Street, Suite 16, London W1G 8QL.
Clinical care is delivered by a pharmacist independent prescriber working under practicing privileges granted by Renovar Ventures Limited company no. 13434565, registered office 75 Harley Street, Suite 16, London W1G 8QL, which is the registered service provider.
Data controllers. Because of this arrangement, more than one organisation is responsible for your personal data:
Renovar Ventures Limited and Pharmelle Ltd have an arrangement in place setting out their respective responsibilities under Article 26 of the UK GDPR. You may contact either organisation using the details in section 3, and you can exercise your rights against either of us.
Both organisations are registered with the Information Commissioner’s Office (ICO):
This policy explains what personal data we collect about you, how and why we use it, who we share it with, how long we keep it, and the rights you have under the UK GDPR and the Data Protection Act 2018. It applies to patients, prospective patients and visitors to our website at https://bodycompositionclinic.co.uk.
Because we are a medical service, much of the information we hold about you is special category data (data concerning health). We apply extra protections to this data, explained in section 5.
For any question about this policy or your personal data, or to exercise your rights:
We aim to respond to all enquiries within two working days, and to formal rights requests within one month (see section 9).
We are not required to appoint a Data Protection Officer.
Depending on your relationship with us, we may collect:
Identity and contact data — your name, date of birth, postal address, email address and telephone number.
Health and clinical data (special category data) — information you give us and that we generate in the course of your care, including your medical history, current medications, weight and body composition measurements, symptoms and lifestyle information, the outcomes of your consultations, prescriptions issued to you, clinical monitoring notes, and blood-test results.
Intake media — photographs or other media you submit as part of your clinical assessment, where these are needed to support safe prescribing.
Booking and appointment data — the appointments you book, your consultation type, and related scheduling information.
Payment data — payments you make for our services. Card payments are processed securely by Stripe through our booking system; we do not see or store your full card details.
Correspondence — the content of emails, forms and messages you send us.
Website and technical data — limited technical information collected when you use our website, such as your IP address, device and browser type, and information collected through cookies. See our separate Cookies Policy for detail.
Under the UK GDPR we must have a lawful basis for using your personal data. Because health data is special category data, we also rely on an additional condition under Article 9. Our bases are set out below.
To provide your care — assessing your suitability, delivering consultations, prescribing, arranging dispensing and blood tests, and monitoring your treatment.
To meet our legal and professional obligations — including record-keeping, pharmacy and prescribing standards, and safety reporting.
To take payment for our services.
To respond to your enquiries and manage our relationship with you.
To run and secure our website.
Where we ever rely on your consent (for example, for any optional processing), you can withdraw it at any time without affecting care you are entitled to receive.
We do not sell your personal data. We share it only where necessary to deliver your care and run our service, with the following parties:
Cliniko (provided by Red Guava Pty Ltd) — our booking and practice management system, which holds your patient record. Data for UK accounts is stored in the United Kingdom. Acts as our processor under a data processing agreement.
Stripe — processes card payments made through our booking system. Stripe acts as an independent controller for payment processing and fraud prevention, in line with its own privacy policy.
Microsoft (Microsoft 365 and SharePoint) — our email and secure document storage, including storage of clinical intake media. Acts as our processor, with UK/EU data residency.
Cognito Forms — the secure form service we use to collect clinical intake media (because our practice management system does not support media capture). Hosted on Microsoft Azure and certified under the UK Extension to the EU–US Data Privacy Framework. Acts as our processor.
DOSE GB (the pharmacy division of Burlington Pharma Ltd) — the GPhC-registered pharmacy that dispenses your medication. We send the prescription together with your name, address, date of birth, email and telephone number. DOSE GB acts as a separate controller for the dispensing and supply of your medicine.
Randox — the UKAS-accredited laboratory that processes your blood tests. We share the identifiers needed to arrange and match your test (name, address, date of birth, email and telephone number). Randox acts as controller/processor for the pathology service it provides.
Website host (123-reg) — hosts our website on UK-based data centres. Acts as our processor.
We may also share your data where we are legally required to do so (for example, with regulators, or to comply with a court order), or where necessary to protect someone’s vital interests in an emergency.
Most of your data is stored in the UK or EU. Where a provider processes data outside the UK (for example, group companies of Stripe, Cognito Forms or Microsoft), we ensure an appropriate safeguard is in place — such as UK “adequacy” regulations, the UK Extension to the EU–US Data Privacy Framework, or the International Data Transfer Agreement / Standard Contractual Clauses. You can ask us for more detail using the contacts in section 3.
We keep your clinical records for 8 years from the date of your last appointment, in line with recognised guidance for adult health records. Where a record is required by law or professional guidance, we keep it for the relevant longer period.
Non-clinical data (for example, website enquiries that do not become patient records) is kept only as long as needed for the purpose it was collected, and then securely deleted.
Under the UK GDPR you have the right to:
To exercise any right, contact us using the details in section 3. We will respond within one month. There is normally no charge. We may need to verify your identity before acting on a request.
We use appropriate technical and organisational measures to protect your data, including access controls, encryption in transit and at rest through our providers, and choosing suppliers who meet recognised security standards. Our providers include PCI-DSS Level 1 (Stripe), UK/EU-hosted systems (Cliniko, Microsoft, 123-reg) and UKAS-accredited services (Randox).
Our website uses a small number of cookies. Please see our separate Cookies Policy for detail on what we use and how to control them.
We may update this policy from time to time. Where changes are significant, we will make this clear on our website.
If you are unhappy with how we have handled your personal data, please contact us first using the details in section 3 so we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO):
