Privacy policy

Who we are

The Clear Ear Room (62 Carpenters Lane, Gorse Hill, Swindon, Wiltshire SN2 8AF) is the “data controller” for the information you give us. You can reach us at bookings@ear-room.co.uk or 07440 382502.

What we collect

• Booking details — your title, name, address, phone number and email.
• Health information — your date of birth, gender, GP surgery name and address, whether a doctor or healthcare professional has advised ear wax removal, and anything relevant you tell us about your ears or health.
• Before & after photographs — only ever with your consent, taken as part of your treatment record.
• Payment information — your deposit is processed by our payment provider (Stripe). Under the PCI-DSS card-security standard, your full card details are never seen or stored by us — they go directly to our payment processor.

Why we use it, and our lawful basis

We use your information to provide and manage your appointment and your care. Because health data (including your photographs) is “special category” data under UK GDPR, we rely on:

• your explicit consent (which you can withdraw at any time), and
• the provision of healthcare and treatment, and
• performing our agreement with you to carry out your appointment.

Who we share it with

We never sell your data. We use a small number of trusted providers only to run the service, acting on our instructions:

• Supabase — secure database/storage (hosted in the UK/EU).
• Stripe — to take your deposit payment.
• Resend — to send your booking confirmation email.
• Google Calendar — to schedule your appointment in our diary.
• Vercel — to host this website.

How we protect it

Your records are held securely with access limited to Carrie and authorised staff. Your before/after photographs are stored privately — they are never made public and are only accessible to us.

How long we keep it

We keep your records only for as long as necessary to provide your care and to meet our legal obligations, after which they are securely deleted. You can ask us to delete your photographs or records at any time (see your rights below).

Deleting your data & your destruction certificate

You can ask us to delete the personal information we hold about you at any time. Once we have permanently removed it, we email you a Certificate of Data Destruction — a GDPR-compliant confirmation that your data has been erased, for your records.

The one exception is financial records. Where the law requires us to keep a record of a transaction (for accounting and tax), we retain only anonymised figures — an amount and a date, with nothing that identifies you. Your card details are never part of this, because (as above) we never hold them — they stay with our PCI-DSS-compliant payment processor.

Your rights

You have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct anything that’s wrong;
• ask us to delete your information, or withdraw your consent;
• complain to the Information Commissioner’s Office (ICO) at ico.org.uk if you’re unhappy with how we’ve handled your data.

Cookies

This website uses only the essential cookies needed for booking and security. We do not use advertising or tracking cookies.

Changes

We may update this policy from time to time; the version on this page is the current one. See also our Terms & conditions.

Last updated: September 2026.