Privacy notice
About this notice
This notice explains what personal information Synomics collects, why, and what your rights are. It covers this website, enquiries, and the services we provide to clients: the Introductory consultation, Medical History Review, Medical Investigations, Ongoing Care (Chronic Illness Support), the Starter Assessment, the Clinician Overview, Report Updates and pro bono places.
How you may use the website is set out in our Terms. Synomics Labs, our research and development arm, has its own privacy notice for its web page.
Who we are
Synomics is a UK integrative medical investigation consultancy. Synomics Labs is our research and development arm. At present both are part of the same company, which is responsible for the information described here (the data controller).
- Legal entity: Synomics
- Registered address: 71 Shelton Street, Covent Garden, London WC2H 9JQ
- Privacy contact: privacy@synomics.co.uk
We are not your doctor, and we do not prescribe. We work in tandem with your own clinicians, never in place of them.
What we collect
When you use the enquiry form
If you use the enquiry form, we collect:
- what you would like to do: book an Introductory consultation, join the waitlist, or ask a question
- your question, if you ask one
- who the enquiry is for: you, someone you care for, or you as a clinician or researcher
- which service you are interested in, if you choose one
- your name
- your phone number and, if you give it, your email address
- your organisation, if you choose to give it
- how and when you would like us to contact you, and whether you would like to hear about earlier places
- anything you tell us that would make the call easier, if you choose to
You do not have to contact us. If you do, we need your name and a phone number or email address so that we can reply.
If you contact us for someone else
If you get in touch for someone you care for, we will ask for their agreement, or confirm that you are able to act for them, before we begin any work. They sign a short form confirming they are happy for you to act with them, which they can withdraw at any time. If you hold a Lasting Power of Attorney for their health and welfare, or are their court-appointed deputy, we will ask to see it.
If a parent, partner, relative, friend or carer joins a consultation or speaks for a client, we will note their name, their relationship to the client and what they tell us.
When you become a client
To provide our services, we collect:
- your name and contact details, your date of birth (to establish your age), your sex at birth, and the name and pronouns you would like us to use
- your medical records, letters and test results, which you send to us or ask others to send
- your symptoms, medical history and medications, from what you tell us in consultations and in any questions you answer
- supplements, food and drink, for symptom and intake tracking in Ongoing Care
- blood test results and other results from your test schedule
- data exported from a wearable device, such as Whoop, Apple Watch or Oura Ring, if you choose to share it
- notes of our consultations, and the reports and plans we write for you
- information about your environment or living conditions, where it is relevant to your health
We do not record or transcribe consultations, and we do not use AI tools with your information.
We use this information only to provide the services you have asked for.
If you ask for a pro bono place
We collect what you tell us about your circumstances, for example that you receive a means-tested benefit, or in a few words why cost is a barrier. We use it only to consider your request, and keep it confidential. We may ask to see a recent benefit award letter. You are welcome to cover any details you would rather we did not see.
When you pay
You pay by bank transfer, using your invoice number as the payment reference. We keep a record of what you have paid and when.
When you visit the website
As with any website, your device's IP address and basic technical details (such as browser type) pass to our hosting provider, Cloudflare, so that the page can be delivered to you. Cloudflare may keep short-term technical logs to keep the service secure.
The enquiry form does not send anything itself. When you press send, it opens your own email app with your message written out, and nothing reaches us until you send that email.
The website uses no analytics and sets no cookies of its own. Its fonts are served from this website.
Your light or dark preference
If you use the theme switch to choose Light or Dark, your browser stores your choice in its local storage, under the name "syn-theme", so that pages look the way you chose. This stays on your device and is not sent to us. If you do not use the switch, nothing is stored and the page follows your device's own setting.
To remove the stored choice, set the switch back to System, or clear this site's data in your browser settings.
Your health information
Before you are a client
Please do not include health details in the enquiry form. We do not need them to reply, and we will talk about your health together on the call.
If you send health details anyway, we will delete them and talk about your health with you on the call instead.
Once we work together
Health information is called "special category data" in law, and it is given extra protection. For us, it includes everything in your records and everything you tell us about your health, as well as any genetic results, your family's health history, and details of your ethnicity where your records include them.
We use it only to provide the service you have asked for, and only with your explicit consent. Before you send us any records, we will ask you to confirm your consent in writing, separately from agreeing to our terms.
You can withdraw your consent at any time by emailing privacy@synomics.co.uk. We will then stop using your health information. As your service is built on it, we will talk with you about what that means for your service and for any refund (see Refunds and cancellations).
Withdrawing your consent does not affect anything we did before. If we need to keep a record to deal with a complaint or legal claim, we keep only what is needed for that.
How your records are kept safe
We will give you a secure way to send your records. Before we begin work, your medical records are redacted and pseudonymised: your name, address, date of birth and other identifying details are removed, and you are given a client reference number that is used in their place. The files you sent are then deleted. Files that carry only your reference number are kept on an encrypted drive, not in the cloud, and the list that links reference numbers to names is not kept with them. The redacted copies of your medical records are deleted once your report has been sent to you.
Synomics Labs
Synomics Labs, our research and development arm, does not receive or use information about our clients. Your information stays with the Synomics consultancy. The only exception is if you ask us to share it, for example because you would like to take part in Synomics Labs research, and then only with your written consent.
What Synomics Labs learns may shape how we work, but it never uses information about our clients to do so.
Why we use your information
We do not use your information for marketing, add you to a mailing list, or sell it. We do not make decisions about you by automated means.
- To reply to your enquiry, arrange your consultation and manage the waitlist. If you ask to book or join the waitlist, our lawful basis is that this is a step you have asked us to take before entering into a contract. If you ask a question, our lawful basis is legitimate interests: we have a legitimate interest in replying to people who contact us, and you would expect us to use your details to do so.
- To provide our services. Our lawful basis is that this is necessary for our contract with you. For health information, see "Your health information" above.
- To deal with people who act for a client. Our lawful basis is legitimate interests: making sure a client can be supported by someone they trust.
- To consider a pro bono request. Our lawful basis is legitimate interests: offering places fairly to people facing financial hardship.
- To take payment and keep financial records. Our lawful bases are our contract with you, and our legal obligation to keep accounting records.
- To deliver the website and keep it secure. Our lawful basis is legitimate interests.
- To deal with complaints or legal claims. Our lawful basis is legitimate interests, and for health information, the condition for establishing, exercising or defending legal claims.
Who we share it with
We share your information only with service providers who handle it for us and on our instructions:
- our website host: Cloudflare
- our email provider: Google Workspace
- the video call service you choose for a consultation, such as FaceTime, WhatsApp, Zoom or Google Meet, under that service's own terms
We do not contact your clinicians. We prepare documents, such as the Clinician Overview, for you to share if you choose. If your clinicians have questions about your reports, you pass them to us, and we reply to you in writing.
We do not arrange laboratory tests, so we do not share your details with laboratories. If you choose a nutrition package, we share with our nutritionists and chefs only what they need to prepare your food, and only with your consent.
We may disclose information if the law requires it.
Where it is stored, and when it leaves the UK
Your medical records are kept on an encrypted drive, not in the cloud.
Two of the companies that help us run Synomics are based in the United States:
- Cloudflare, which hosts our website; and
- Google, which provides our email.
They handle your information only on our instructions, under written contracts with us.
When your information is sent to them in the United States, it is protected by UK regulations known as the UK-US data bridge. These allow information to go only to US companies that have signed up to the "UK Extension to the EU-US Data Privacy Framework" and committed to protecting it. Google and Cloudflare have both signed up. Their contracts with us also include the UK's approved data transfer clauses, as a secondary safeguard.
If you would like more detail about any of this, email privacy@synomics.co.uk.
How long we keep it
- Enquiries that do not lead to a booking: 12 months, then deleted.
- Waitlist details: until we offer you a place or you ask to be removed.
- Pro bono requests: kept while you wait for a place, and deleted 6 months after we let you know we cannot offer one.
- Medical records you send us: redacted and pseudonymised before we begin, and the files you sent are then deleted. The redacted copies are deleted once your report has been sent to you.
- Your reports, and our emails with you: 8 years after we last worked with you, as explained below.
- Payment and accounting records: 6 years, as the law requires.
How long we keep your reports
Your reports, and our emails with you, are kept for 8 years after we last worked with you. Many clients come back to us years later, as their health or their questions change. Keeping your reports means we can pick up where we left off, rather than starting again.
Before that time is up, we will write to you. If you would like us to keep them for longer, simply tell us, and we will keep them for a further 5 years and write to you again before that time is up. If we do not hear from you, or cannot reach you, we will securely delete them.
You can ask us to delete your reports and our emails at any time before then. We will do so, unless we need to keep a record to deal with a complaint or legal claim. If that applies, we will tell you what we are keeping and why.
The redacted copies of your medical records are deleted once your report has been sent to you (see How your records are kept safe).
Keeping it safe
We limit access to client information to the people who need it to provide your service. Client files carry only a reference number, and are kept on an encrypted drive, not in the cloud.
Your rights
You have the right to:
- ask for a copy of the information we hold about you
- ask us to correct information that is wrong or incomplete
- ask us to delete your information
- ask us to limit how we use your information
- ask for a copy of information you gave us, in a format you can take elsewhere
- withdraw your consent at any time, where we rely on it
These rights have some conditions and exceptions. We will reply within one month, and will tell you if we need longer.
Your right to object
You have the right to object to our use of your information where we rely on legitimate interests. If you object, we will stop unless we have compelling legitimate grounds to continue. If you ask us to stop using an enquiry, we will delete it.
Children
We do not ordinarily work with anyone under 18. In special cases, after discussion, we may carry out a Medical Investigation for a young person, with a parent or guardian acting for them. Their information is protected in the same way as everyone else's.
How to complain
If you are unhappy with how we have handled your information, please contact us first at privacy@synomics.co.uk. We will acknowledge your complaint within 30 days and tell you the outcome.
You also have the right to complain to the UK regulator, the Information Commission (formerly the ICO), at ico.org.uk.
Changes to this notice
We will update this notice if what we collect or how we use it changes, for example if Synomics Labs becomes a separate organisation. The date at the top shows when it last changed.