New Leaf Health Privacy Policy

Policy last updated: 04/05/2022

We at New Leaf Health Ltd are committed to protecting and respecting your privacy. This policy, together with any other documents referred to within, sets out the basis on which we will process any personal data that we collect from you, or that you provide to us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

For the purpose of the Data Protection Act 2018 (Act) / EU General Data Protection Regulation 2016 (GDPR), the data controller is New Leaf Health Ltd Mill House, High Street, Kinver, DY7 6ER.

Our contact details

Name: New Leaf Health Ltd

Address: Mill House, High Street, Kinver, DY7 6ER

Telephone: 01384 877 855


The type of personal information we collect

We currently collect and process the following information:

  • Your contact details (including full name, place of work, work email address and work phone number).
  • Your correspondence with us.
  • Your financial and credit/debit card information (via a secure payment processor) for online orders made via our website.

We also collect information on how you use and interact with our website, however, you are not personally identifiable by this information, as your IP address is anonymised.

Additionally, we collect ‘special category’ data in the form of general health data through the fulfilment of our products and services. This data is recorded and stored anonymously and you are not identifiable as a result of us processing this data.

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

  • You enquire with us via email, telephone, or through a form on our website.
  • You download an asset through a form on our website.
  • You purchase one of our products or services.
  • You use our online booking platform as part of one of our services.

We also receive personal information indirectly, from the following sources in the following scenarios:

  • From third-party websites that promote our services (such as Mental Health First Aid England, or CPD) when you enquire or register with them regarding one of our services.
  • From third-party marketing agencies as part of a wider list for the purpose of marketing.

We use the information in order to:

  • Provide you with information on our services and products.
  • Facilitate and fulfil the services that we have sold to you.
  • Process your purchases through our website (for online orders).
  • Contact you for marketing purposes.
  • Suppress your contact details to prevent us from contacting you again in the future, if you have requested that we don’t contact you.

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:

  • Your consent. You are able to remove your consent at any time. You can do this by contacting
  • We have a legitimate interest.

How we store your personal information

Your information is securely stored on our systems and is protected from outside and unauthorised access by security put in place by our IT partners.

  • We retain your personal contact details from enquiries for a maximum of 3 years, to assist in any future enquiries you may make. At this point, your personal contact details (name and email address) will be removed from our databases. We will retain general information about the company and enquiry for our records and will retain a copy of our correspondence with you.
  • We retain your personal contact details as an active client indefinitely. If you stop being an active client, we will retain your information unless you request that your details be deleted. In this instance, your personal details will be completely erased from any of our databases on which your details feature, however, we will retain any records or correspondence relating to services you have undertaken with us, and we will keep general information on the company and the services undertaken.
  • For data used when registering for our online booking tool, we will retain this information indefinitely, or until you request deletion, to ensure that your account remains active and can be used again in the future, should you utilise our services again.
  • For data we have acquired via third-party marketing agencies for marketing purposes, we will retain your personal contact information for a maximum of 3 years, or for the length of time specified by the supplier (usually no more than 24 months). We will then delete your information from our system. We may, however, obtain your information again via the third-party marketing agency.
  • In instances where you have requested that we no longer contact you, we will keep a copy of your email address only for the purpose of suppression, to allow us to screen against any data we may acquire from third-party marketing agencies, in order to prevent us unintentionally acquiring your personal data and contacting you.

We may also retain specific information only necessary for the following reasons:

  • If there is an unresolved issue relating to your account, such as an outstanding invoice on your account.
  • If necessary for its legitimate business interests, such as fraud prevention.
  • If we are required to by applicable law; and/or in aggregated and/or anonymized form.

Sharing your information

We may disclose your personal information to third-parties in specific circumstances, in which instance you will be notified. These circumstances could include:

  • If we sell the business or parts of the business, in which case we may disclose your information to the buyer in order to continue using the data in line with this policy.
  • If we acquire new business assets and transfer specific data processing tasks to these new acquisitions.
  • If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms and conditions and other agreements; or to protect the rights, property, or safety of New Leaf Health Ltd, our customers, or others.

Your data protection rights

Under data protection law, you have rights including:

  • Your right of access – You have the right to ask us for copies of your personal information.
  • Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
  • Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
  • Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
  • Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.
  • Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at:

Name: New Leaf Health Ltd

Address: Mill House, High Street, Kinver, DY7 6ER

Telephone: 01384 877 855


You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:  

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

ICO website: