Marketing & Consent Policy

This policy sets out how EveryClinic obtains, records, honours and withdraws consent for marketing communications sent to Patients, including emails or messages about new Clinics, new service categories, features, offers or content.

It applies alongside our Privacy Policy and is designed to meet the Privacy and Electronic Communications Regulations 2003 (“PECR”) and the UK GDPR. It covers Patients only; Clinic-facing marketing (e.g. partner newsletters) is addressed separately in the Clinic Partner Agreement.

“Marketing” means any communication promoting EveryClinic, a Clinic, or a service — for example: newsletters, new-service or new-Clinic announcements, promotional offers, seasonal campaigns, or re-engagement messages to lapsed users.

Marketing does NOT include service messages that are necessary to deliver a Booking you have made, such as: booking confirmations, appointment reminders, requests to leave a review of an appointment you attended, or essential account/security notices. These are sent under our contract with you and do not need separate marketing consent (see Privacy Policy, section 4).

We only send marketing by email, SMS or push notification where you have given clear, opt-in consent.

We do not rely on the “soft opt-in” exemption. The PECR soft opt-in can let a business email its own existing customers about its own similar products where their details were obtained in the course of a sale. Because booking through EveryClinic is free to Patients (there is no sale to you), and any Clinic services are the Clinic’s own rather than EveryClinic’s products, we do not rely on that exemption. All electronic marketing to Patients is sent on the basis of explicit opt-in consent.

We do not rely on “legitimate interests” as a basis for direct electronic marketing, in line with ICO guidance on PECR.

Marketing consent is requested through a clear, unticked opt-in checkbox or toggle, separate from acceptance of the Terms and Conditions and from completing a Booking. Pre-ticked boxes, bundled consents, or making marketing a condition of booking are not used.

Where possible we offer granular choices (e.g. email vs. SMS, “new services” vs. “offers”) so you can consent to only the communications you want.

We record, for each Patient: what they consented to, the date and method of consent, and the wording/version of the consent notice shown at the time, so we can demonstrate compliance if asked.

We do not use health-related search or booking behaviour (for example, the specialty or condition you searched for) to target or personalise marketing content, unless you have given explicit, specific consent to that use. General marketing (e.g. “new Clinics near you”) may use non-health data such as location.

We do not share your contact details with Clinics or other third parties for their own direct marketing purposes, unless you have separately and explicitly opted in to that specific sharing.

Any future co-marketing with Clinic partners (for example, a joint promotional email) will be sent by EveryClinic under EveryClinic’s own consent records, not by handing your contact details to the Clinic.

Every marketing email and SMS includes a clear, working unsubscribe or “STOP” mechanism. Opt-out requests are actioned within 2 business days and at the latest within the statutory maximum.

You may also withdraw consent at any time via your account settings or by contacting us. Withdrawing consent does not affect the lawfulness of marketing sent before withdrawal, and does not affect service messages related to a Booking.

Once you unsubscribe, we keep a minimal suppression record (e.g. your email address on a do-not-contact list) so we don’t accidentally re-contact you — see the Data Retention & Third-Party Sharing Policy.

Where a Patient has had no engagement with marketing communications (no opens/clicks) for an extended period (suggested: 24 months), we will either re-confirm consent or stop marketing to that Patient, to keep our marketing list accurate and compliant.

We do not send marketing communications to anyone we know or reasonably believe to be under 18.

This policy is owned by Lakhbir Dhillon (Data Protection Officer), who is responsible for ensuring marketing tooling (e.g. email platform) is configured to honour consent choices and unsubscribe requests automatically. Direct marketing is a priority area for ICO enforcement, and PECR penalties rose to £17.5m or 4% of global turnover under the Data (Use and Access) Act 2025 — so consent discipline is treated as a material compliance control.

This policy is reviewed at least annually, or sooner if PECR/UK GDPR guidance changes materially.