Privacy Policy

This Privacy Policy explains how Piotr Kardas, a sole trader trading as HealthySwitch.Me, collects and uses your personal information when you visit healthyswitch.me, book a consultation, buy something Piotr offers you after it, or receive our specialist exercise rehabilitation services. It also explains the rights you have over your information under the UK GDPR and the Data Protection Act 2018.

We know that some of the information we handle is sensitive, in particular information about your health. We treat that information with care, we are clear about why we hold it, and we give you control over it. This policy sets all of that out in plain terms.

This policy should be read alongside our Cookie Policy, which explains how we use cookies and similar technologies on the Website, and our General Conditions of Service and Clinical Disclaimer, which govern the services themselves.

1. Who we are and how to contact us

1.1 The data controller for your personal information is Piotr Kardas, trading as HealthySwitch.Me, a sole trader established in England. This means Piotr Kardas decides how and why your personal information is used, and is responsible for looking after it.

1.2 Our correspondence address is 167-169 Great Portland Street, 5th Floor, London W1W 5PF.

1.3 For any question about this policy, about your information, or to exercise any of your rights, contact us at privacy@healthyswitch.me. For general enquiries you can also reach us at contact@healthyswitch.me.

1.4 We are not required by law to appoint a Data Protection Officer, and we have not appointed one. The contact point above is responsible for privacy matters.

1.5 We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, and we pay the annual data protection fee. We comply with the ICO's requirements for registered controllers. If you would like us to confirm our registration, please ask us using the contact details in section 1.3 and we will do so.

2. A quick summary

If you read nothing else, this is the short version:

• We collect the information we need to arrange your consultation and appointments, to take payment, to deliver the services safely, to deliver an exercise toolbox if you buy one, and to keep proper records.
• Some of this is health information (for example your diagnosis letter and clearance from your GP or consultant). We collect and use your health information only with your explicit consent, which you can withdraw at any time. After your engagement ends we keep a limited record for the periods set out in section 10, as the law allows.
• We do not sell your personal information to anyone.
• We use a small number of trusted service providers to run the Website, take payment, hold video sessions, and, where you choose them, provide the app for your exercise plan and deliver an exercise toolbox. They are named in section 6.
• You have clear rights over your information, set out in section 9, including the right to ask for a copy of it and to ask us to delete it.

3. The information we collect

3.1 We collect and use the following categories of personal information.

(a) Identity and contact information. Your name, email address, telephone number, and the messaging channel you choose (for example text message or WhatsApp), and your home address where you have chosen a home visit, or where we deliver an exercise toolbox to you, together with any delivery instructions you give us.

(b) Booking, order, and appointment information. The consultation you book, and any online appointment, home visit, exercise plan, or exercise toolbox you buy after it; the dates and times of your appointments; whether an appointment is delivered online by video call or at your home; whether you chose to receive an exercise plan in an app or on paper; the delivery details for an exercise toolbox; requests to move or cancel an appointment, and any return of a toolbox; and related correspondence with you.

(c) Health information. Information you provide about your prostate cancer diagnosis, treatment, symptoms, physical condition, and any relevant limitations. This includes the diagnosis letter you supply before your consultation and the written clearance from your GP or consultant supplied before your first appointment or exercise plan, together with the notes we keep of your appointments and progress, and the exercise plans prepared for you ("session records"). It also includes any information you choose to share with us when asking for an accessibility adjustment, as described in our Accessibility Statement. This is special-category data and is handled as described in section 5.

(d) Payment information. The fact and amount of a payment, the date, and confirmation that a payment succeeded or failed. Your card details are entered directly into a secure hosted payment page operated by our payment provider, Stripe: the checkout used when you book the consultation, or a Stripe payment link that Piotr sends you for anything you buy after it. When you pay through a payment link, the payment page may also ask for your name, email address, telephone number, and, for an exercise toolbox, your delivery address, which Stripe passes to us so that we can fulfil your order. We do not receive or store your full card number; Stripe processes card details in compliance with the Payment Card Industry Data Security Standard (PCI DSS).

(e) Marketing preferences. Whether you have chosen to receive updates or other marketing from us, and your responses to that marketing.

(f) Technical information. Information collected automatically by the platform that hosts the Website when you visit, such as your device type, browser, and the internet address your visit comes from, which are used to serve the pages and to keep the Website secure. By default the Website sets strictly necessary cookies only. Google Analytics 4 and Microsoft Clarity are loaded only if you choose "Accept analytics" in our cookie banner (see section 6.2a); what each cookie is, and how to control them, is explained in our Cookie Policy.

3.2 Most of the information above comes directly from you. Some technical information is collected automatically as you use the Website. On occasion, health information may come from a healthcare professional you have asked to provide clearance or a letter on your behalf, or who refers you to us.

3.3 You do not have to give us your information, but if you do not provide the information we need to arrange and safely deliver the services (in particular the screening documents described in our General Conditions of Service), we may be unable to provide those services to you.

3.4 People who use our administration area. If we give you access to the private administration area of this Website, you sign in with your Google account. Google confirms your name, email address and Google account identifier to us. We keep them in our website records, with who gave you access and when you last signed in, only to manage who has access, for as long as you have it. Our lawful basis is our legitimate interests in keeping the administration area secure.

4. Why we use your information, and our lawful bases

4.1 The UK GDPR requires us to have a "lawful basis" for using your personal information. Where the information is health information, we also need a separate, additional condition under Article 9 (see section 5). The table below sets out what we do, and the lawful basis for each purpose.

4.2 Legitimate interests. Where we rely on legitimate interests, we have considered whether those interests are outweighed by your interests and rights, and we have concluded they are not. You can ask us for more detail about this assessment, and you can object to processing based on legitimate interests (see section 9).

4.3 Where we rely on consent, you can withdraw it at any time (see section 5.4 and section 8). Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

4.4 Protecting someone from serious harm. In the rare case where we need to share information to protect someone from serious harm, for example a safeguarding referral as described in our safeguarding information, we rely on vital interests (Article 6(1)(d) and, where you cannot consent, Article 9(2)(c)) or the safeguarding condition in Schedule 1, paragraph 18 of the Data Protection Act 2018.

5. Health information and explicit consent

5.1 Information about your health is special-category data under Article 9 of the UK GDPR, which is given extra protection because of its sensitivity. Because the services support men with a prostate cancer diagnosis, handling your health information is central to what we do.

5.2 Our Article 9 condition for collecting and using your health information to deliver the services is your explicit consent (Article 9(2)(a)). We ask for your clear, specific, and informed agreement before we collect and use your health information, including your diagnosis letter, your GP or consultant clearance, and the session records we keep. Section 5.4 explains the separate, limited condition we rely on to keep records after the services end.

5.3 What "explicit consent" means. Explicit consent is a clear, positive, and unambiguous agreement to us using your health information for the purposes we have described. We ask for it separately and plainly, so that you know exactly what you are agreeing to. It is not buried in other terms, and it is never assumed from silence or inactivity.

5.4 You can withdraw your consent at any time. You can do this by contacting us using the details in section 1. If you withdraw your consent, we will stop using your health information for the purposes that relied on that consent, and we will not be able to continue delivering services that depend on it. Withdrawing consent does not affect the lawfulness of our use of your information before you withdrew it, and it does not require us to delete records we are required, or lawfully entitled, to keep (for example where we must retain a record to defend a potential claim, or to meet a legal obligation). Where we keep health information after your engagement ends or after you withdraw consent, our separate Article 9 condition for that limited retention is the establishment, exercise, or defence of legal claims (Article 9(2)(f)). Your explicit consent remains the only condition on which we collect and use your health information to deliver the services. Section 10 explains our retention periods.

5.5 We maintain an internal Appropriate Policy Document covering our special-category processing, including the safeguarding condition we may rely on (see section 4.4). It records the Article 9 conditions we rely on and how we comply with the data protection principles, our retention, and our erasure practices, and it is available to the Information Commissioner's Office on request. A copy is set out in the Appendix to this policy for review.

6. Who we share your information with

6.1 We do not sell your personal information, and we do not share it with anyone for their own marketing.

6.2 We use a small number of trusted service providers to run our services. Most act as our processors, meaning they act on our instructions and are bound by contracts that require them to keep your information secure and to use it only for the purposes we specify. Some, in particular a payment provider, act as independent controllers for parts of what they do, because they use certain information to meet their own legal, security, and fraud-prevention duties; where that is the case, that provider handles your information under its own privacy terms as well. The role we have identified for each provider is shown below. They are:

If you choose to send us documents by text message or WhatsApp, the messaging provider (for example Meta, in the case of WhatsApp) will process those messages under its own privacy terms as an independent controller. If you prefer, you can always send your documents by email instead. Likewise, if you would rather your exercise plan was not held in a third-party app, you can choose to receive it on paper.

6.2a Website analytics, only with your consent. We use Google Analytics 4 and Microsoft Clarity to understand which pages are read and how the site is used, and only after you choose "Accept analytics" in our cookie banner. If you choose "Essential only", neither is loaded. We use no advertising or remarketing platform. Our Cookie Policy lists the cookies, what they do and how long they last, and you can change your choice at any time through "Cookie settings" at the foot of every page.

6.3 We may also share your information:

(a) with professional advisers (for example an accountant, insurer, or solicitor) where reasonably necessary and subject to a duty of confidentiality;

(b) where we are required to do so by law, by a court, or by a regulator, or to protect the safety of a person (including a safeguarding referral to the appropriate authority, as described in our safeguarding information); and

(c) if the business is reorganised or transferred, in which case your information may be disclosed to a prospective new owner subject to appropriate confidentiality protections. We would not share your health information at that stage except in anonymised form, and any new owner would only take over your records with your consent or under equivalent legal protections.

6.4 Apart from the cases in section 6.3(b), we share your health information with a healthcare professional only with your explicit consent. If a healthcare professional referred you to us and you agree, Piotr emails them a short summary after your initial assessment, then progress updates. Otherwise we do not share it with your GP or wider medical team unless you ask us to, and we act on your instructions.

7. International transfers

7.1 Some of our providers are based outside the United Kingdom, or store or process information outside the UK. This means your information may be transferred to, and processed in, a country other than the UK (for example the United States, in the case of some technology providers).

7.2 Whenever we transfer your information outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK data protection law. Depending on the provider, this is one of the following:

(a) the destination country benefits from UK "adequacy" regulations, meaning it is recognised as offering an equivalent level of protection; or

(b) the transfer is covered by the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any additional measures needed to protect your information.

7.3 You can ask us for more information about the safeguards that apply to a particular transfer using the contact details in section 1.

8. Marketing

8.1 We will only send you marketing (for example updates about the services) where you have given us your consent to do so, or where we are lawfully entitled to under the "soft opt-in".

8.2 The soft opt-in. If you are an existing client, we may send you information about similar products and services we offer, on the basis of our legitimate interests, because you gave us your details in the course of buying, or enquiring about, our services. We only do this for similar products and services, and every message gives you a simple way to opt out.

8.3 Your control. You can opt out of marketing at any time, either by using the unsubscribe link in any marketing email or by contacting us using the details in section 1. We review our marketing contacts and will stop sending marketing to a contact who has been inactive for two years.

8.4 Opting out of marketing does not stop the practical messages we need to send you about a booking you have made (for example a confirmation, a reminder, or a request for your screening documents).

9. Your rights

9.1 Under the UK GDPR you have the following rights over your personal information:

(a) the right to be informed about how we use your information (which this policy provides);

(b) the right of access: to ask for a copy of the information we hold about you;

(c) the right to rectification: to have inaccurate information corrected, or incomplete information completed;

(d) the right to erasure: to ask us to delete your information in certain circumstances (this right is not absolute; it does not apply where we are required or entitled to keep the information, for example for the retention periods in section 10 and section E of the Appendix);

(e) the right to restrict processing: to ask us to limit how we use your information in certain circumstances;

(f) the right to data portability: to receive certain information you gave us in a portable format, where we process it by automated means on the basis of consent or contract;

(g) the right to object: to object to processing based on our legitimate interests, and to object at any time to processing for marketing; and

(h) the right to withdraw consent: where we rely on your consent (including your explicit consent for health information), you can withdraw it at any time (see section 5.4).

9.2 How to exercise your rights. Contact us using the details in section 1. We will respond within one month. If your request is complex, or you have made a number of requests, we may need up to a further two months, as the law allows; if so, we will tell you within the first month and explain why. We may ask you to confirm your identity before we act, to protect your information. In most cases exercising your rights is free; we may charge a reasonable fee, or decline to act, only where a request is clearly unfounded or excessive, and we will explain if that is the case.

9.3 Complaining to the regulator. If you are unhappy with how we have handled your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time. You can contact the ICO at ico.org.uk, by telephone on 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

10. How long we keep your information

10.1 We keep your information only for as long as we need it, and then delete it or make it anonymous. Our retention periods are:

10.2 The rationale for these periods, and how we delete or anonymise information at the end of them, is set out in the Appendix.

11. How we keep your information secure

11.1 We use appropriate technical and organisational measures to protect your information against loss, misuse, and unauthorised access, including access controls, encryption in transit where our providers support it, and the security measures provided by the reputable providers named in section 6. Screening documents you send us as a PDF or photograph are handled and stored with care and access limited to what is necessary to deliver the services. Section 6 explains the role of the messaging provider if you choose to send documents by text message or WhatsApp.

11.2 No transmission of information over the internet is ever completely secure. We take reasonable steps to protect information in transit, and when we ask for your screening documents we will tell you the ways you can send them.

12. Cookies

12.1 By default the Website sets strictly necessary cookies only. When you first visit, a consent banner asks whether you accept analytics. Google Analytics 4 and Microsoft Clarity are loaded only if you choose "Accept analytics"; if you choose "Essential only", neither is loaded. You can change your choice at any time through "Cookie settings" in the footer of every page. What each cookie is, how long it lasts, and how you can also control cookies through your browser, is explained in our Cookie Policy, which forms part of this policy.

13. Children

13.1 The services are for adults. The Website and the services are not directed at children, and we do not knowingly collect information about anyone under 18. If you believe we hold information about a child, please contact us.

14. Changes to this policy

14.1 We may update this policy from time to time, for example to reflect changes in the services or in the law. The current version, with its effective date, is always available on the Website. Where a change is significant, we will take reasonable steps to bring it to your attention.

This policy takes effect from 1 October 2026.

Appendix: Appropriate Policy Document (APD)

This Appropriate Policy Document is prepared under Schedule 1, Part 4 of the Data Protection Act 2018, in connection with the Schedule 1 safeguarding condition we may rely on (see section C below). It records how Piotr Kardas, trading as HealthySwitch.Me, complies with the data protection principles when processing special-category (health) data, and the retention and erasure practices that apply to that data. It is reviewed and kept in place for as long as such processing continues, and it is provided to the Information Commissioner's Office on request. Effective from 1 October 2026.

A. Controller

Piotr Kardas, trading as HealthySwitch.Me, a sole trader established in England. Contact: privacy@healthyswitch.me. Registered with the Information Commissioner's Office as a data controller, and paying the annual data protection fee.

B. Special-category data processed, and the purpose

We process health data (Article 9(1) UK GDPR) about clients and prospective clients, comprising diagnosis letters, GP or consultant clearance, and session records relating to prostate cancer diagnosis, treatment, symptoms, and physical condition. The purpose is to screen for eligibility and to plan and deliver one-to-one specialist exercise rehabilitation safely. In addition, where a client separately and explicitly consents, health-related testimonial content may be used as described in the Privacy Policy and the Testimonial, Photography and Video Consent document.

C. Lawful basis and Article 9 condition

• Article 6 basis: performance of a contract (Article 6(1)(b)); and, where relevant, legitimate interests (Article 6(1)(f)) and legal obligation (Article 6(1)(c)) for record-keeping.
• Article 9 condition for collection and delivery: explicit consent (Article 9(2)(a)). Consent is obtained separately, in clear and specific terms, and is recorded. It can be withdrawn at any time, on which we cease the processing that relied on it, subject to records we are required or entitled to retain.
• Article 9 condition for retention after the services end or consent is withdrawn: establishment, exercise, or defence of legal claims (Article 9(2)(f)), for the limited record kept for the periods in section E.
• Safeguarding: in the rare case of a disclosure to protect someone from serious harm, we rely on vital interests (Article 6(1)(d) and, where the person cannot consent, Article 9(2)(c)) or the safeguarding condition in Schedule 1, paragraph 18 of the Data Protection Act 2018, to which this document attaches.

D. Compliance with the data protection principles

• Lawfulness, fairness, transparency. Processing is grounded in the conditions in section C and described plainly in the public Privacy Policy.
• Purpose limitation. Health data is used only for the screening and delivery purpose above, not for any incompatible purpose, and not for marketing, except that health-related testimonial content may be used where the client separately and explicitly consents, as described in the Privacy Policy.
• Data minimisation. We request only the health information needed to screen and deliver safely (diagnosis letter, clearance, and proportionate session records).
• Accuracy. We rely on information supplied by the client and their healthcare professionals, and correct records on request or when we become aware of an error.
• Storage limitation. Retention periods are stated in section E below.
• Integrity and confidentiality. Access is limited to the practitioner and, where strictly necessary, those who help operate the practice under confidentiality obligations [confirm the access list before publication]; documents are stored securely; providers handling the data are bound by processor contracts (section 6 of the Privacy Policy).
• Accountability. This document, the ICO registration, and our records of consent evidence our compliance.

E. Retention

• Health and case records (including diagnosis letters, clearance, and session records): 7 years after last contact.
• Financial and payment records: 6 years (HMRC / accounting).
• Marketing data: until withdrawal or opt-out, reviewed after 2 years of inactivity.
• Testimonial and media consent records: for as long as the content is in use, and afterwards for as long as needed to evidence the consent given.

These periods balance the client's interest in data minimisation against the need to keep a defensible clinical-adjacent and financial record, and to be able to respond to a query, complaint, or claim within the relevant limitation period (the retention condition in section C).

F. Erasure and review

At the end of the applicable retention period, or on a valid erasure request where no overriding retention ground applies, health data is securely deleted or irreversibly anonymised, including from backups on their normal cycle. Withdrawal of consent triggers cessation of consent-based processing and, where no other lawful ground or retention obligation applies, erasure. This document is reviewed periodically and whenever the processing, the retention periods, or the relevant law changes.