Privacy policy
In brief
- We collect only the data needed to provide your care and run the service.
- Your health data goes to the clinician treating you and the pharmacy dispensing your prescription — never to your GP, employer or insurer without your explicit consent, except where the law requires.
- The delivery company sees your name and address only. Nothing on the parcel refers to its contents.
- Data is processed in the EU by Sanvivo, our German platform operator, under the UK's adequacy arrangements for the EU.
- We use Google’s advertising tag to measure our adverts, which sets cookies in your browser. You can refuse them in your browser settings — see section 8.
- We never sell your data, and we send no health information to any advertiser.
- You can complain to the ICO at any time.
1. Who we are
Flora Haus Ltd, trading as Flora House ("we", "us"), is the data controller for the personal data described in this policy. Our platform is powered by Sanvivo, a German medical platform operator, which processes data on our behalf.
Contact for privacy matters: hello@florahaus.co.uk. You can also raise any concern about how your data is handled with the Information Commissioner's Office (ICO).
2. What data we collect
Waitlist sign-ups
If you ask us to keep you posted, we store the contact details you give us — an email address, a phone number, or both — and a record of your consent (including the date and wording you agreed to), so we can contact you when the service opens. We ask for no health information at this stage. The same applies if you register your interest in a retreat: we store the details you give, a record of your consent, and a note that the request came from the retreats page so we can reply about the right thing. We rely on your consent for this, and you can withdraw it — and have those details deleted — at any time by emailing hello@florahaus.co.uk.
Clinician registrations
If you are a doctor and register your interest on our medical professionals page, we store the email address you give us and a record of your consent (including the date and wording you agreed to), so we can contact you about prescribing through the platform. We ask for nothing else — no GMC number, and nothing about your patients. A notification containing that email address is sent to the Flora House team so we can respond. We rely on your consent, and you can withdraw it — and have the address deleted — at any time by emailing hello@florahaus.co.uk.
Advertising measurement
We advertise on search engines, and we need to know which adverts work. When you arrive from one, the advert’s own web address carries a click identifier and labels describing the advert — the campaign, the search term it was shown for, and the type of device. We record those, and if you go on to join the waitlist we keep them with your sign-up, so we can tell which advert brought you here.
A click identifier identifies the click, not you: it is issued by the search engine for that one visit, it is not linked to a name, an email address or an account, and it is not used to recognise you on a later visit. We tell the search engine that a click it sent us led to a sign-up, and we send it nothing else from our own records — never your email address, your phone number, or anything about your health.
Separately, we run Google’s advertising tag on this website. It sets cookies in your browser and reports your visit to Google so that Google can measure and improve our adverts. Section 8 explains what it sets, what Google receives, and how to refuse it.
Account and contact data
Name, date of birth, email address, phone number, home address, and proof of identity where required.
Health data (special category data)
Your medical history, current medication, diagnoses, consultation notes, and prescription records. This is special category data under UK GDPR and receives the highest level of protection.
Payment and transaction data
Payment card details are handled by our payment processor — we never store full card numbers. We keep records of the service fees you have paid.
Technical data
Basic server logs (IP address, browser type, pages requested) kept for security and reliability.
3. Why we may lawfully use your data
| Use | Lawful basis |
|---|---|
| Emailing you about our launch after you join the waitlist | Article 6(1)(a) UK GDPR — your consent, which you may withdraw at any time |
| Creating your account, booking consultations, taking payment | Article 6(1)(b) UK GDPR — performance of a contract |
| Providing your clinical care: consultations, prescriptions, dispensing | Article 9(2)(h) UK GDPR — provision of health care, under the responsibility of clinicians bound by a professional duty of confidentiality; alongside Article 6(1)(b) |
| Any sharing beyond your direct care (for example, a summary to your GP at your request) | Article 9(2)(a) UK GDPR — your explicit consent, which you may withdraw at any time |
| Service security, fraud prevention, limited service analytics | Article 6(1)(f) UK GDPR — legitimate interests, balanced against your rights |
| Measuring which of our adverts work, and telling the search engine that a click led to a sign-up | Article 6(1)(f) UK GDPR — our legitimate interest in not wasting money on advertising that does not work, balanced against your rights. No health information is involved, and nothing that identifies you is sent to the search engine. |
4. Who receives your data
- Independent prescribing clinicians — the GMC-registered specialist treating you sees your full medical record.
- The dispensing pharmacy — receives your prescription and delivery details in order to dispense lawfully.
- The delivery provider — receives your name and delivery address only. No medical information appears on or in connection with the parcel.
- Payment processor — processes your card payments; certified to industry security standards.
- Hosting provider — our platform and data are hosted in the European Union.
- Google — as our advertising platform, in two ways. Where you reached us by clicking one of our adverts, we tell Google that the click led to a sign-up, sending the identifier for its own click and nothing else. Additionally, Google’s advertising tag runs on this website and reports your visit to Google directly, together with the cookie identifiers it sets and the technical data your browser sends, including your IP address. Google receives no name, no email address, no phone number and no medical information from us, and we never tell it why you are interested in our service. See section 8.
- Website analytics provider — PostHog, on its European Union infrastructure, receives anonymous website usage data only: which pages are viewed, and general information your browser sends such as approximate region, device type and referring site. It receives no name, no email address, and no medical information. See section 8.
Our promise: we do not disclose your data to your GP, your employer, or your insurer without your explicit consent — except in the rare cases where the law requires disclosure (for example, a court order or a serious safeguarding duty). We never sell personal data.
5. International transfers
Sanvivo, our platform operator, is based in Germany, and processing takes place in the European Union. The UK Government has determined that the EU provides an adequate level of data protection, so this transfer is lawful under UK GDPR without further safeguards. If that adequacy decision ever changes, we will put standard contractual safeguards in place before continuing.
The advertising measurement described in sections 2 and 8 involves Google, which operates from the United States, under Google’s standard contractual clauses and the UK extension to the EU–US Data Privacy Framework. Google’s advertising tag transfers technical data about your visit, including your IP address and the cookie identifiers it sets. No health information and no contact detail leaves the EU by this route.
6. How long we keep your data
Medical records are retained for 8 years after the conclusion of your treatment, in line with NHS records-management guidance and professional requirements for clinical records. Account and transaction data are kept for as long as needed for tax and legal obligations (typically 6 years). Server logs are kept for a short, fixed period for security purposes.
The advertising record described in section 2 is kept with your waitlist sign-up and is deleted with it, so asking us to delete your details removes it too. Records of clicks that never led to a sign-up are kept for 12 months and then deleted; they contain nothing that identifies a person.
7. Your rights
Under UK GDPR you have the right to:
- access a copy of your data;
- correct inaccurate data;
- request erasure (subject to our legal duty to retain medical records);
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time, where consent is the basis for processing.
To exercise any right, email hello@florahaus.co.uk. We respond within one month.
You also have the right to complain to the Information Commissioner's Office: ico.org.uk, or by phone on 0303 123 1113.
8. Cookies, analytics and advertising measurement
This website runs Google’s advertising tag, which sets cookies in your browser so that Google can measure how well our adverts work. Our own website analytics remain cookieless. This section explains both, and how to refuse them.
Cookies set by Google’s advertising tag
When you open any page here, Google’s tag loads and reports the visit to Google. It sets first-party cookies in your browser — typically named _gcl_au, and _gcl_aw if you arrived from one of our adverts — which hold a randomly generated identifier and usually last up to 90 days. Their purpose is to connect an advert click to what you do afterwards on this site, so Google can report whether the advert led to a sign-up.
Through this tag, Google receives the pages you open on this website, the technical data your browser sends including your IP address, and the cookie identifiers above. Google acts as our advertising provider and may also use this data for its own purposes as set out in its own privacy policy.
What Google never receives from us: your name, your email address, your phone number, anything you type into a form, and anything at all about your health, your symptoms, or why you are interested in medical cannabis. We do not send an advertising platform any information about a condition you may have, and we never will.
How to refuse it
These advertising cookies are not necessary for the website to work, and nothing here depends on them:
- Your browser’s privacy settings can block or delete cookies for this site, and most browsers can block third-party scripts entirely.
- Any tracker-blocking extension or browser privacy mode will stop the tag loading at all.
- You can turn off personalised advertising in Google’s own ad settings, which applies wherever you are signed in to Google.
- Sending a “Do Not Track” or global privacy signal will also be respected by many blockers.
Advertising cookies of this kind require your consent under the Privacy and Electronic Communications Regulations (PECR). A consent control for them is not yet in place on this website; until it is, please use the browser controls above if you do not want them, and email hello@florahaus.co.uk if you would like us to confirm what has been recorded about your visit.
How we measure the website ourselves
Separately from Google, we use PostHog on its European Union infrastructure, configured to run cookieless:
- Nothing is stored on your device to identify you. Instead, so that a visit can be counted as one visit rather than as five unconnected page views, PostHog works out a temporary identifier on its own servers from your IP address, your browser type and this website’s address, scrambled together in a way that cannot be reversed. That identifier changes every day, so pages you open within a day may be recognised as the same visit, and you are not recognised from one day to the next or across other websites.
- We do not record your screen, your typing, or your mouse movements. Session recording and on-site surveys are switched off.
- Nothing you enter into a form is sent to PostHog, and no data about you is ever sold.
We rely for this on our legitimate interest in understanding whether the website works and which information people are looking for (Article 6(1)(f) UK GDPR). Because it places no identifier on your device, it does not itself require consent under PECR.
What else is kept in your browser
Two temporary entries, aside from the Google cookies above. Both are scoped to the browser tab and discarded the moment you close it, and neither contains a name, an email address, or any identifier that outlives the tab:
- one recording which advert or link you arrived from, so that if you sign up after reading a few pages we can still tell which advert brought you;
- one recording that we have already shown you our sign-up offer, so you are not shown it twice.
Our own record of the advert you clicked
Independently of Google’s tag, we keep our own record of advert clicks, as described in section 2: the click identifier from the web address and labels describing the advert. If you join the waitlist we keep it with your sign-up so we can tell which advert brought you, and it is deleted when your details are. Records of clicks that never lead to a sign-up contain no personal data beyond the click identifier itself, and are deleted after 12 months.
9. Changes to this policy
We will post any changes on this page and update the version number and date above. Significant changes affecting how your health data is handled will be notified to you directly.