PRIVACY POLICY
Last updated 17 July 2026
This privacy notice for UK Bright Futures Ltd (doing business as Bright Futures Health) ('we', 'us', or 'our') describes how and why we might collect, store, use, and/or share ('process') your information when you use our services ('Services'), such as when you:
- Visit our website at https://brightfutures.health, or any website of ours that links to this privacy notice;
- Make an enquiry or booking, or otherwise contact us about your child's care;
- Engage with us in other related ways, including any sales, marketing, or events.
A note on scope. This policy covers general use of our website. Where you send us information about your child's health through an enquiry or booking, that information is covered by our Patient & Family Privacy Notice, which explains the additional protections that apply.
Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you still have any questions or concerns, please contact us at [email protected].
SUMMARY OF KEY POINTS
This summary provides key points from our privacy notice. You can find more detail on any topic in the section indicated, or by using the table of contents below.
What personal information do we process? When you visit or use our Services, we may process personal information depending on how you interact with us — including information you give us through an enquiry or booking, and technical information collected automatically.
Do we process any sensitive personal information? Yes. Because we are a children's health service, information you send us through the website — for example through an enquiry or booking — can include health information about your child. This is 'special category' data under UK data protection law and receives extra protection; it is handled under our Patient & Family Privacy Notice.
Do we collect information about children? Yes. We are a paediatric service, so we collect and process information about children under 18 — provided to us by a parent or carer, or by a young person who is old enough to do so. We do not knowingly allow a child to set up an account or receive marketing independently.
How do we process your information? We process your information to respond to your enquiry, arrange appointments, provide, improve, secure and administer our Services, communicate with you, and comply with law. We process your information only when we have a valid legal reason to do so.
In what situations and with which parties do we share personal information? We may share information with the service providers that help us run our website and communicate with you, and in the specific situations described below.
How do we keep your information safe? We have organisational and technical measures in place to protect your personal information, though no system can be guaranteed 100% secure.
What are your rights? Depending on where you are, you may have rights regarding your personal information, including to access, correct, erase, restrict or object.
TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide to us when you make an enquiry or booking, express an interest in our Services, or otherwise contact us. Depending on your interaction with us, this may include:
- your name and contact details (email address and phone number);
- your child's name and age; and
- the reason for your enquiry or booking, which may include information about your child's health.
Sensitive information. Because we are a children's health service, the information you send us can include health information about your child, and information relating to a child under 18. This is 'special category' personal data and receives extra protection under UK data protection law. Where you provide it, it is handled under our Patient & Family Privacy Notice, which sets out the lawful bases we rely on (including the provision of health care under Article 9(2)(h)), how we keep it confidential, and your rights.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.
Information automatically collected
In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, approximate location, and information about how and when you use our Services. This is primarily needed to maintain the security and operation of our Services, and for internal analytics and reporting. We collect this information through cookies and similar technologies (see section 5).
2. HOW DO WE PROCESS YOUR INFORMATION?
In Short: We process your information to respond to your enquiry, arrange care, provide, improve and secure our Services, communicate with you, and comply with law.
- To respond to your enquiries and arrange appointments and bookings.
- To provide, maintain, secure and improve our website.
- To understand how our website is used (analytics), where you have accepted analytics cookies.
- To send you updates or marketing only where you have asked us to or agreed — you can opt out at any time.
- To comply with our legal and regulatory obligations.
- To protect an individual's vital interests, such as to prevent harm.
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
In Short: We only process your personal information when we have a valid legal reason to do so under the UK GDPR.
The UK GDPR requires us to explain the valid legal bases we rely on to process your personal information. We may rely on the following:
- Consent. Where you have given us permission to use your personal information for a specific purpose (for example, non-essential cookies or marketing). You can withdraw your consent at any time.
- Legitimate interests. To run and secure our website and to respond to your enquiries, where this is not overridden by your interests and rights.
- Performance of a contract. Where we need to process your information to provide our Services, including where you book and pay for an appointment.
- Legal obligations. Where processing is necessary to comply with our legal obligations.
- Vital interests. Where processing is necessary to protect your vital interests or those of another person.
Where the information concerns your child's health, the special-category condition we rely on is the provision of health care (Article 9(2)(h)), with the matching condition in Schedule 1 of the Data Protection Act 2018, as set out in our Patient & Family Privacy Notice.
In Short: We may share information with the service providers that help us run our website and communicate with you, and in the specific situations described below.
Vendors, consultants, and other third-party service providers. We may share your data with third-party providers who perform services for us and require access to do that work. We have contracts in place with them designed to protect your personal information — they may only use it on our instructions, and must protect it and retain it only for the period we instruct. The categories of provider we use include:
- Website hosting (for example GoDaddy);
- Consent & cookie management (for example Termly.io);
- Web analytics (for example Google Analytics);
- Communication and chat (for example our website chat and messaging providers);
- Social media plugins and advertising (for example Facebook and X/Twitter plugins).
The specific list of providers is kept under review and is available on request. Once you become a patient, your information is handled through our clinical and administrative systems as described in the Patient & Family Privacy Notice and our Records of Processing Activities.
Where your information is processed. Most of our providers process information in the UK or the European Economic Area. A small number may process limited information (such as your contact details) outside the UK. Where they do, we make sure it is protected by safeguards approved for UK data transfers, such as the UK International Data Transfer Agreement or Standard Contractual Clauses and, for the United States, the UK extension to the EU–US Data Privacy Framework.
We may also need to share your personal information in the following situation: Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
In Short: We may use cookies and other tracking technologies to collect and store your information.
We use cookies and similar tracking technologies to gather information when you interact with our Services. Some are essential to keep our Services secure and working; non-essential cookies (including analytics and any advertising cookies) are only set with your consent, which you give through the cookie banner and can change at any time. Specific information about how we use these technologies and how you can refuse certain cookies is set out in our Cookie Notice.
Google Analytics
We may share your information with Google Analytics to track and analyse the use of the Services. To opt out of being tracked by Google Analytics, visit https://tools.google.com/dlpage/gaoptout. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.
6. HOW LONG DO WE KEEP YOUR INFORMATION?
In Short: We keep your information only as long as necessary, unless otherwise required by law.
We keep website enquiry information only as long as we need it — generally up to two years if you do not go on to become a patient — and then delete it. If you become a patient, your information is retained under our Data Retention Policy and the Patient & Family Privacy Notice (children's clinical records are generally kept until the patient's 25th birthday, or 26th if the last entry was made at 17). When we have no ongoing legitimate need to process your personal information, we will either delete or anonymise it, or securely store and isolate it until deletion is possible.
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system of organisational and technical security measures.
We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. However, despite our safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that unauthorised third parties will never defeat our security. You should only access the Services within a secure environment.
8. DO WE COLLECT INFORMATION FROM MINORS?
In Short: Yes — we are a children's health service, so we do process information about under-18s, provided by a parent or carer or a competent young person. We do not knowingly allow children to set up accounts or receive marketing independently.
Our website is intended to be used by parents and carers on behalf of their children, and by young people where they are old enough to do so. Because we care for children, we collect and process personal information — including health information — about children under 18. This information is normally provided to us by a person with parental responsibility, or by a young person who is competent to provide it, and it is handled under our Patient & Family Privacy Notice. We do not knowingly allow a child to set up an account independently or to receive marketing. If you believe a child has provided information in a way they should not have, please contact us at [email protected] and we will put it right.
9. WHAT ARE YOUR PRIVACY RIGHTS?
In Short: In some regions, such as the United Kingdom (UK) and the European Economic Area (EEA), you have rights that allow you greater access to and control over your personal information.
In some regions (like the UK and the EEA), you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information; (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) if applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances you may also have the right to object to processing. To make a request, contact us using the details in section 12.
If you are located in the UK and believe we are unlawfully processing your personal information, you also have the right to complain to the Information Commissioner's Office (ICO). We would, however, welcome the chance to help resolve your concern first.
Withdrawing your consent: If we are relying on your consent, you have the right to withdraw it at any time by contacting us using the details in section 12, or by updating your preferences. This will not affect the lawfulness of processing before withdrawal.
Opting out of marketing: You can unsubscribe at any time by clicking the unsubscribe link in our emails, or by contacting us. We may still send you service-related messages that are necessary for the administration of your care.
10. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems include a Do-Not-Track ('DNT') feature you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals. If a standard is adopted that we must follow in future, we will inform you in a revised version of this notice.
11. DO WE MAKE UPDATES TO THIS NOTICE?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this privacy notice from time to time. The updated version will be indicated by an updated 'Last updated' date at the top of this notice. If we make material changes, we may notify you by prominently posting a notice or by directly sending you a notification. We encourage you to review this privacy notice frequently.
12. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
If you have questions or comments about this notice, you may contact our Information Governance Lead, Dr Martin Gray, by email at [email protected], or by post at:
UK Bright Futures Ltd
6 Wilkinson Street
London, SW8 1DB
United Kingdom
13. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please submit a data subject access request, or contact us using the details in section 12.