PRIVACY POLICY

Website: www.itsabouttime.me
Last updated: 31 July 2026

Introduction

It’s About Time (“we”, “us”, “our”) is a women’s health initiative operated by Lawmed Ltd (“Lawmed”), a UK-based medical device distributor.

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable privacy legislation.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you interact with our website or business, enquire about our services, or book appointments through our website.

Data Controller

Lawmed is the data controller responsible for personal data collected through the It’s About Time website.

Contact details:
Email: ItsAboutTime@lawmed.co.uk & enquiries@lawmed.co.uk
Telephone: +44 (0) 1932 260 838
Address: Building 5, The Heights, Wellington Way, Weybridge, KT13 0NY, UK

Scope of This Policy

This Privacy Policy applies to:

• Website visitors
• Individuals submitting enquiries
• Individuals seeking information about women’s health conditions and services
• Patients requesting appointments or consultations
• Healthcare professionals and NHS contacts
• Business customers and suppliers
• Job applicants and individuals submitting CVs for current and future opportunities

Information We Collect

Depending on how you interact with us, we may collect:

• Name
• Job title
• Organisation name
• Email address
• Telephone number
• Postal address (where applicable)
• Date of birth
• Information you provide when making an enquiry
• Information you provide when requesting or booking an appointment
• Health information you voluntarily provide to enable us to arrange or facilitate your care
• Your GP details
• Enquiry and correspondence details
• Technical information including IP address, browser type, device information and website usage data

Because It’s About Time supports women’s healthcare services, you may voluntarily provide information relating to your health. This constitutes special category personal data under UK GDPR and is processed only where necessary and in accordance with applicable legal requirements.

How We Collect Your Data

We collect personal data through:

• Website enquiry forms
• Appointment request forms
• Cliniko appointment booking system
• Email and telephone communications
• Business meetings and events
• Website interactions

Appointment Booking and Cliniko

We use Cliniko, a secure cloud-based practice management and appointment booking platform, to manage appointment requests and patient communications.

Where you book an appointment or submit information through Cliniko, your personal information may include contact details and health information that you choose to provide.

Cliniko provides a secure cloud-based practice management and appointment booking platform and processes personal data on our behalf as a data processor under appropriate contractual and security safeguards.

Cliniko applies industry-standard technical and organisational security measures to protect personal data, including encryption, access controls and secure hosting infrastructure.

We only collect information necessary to:

• Arrange appointments
• Communicate with you regarding your care
• Respond to enquiries
• Provide requested services
• Maintain appropriate clinical and administrative records where applicable

Clinical Records

Where you receive treatment from an independent clinician or partner clinic introduced through It’s About Time, that clinician or clinic will usually act as the independent data controller for your clinical records and information generated during your care.

Their own Privacy Policy will explain how they collect, use, store and retain your clinical information.

It’s About Time and Lawmed will only access or process patient information where necessary to arrange appointments, support communications, facilitate your requested care, or fulfil applicable legal and regulatory obligations.

NHS & Healthcare Compliance Context

Where we engage with NHS Trusts, healthcare providers, or public sector organisations, we apply appropriate data protection and governance standards aligned with UK GDPR principles and recognised healthcare procurement expectations, including proportionate alignment with NHS Data Security and Protection Toolkit (DSPT) principles.

We apply data minimisation and only collect personal data that is necessary for:

• Responding to clinical, procurement, or technical enquiries
• Managing appointment bookings
• Supporting healthcare communications
• Meeting contractual and legal obligations
• Managing business communications

Use of Website Enquiries, monday.com and Data Hosting

We use monday.com to manage and process enquiry submissions.

monday.com operates on AWS infrastructure, and data processed through our systems is stored within the European Union (EU).

monday.com acts as a data processor and processes data on our behalf under appropriate contractual and security safeguards.

We apply additional safeguards including:

• Role-based access controls
• Secure authentication mechanisms
• Access logging and audit trails
• Restricted internal access on a need-to-know basis

Recruitment Data Processing

If you apply for a role or submit your CV to us, your personal data will be used to assess your suitability for employment opportunities.
Your information may be shared internally with relevant hiring managers and personnel involved in the recruitment process on a strict need-to-know basis.
We may use secure recruitment systems, such as Employment Hero, to manage applications and restrict access to authorised personnel only.

Legal Basis for Processing

We process personal data under the following lawful bases:

• Legitimate interests– to respond to enquiries, manage relationships and appointments, and operate our services
• Contractual necessity– to take steps prior to entering into or performing a contract
• Legal obligation– to comply with applicable laws and regulatory requirements
• Consent– where we process health information (special category personal data), we rely on an appropriate Article 9 UK GDPR condition, including where processing is necessary for the provision or management of healthcare services or where explicit consent is required

Each processing activity is assessed to ensure an appropriate lawful basis under UK GDPR.

Marketing Communications

Where you have provided consent, we may contact you with information about our services, women’s health initiatives, events, or relevant updates.

You can withdraw your consent or unsubscribe from marketing communications at any time by contacting us using the details provided in this Privacy Policy or by using the unsubscribe option included in our communications.

Data Sharing

We may share personal data with:

• IT and system providers (including Microsoft 365 for business email, Cliniko and monday.com)
• Professional advisers (legal, accounting, compliance)
• Hosting and technical service providers
• Healthcare professionals or partner clinics where necessary to facilitate your requested care
• Regulatory authorities where required by law
• Internal staff involved in recruitment processes (e.g., hiring managers)

We do not sell personal data.

All third parties are required to process data securely and in accordance with applicable data protection laws.

International Transfers

Where personal data is transferred outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent legal protections.

Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to manage ongoing business relationships and meet legal, regulatory, and operational requirements. Business records may be retained for up to 6 years where relevant to contractual or legal obligations.

Where health information forms part of clinical records maintained by or on behalf of healthcare providers, retention periods will comply with applicable NHS and healthcare records management requirements.

Recruitment Data Retention: For job applicants and individuals submitting CVs (including speculative applications), we retain personal data for up to 12 months from the date of submission or last interaction, for the purpose of considering candidates for current and future opportunities.
After this period, personal data will be securely deleted unless we have obtained your explicit consent to retain your information for a longer period as part of a talent pool for future roles.
You may withdraw your consent at any time by contacting us.

Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Access controls
• Secure cloud-based systems
• Encryption where appropriate
• Staff confidentiality obligations
• Controlled and audited data access
• Role-based permissions

Your Data Protection Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Object to processing
• Restrict processing
• Request data portability
• Withdraw consent where processing is based on consent

To exercise your rights, please contact us using the details above.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Cookies

We use cookies and similar technologies to ensure website functionality and improve user experience.

For detailed information about the cookies we use, including how to manage or withdraw consent, please refer to our separate Cookie Policy below.

Where required, non-essential cookies are only used with user consent in accordance with the Privacy and Electronic Communications Regulations (PECR).

Children’s Privacy

Our website and services are not intended for children under the age of 13.

We do not knowingly collect personal data from children under this age.

If you believe that we have collected personal data from a child without appropriate consent, please contact us and we will take appropriate steps to review and remove the information where required.

Links to Other Websites

Our website may contain links to third-party websites or services.

If you follow a link to another website, please review their privacy policy as we do not control and are not responsible for the privacy practices of third-party websites.

Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be published on our website with a revised “Last updated” date.

 

COOKIE POLICY

Website: www.itsabouttime.me
Last updated: 31 July 2026

About This Website

The It’s About Time website is operated by Lawmed Ltd, a UK-based medical device distributor. This Cookie Policy explains how cookies are used when you visit www.itsabouttime.me.

1. What Are Cookies

Cookies are small text files stored on your device when you visit a website. They help websites function properly and provide information about how users interact with the site.

2. How We Use Cookies

We use cookies and similar technologies to:

• Ensure the website functions correctly
• Improve website performance and user experience
• Analyse website traffic and usage patterns to improve our website and services

3. Types of Cookies We Use

3.1 Strictly Necessary Cookies

These cookies are required for the website to function properly and cannot be disabled. They are usually set in response to actions such as form submissions or privacy preferences.

Legal basis: Legitimate interests

3.2 Analytics Cookies

These cookies help us understand how visitors use our website so we can improve performance and content.

Legal basis: Consent

3.3 Functional Cookies

These cookies allow the website to remember your preferences and improve your experience.

Legal basis: Consent

4. Third-Party Cookies

We may use third-party services that set cookies on our website, including:

• Microsoft 365 (where website enquiry forms are used to send enquiries to our business email accounts)
• monday.com (to manage and process website enquiries)
• Cliniko (where appointment booking functionality is made available through our website)
• Analytics providers (where enabled, such as website traffic measurement tools)

These third parties may process data in accordance with their own privacy policies and applicable data protection laws.

5. Legal Basis for Cookies

We use cookies under the following lawful bases:

• Strictly necessary cookies:legitimate interests (to operate the website)
• Non-essential cookies (analytics and functional):user consent

6. Consent

We only store or access non-essential cookies on your device after you have provided consent via our cookie banner.

You can withdraw or change your consent at any time through our cookie settings or your browser controls. Non-essential cookies are only used where you have provided consent in accordance with the Privacy and Electronic Communications Regulations (PECR). 

7. Managing Cookies

You can manage cookies in the following ways:

• Accept or reject non-essential cookies via our cookie banner
• Adjust your browser settings to block or delete cookies

Please note that disabling certain cookies may affect website functionality.

8. Contact Us

If you have any questions about this Cookie Policy or our use of cookies, please contact:

Lawmed Ltd
Email: ItsAboutTime@lawmed.co.uk or enquiries@lawmed.co.uk
Telephone: +44 (0) 1932 260 838
Address: Building 5, The Heights, Wellington Way, Weybridge, KT13 0NY, UK

9. Changes to This Cookie Policy

We may update this Cookie Policy from time to time. The latest version will always be published on our website a revised “Last updated” date.