Privacy policy
In brief
- We collect only the data needed to provide your care and run the service.
- Your health data goes to the clinician treating you and the pharmacy dispensing your prescription — never to your GP, employer or insurer without your explicit consent, except where the law requires.
- The delivery company sees your name and address only. Nothing on the parcel refers to its contents.
- Data is processed in the EU by Sanvivo, our German platform operator, under the UK's adequacy arrangements for the EU.
- We use advertising tags from Google and Reddit to measure our adverts, which set cookies in your browser. You can refuse them in your browser settings — see section 8.
- We never sell your data, and we send no health information to any advertiser.
- If you complain to us, what you write is kept for 10 years because the rules for complaints records require it — so that record is one we cannot delete on request. See section 2.
- You can complain to the ICO at any time.
1. Who we are
Flora Haus Ltd, trading as Flora House ("we", "us"), a company registered in England and Wales under company number 17473485, whose registered office is at 71–75 Shelton Street, London WC2H 9JQ, is the data controller for the personal data described in this policy. Our platform is powered by Sanvivo, a German medical platform operator, which processes data on our behalf.
Contact for privacy matters: hello@florahaus.co.uk. You can also raise any concern about how your data is handled with the Information Commissioner's Office (ICO).
2. What data we collect
Waitlist sign-ups
If you ask us to keep you posted, we store the contact details you give us — an email address, a phone number, or both — and a record of your consent (including the date and wording you agreed to), so we can contact you when the service opens. We ask for no health information at this stage. The same applies if you register your interest in a retreat: we store the details you give, a record of your consent, and a note that the request came from the retreats page so we can reply about the right thing. We rely on your consent for this, and you can withdraw it — and have those details deleted — at any time by emailing hello@florahaus.co.uk.
Complaints, concerns and feedback
If you use our complaints and feedback form, or tell us about something in any other way, we record your name, your email address, a phone number if you give one, whether you are the patient or writing on someone's behalf, and what you have told us — in your own words, as you wrote it. We also record what outcome you have asked for and anything you tell us about how you would like us to reply to you.
An account of what happened to someone in the course of their care will usually say something about their health, which makes it special category data. We are treating it as such whether or not you intended it that way. Three things follow, and they differ from everything else in this section:
- It is not held on the basis of your consent. A regulated healthcare provider is required by law to investigate and respond to complaints, and doing so is part of providing care. The tick box on the form records that you were told what happens to what you wrote — it is not the thing that makes it lawful for us to keep it.
- We cannot simply delete it if you ask. The record of a complaint, what we found and what we did about it has to be kept for 10 years. That is longer than we keep anything else described here, and it is not something we can waive.
- It is not filed in your clinical record, and it is seen only by the people investigating and answering it. Where you are writing on a patient's behalf, we will not discuss their care with you, or confirm that they are a patient at all, until we have their written consent.
Our complaints form carries no advertising tag and no advert-tracking of any kind. Nothing you type into it reaches Google, our analytics provider, or anyone else outside the people handling it.
Advertising measurement
We advertise on search engines, and we need to know which adverts work. When you arrive from one, the advert’s own web address carries a click identifier and labels describing the advert — the campaign, the search term it was shown for, and the type of device. We record those, and if you go on to join the waitlist we keep them with your sign-up, so we can tell which advert brought you here.
A click identifier identifies the click, not you: it is issued by the search engine for that one visit, it is not linked to a name, an email address or an account, and it is not used to recognise you on a later visit. We tell the search engine that a click it sent us led to a sign-up, and we send it nothing else from our own records — never your email address, your phone number, or anything about your health.
We also measure visits that reach us without a search engine — for example when you scan a QR code on one of our business cards or printed materials, or follow a link in a newsletter. The web address then carries only the labels describing that campaign, and no click identifier. We keep a count of how many such visits each campaign brings, so we can tell which of our materials are working. That count records the campaign and nothing about you: no name, no email address, no identifier, and nothing stored on your device. If you go on to join the waitlist, the campaign labels are kept with your sign-up in the same way as for an advert.
Separately, we run Google’s and Reddit’s advertising tags on this website. Each sets cookies in your browser and reports your visit to that platform so that it can measure and improve our adverts. Section 8 explains what they set, what each platform receives, and how to refuse them.
Account and contact data
Name, date of birth, email address, phone number, home address, and proof of identity where required.
Health data (special category data)
Your medical history, current medication, diagnoses, consultation notes, and prescription records. This is special category data under UK GDPR and receives the highest level of protection.
Payment and transaction data
Payment card details are handled by our payment processor — we never store full card numbers. We keep records of the service fees you have paid.
Technical data
Basic server logs (IP address, browser type, pages requested) kept for security and reliability.
3. Why we may lawfully use your data
| Use | Lawful basis |
|---|---|
| Emailing you about our launch after you join the waitlist | Article 6(1)(a) UK GDPR — your consent, which you may withdraw at any time |
| Creating your account, booking consultations, taking payment | Article 6(1)(b) UK GDPR — performance of a contract |
| Providing your clinical care: consultations, prescriptions, dispensing | Article 9(2)(h) UK GDPR — provision of health care, under the responsibility of clinicians bound by a professional duty of confidentiality; alongside Article 6(1)(b) |
| Recording, investigating and answering a complaint, concern or piece of feedback, and keeping the record of it | Article 6(1)(c) UK GDPR — a legal obligation, being Regulation 16 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014; and, for anything it says about health, Article 9(2)(h) UK GDPR — the management of health care services |
| Any sharing beyond your direct care (for example, a summary to your GP at your request) | Article 9(2)(a) UK GDPR — your explicit consent, which you may withdraw at any time |
| Service security, fraud prevention, limited service analytics | Article 6(1)(f) UK GDPR — legitimate interests, balanced against your rights |
| Measuring which of our adverts work, and telling the search engine that a click led to a sign-up | Article 6(1)(f) UK GDPR — our legitimate interest in not wasting money on advertising that does not work, balanced against your rights. No health information is involved, and nothing that identifies you is sent to the search engine. |
4. Who receives your data
- Independent prescribing clinicians — the GMC-registered specialist treating you sees your full medical record.
- The dispensing pharmacy — receives your prescription and delivery details in order to dispense lawfully.
- The delivery provider — receives your name and delivery address only. No medical information appears on or in connection with the parcel.
- Payment processor — processes your card payments; certified to industry security standards.
- Hosting provider — our platform and data are hosted in the European Union.
- Google — as our advertising platform, in two ways. Where you reached us by clicking one of our adverts, we tell Google that the click led to a sign-up, sending the identifier for its own click and nothing else. Additionally, Google’s advertising tag runs on this website and reports your visit to Google directly, together with the cookie identifiers it sets and the technical data your browser sends, including your IP address. Google receives no name, no email address, no phone number and no medical information from us, and we never tell it why you are interested in our service. See section 8.
- Reddit — as our advertising platform, in the same two ways. Where you reached us by clicking one of our Reddit adverts, we tell Reddit that the click led to a sign-up, sending the identifier for its own click and nothing else. Additionally, Reddit’s advertising tag runs on this website and reports your visit to Reddit directly, together with the cookie identifier it sets and the technical data your browser sends, including your IP address. Reddit receives no name, no email address, no phone number and no medical information from us. See section 8.
- Website analytics provider — PostHog, on its European Union infrastructure, receives anonymous website usage data only: which pages are viewed, and general information your browser sends such as approximate region, device type and referring site. It receives no name, no email address, and no medical information. See section 8.
Our promise: we do not disclose your data to your GP, your employer, or your insurer without your explicit consent — except in the rare cases where the law requires disclosure (for example, a court order or a serious safeguarding duty). We never sell personal data.
5. International transfers
Sanvivo, our platform operator, is based in Germany, and processing takes place in the European Union. The UK Government has determined that the EU provides an adequate level of data protection, so this transfer is lawful under UK GDPR without further safeguards. If that adequacy decision ever changes, we will put standard contractual safeguards in place before continuing.
The advertising measurement described in sections 2 and 8 involves Google, which operates from the United States, under Google’s standard contractual clauses and the UK extension to the EU–US Data Privacy Framework. Google’s advertising tag transfers technical data about your visit, including your IP address and the cookie identifiers it sets. No health information and no contact detail leaves the EU by this route.
Reddit, which also operates from the United States, receives the equivalent technical data through its own advertising tag, under Reddit’s standard contractual clauses with the UK addendum. The same limit applies: no health information and no contact detail.
6. How long we keep your data
Medical records are retained for 8 years after the conclusion of your treatment, in line with NHS records-management guidance and professional requirements for clinical records. Account and transaction data are kept for as long as needed for tax and legal obligations (typically 6 years). Server logs are kept for a short, fixed period for security purposes.
Complaints records — the complaint, our investigation and our response — are kept for 10 years, which is what the records-management rules for complaints require. This is the one category in this policy that we cannot delete on request.
The advertising record described in section 2 is kept with your waitlist sign-up and is deleted with it, so asking us to delete your details removes it too. Records of clicks that never led to a sign-up are kept for 12 months and then deleted; they contain nothing that identifies a person. Our count of visits from a QR code or newsletter link is kept on the same basis — up to 12 months, and containing nothing that identifies a person.
7. Your rights
Under UK GDPR you have the right to:
- access a copy of your data;
- correct inaccurate data;
- request erasure (subject to our legal duty to retain medical records and complaints records);
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time, where consent is the basis for processing.
To exercise any right, email hello@florahaus.co.uk. We respond within one month.
You also have the right to complain to the Information Commissioner's Office: ico.org.uk, or by phone on 0303 123 1113.
To complain about anything else — your care, a consultation, our staff, fees, or this website — see our complaints and feedback page. Complaining is free and does not affect your care.
8. Cookies, analytics and advertising measurement
This website runs Google’s advertising tag and Reddit’s advertising tag, which set cookies in your browser so that each platform can measure how well our adverts work. Our own website analytics remain cookieless. This section explains all of this, and how to refuse the advertising cookies.
Cookies set by Google’s advertising tag
When you open any page here, Google’s tag loads and reports the visit to Google. It sets first-party cookies in your browser — typically named _gcl_au, and _gcl_aw if you arrived from one of our adverts — which hold a randomly generated identifier and usually last up to 90 days. Their purpose is to connect an advert click to what you do afterwards on this site, so Google can report whether the advert led to a sign-up.
Through this tag, Google receives the pages you open on this website, the technical data your browser sends including your IP address, and the cookie identifiers above. Google acts as our advertising provider and may also use this data for its own purposes as set out in its own privacy policy.
Cookies set by Reddit’s advertising tag
Reddit’s tag loads on the same pages and works the same way. It sets a first-party cookie in your browser — typically named _rdt_uuid — which holds a randomly generated identifier and usually lasts up to 90 days. Its purpose is to connect a Reddit advert to what you do afterwards on this site, so Reddit can report whether the advert led to a sign-up. Through this tag, Reddit receives the pages you open on this website, the technical data your browser sends including your IP address, and that cookie identifier. Reddit acts as our advertising provider and may also use this data for its own purposes as set out in its own privacy policy.
What neither Google nor Reddit ever receives from us: your name, your email address, your phone number, anything you type into a form, and anything at all about your health, your symptoms, or why you are interested in medical cannabis. We do not send an advertising platform any information about a condition you may have, and we never will.
How to refuse it
These advertising cookies are not necessary for the website to work, and nothing here depends on them:
- Your browser’s privacy settings can block or delete cookies for this site, and most browsers can block third-party scripts entirely.
- Any tracker-blocking extension or browser privacy mode will stop the tag loading at all.
- You can turn off personalised advertising in Google’s own ad settings, which applies wherever you are signed in to Google.
- You can turn off personalised advertising in Reddit’s own privacy settings, which applies wherever you are signed in to Reddit.
- Sending a “Do Not Track” or global privacy signal will also be respected by many blockers.
Advertising cookies of this kind require your consent under the Privacy and Electronic Communications Regulations (PECR). A consent control for them is not yet in place on this website; until it is, please use the browser controls above if you do not want them, and email hello@florahaus.co.uk if you would like us to confirm what has been recorded about your visit.
How we measure the website ourselves
Separately from Google, we use PostHog on its European Union infrastructure, configured to run cookieless:
- Nothing is stored on your device to identify you. Instead, so that a visit can be counted as one visit rather than as five unconnected page views, PostHog works out a temporary identifier on its own servers from your IP address, your browser type and this website’s address, scrambled together in a way that cannot be reversed. That identifier changes every day, so pages you open within a day may be recognised as the same visit, and you are not recognised from one day to the next or across other websites.
- We do not record your screen, your typing, or your mouse movements. Session recording and on-site surveys are switched off.
- Nothing you enter into a form is sent to PostHog, and no data about you is ever sold.
We rely for this on our legitimate interest in understanding whether the website works and which information people are looking for (Article 6(1)(f) UK GDPR). Because it places no identifier on your device, it does not itself require consent under PECR.
What else is kept in your browser
Two temporary entries, aside from the advertising cookies above. Both are scoped to the browser tab and discarded the moment you close it, and neither contains a name, an email address, or any identifier that outlives the tab:
- one recording which advert or link you arrived from, so that if you sign up after reading a few pages we can still tell which advert brought you;
- one recording that we have already shown you our sign-up offer, so you are not shown it twice.
Our own record of the advert you clicked
Independently of Google’s tag, we keep our own record of advert clicks, as described in section 2: the click identifier from the web address and labels describing the advert. If you join the waitlist we keep it with your sign-up so we can tell which advert brought you, and it is deleted when your details are. Records of clicks that never lead to a sign-up contain no personal data beyond the click identifier itself, and are deleted after 12 months.
Where you reach us by scanning a QR code or following a newsletter link rather than from an advert, there is no click identifier at all. We keep only a running count of how many visits each campaign brought, labelled with the campaign and nothing else — no identifier, and nothing stored on your device. This sets no cookie and does not recognise you between visits.
9. Changes to this policy
We will post any changes on this page and update the version number and date above. Significant changes affecting how your health data is handled will be notified to you directly.