Privacy Policy
19th June 2026
This Privacy Notice explains how Joey Cares Limited collects, uses and shares your personal information when you use Joey. It covers information about you as a parent or carer, and about your child as our patient.
We know that health information is sensitive and private. We take our responsibility to protect it very seriously. If you have any questions after reading this notice, please get in touch, we are always happy to explain.
(1) Who We Are
We are Joey Cares Limited, a CQC-registered paediatric healthcare provider operating under the name Joey. We provide healthcare advice and clinical consultations for children via WhatsApp.
We are registered with the UK data protection authority, the Information Commissioner's Office (ICO), under registration number ZB688404.
For data protection purposes, Joey Cares Limited is the data controller for the personal information we hold about you and your child. This means we are responsible for deciding how and why your information is used, and for keeping it safe.
Our Senior Responsible Individual (SRI)
Our Senior Responsible Individual (SRI) is a member of our senior leadership team and is responsible for overseeing how we handle your personal information and ensuring we comply with data protection law.
You can contact our SRI at: info@askjoeynow.com
(2) What Information We Collect
About you as a parent or carer
-
Your name and contact details (email address, phone number)
-
Payment information which is processed securely by our payment provider; we do not store your card details
-
Your relationship to the child and confirmation of parental responsibility
-
Your communication preferences
About your child as our patient
-
Name, date of birth, and age
-
Medical history, current medications, and allergies
-
Symptoms, clinical observations, and consultation notes
-
Diagnosis, treatment recommendations, and prescriptions
-
Photographs or videos shared to support clinical assessment
-
Test results and correspondence from other healthcare professionals
-
Consent records, documenting who gave consent and in what capacity
-
Safeguarding information where relevant
We provide our service via WhatsApp Business. Messages you send through WhatsApp are end-to-end encrypted, this means only you and our clinical team can read the content of your messages. WhatsApp (owned by Meta) processes metadata only, such as the time and date a message was sent and your phone number. The content of your health conversations is not accessible to Meta. We transfer all clinically relevant information from WhatsApp into your child's health record promptly.
If you visit our website
-
Pages you visit and how you navigate the site
-
Your device type and browser
-
Cookies - please see our cookie section for details
If you apply to work with us
-
Your CV and application information
-
References and pre-employment check information
-
Right to Work documentation
-
DBS check information where required for the role
(3) How We Use Your Information
Providing healthcare
To assess your child's symptoms, provide clinical advice, issue prescriptions, and ensure continuity of care.
Maintaining health records
To keep accurate, up-to-date clinical records of all advice, treatments, and correspondence relating to your child.
Safeguarding
To identify and act on any concerns about a child's safety or welfare, including sharing information with relevant authorities where required by law.
Sharing with your child's GP
To share relevant clinical information with your child's registered GP where this supports their ongoing care.
Processing payments
To process payments for consultations securely via our payment provider.
Service communications
To send you consultation follow-ups and important service updates.
Improving our service
To analyse patterns from consultations to improve the quality of care and develop our services. We will never use your child's identifiable health information for commercial purposes without your explicit consent.
Marketing
To send you information about Joey's services, only where you have given us consent to do so. You can withdraw consent at any time.
Legal and regulatory compliance
To comply with our obligations as a CQC-registered healthcare provider.
(4) Our Legal Basis for Processing
Data protection law requires us to have a lawful reason for using your information. Here is why we process each type of information:
-
Your child's health information, to provide healthcare
-
Legal basis: Healthcare purposes - Article 9(2)(h)
-
-
Safeguarding information, to protect your child's safety
-
Legal basis: Vital interests - Article 9(2)(b) and (c)
-
-
Your contact and account details, to provide the service you have subscribed to
-
Legal basis: Contract performance - Article 6(1)(b)
-
-
Legal and regulatory records, to comply with our obligations as a CQC-registered provider
-
Legal basis: Legal obligation - Article 6(1)(c)
-
-
Website and system security, to keep our service safe and functioning
-
Legal basis: Legitimate interests - Article 6(1)(f)
-
-
Marketing communications, to send you updates about Joey - only with your permission
-
Legal basis: Consent - Article 6(1)(a)
-
-
Job applicant information, to assess your application and carry out pre-employment checks
-
Legal basis: Legal obligation and legitimate interests - Article 6(1)(c) and (f)
-
-
Website visitor data, to understand how our site is used and improve it
-
Legal basis: Consent - Article 6(1)(a) for non-essential cookies
-
(5) How Long We Keep Your Information
We keep your child's healthcare records for as long as required by law and clinical best practice. As a paediatric service, we follow the NHS England Records Management Code of Practice 2021.
The types of records and how long we keep them:
-
Your child's health records (general)
-
Until your child's 25th birthday, or their 26th birthday if they were 17 at their last consultation. In the unlikely event of a child's passing, records are retained for 8 years from that date where this falls before their 25th birthday
-
-
Records involving safeguarding concerns
-
May be retained beyond 25 years where ongoing concerns exist.
-
-
Records with potential genetic or long-term clinical implications
-
Clinical advice will be sought before disposal. May be extended with documented justification.
-
-
Consent records
-
Retained as part of the health record for the same period
-
-
Payment records
-
6 years from the transaction date, as required by financial and tax law
-
-
Marketing consents
-
Until you withdraw consent, plus a short period to evidence compliance
-
You have the right to ask us to delete your information in certain circumstances. However, for legal and clinical reasons we may be required to retain your child's health records even if you request deletion. We will always explain our reasons clearly if this applies.
(6) Who We Share Your Information With
With your child's GP
We may share relevant clinical information, such as a consultation summary, with your child's registered GP to support their ongoing care. We will tell you when we do this.
With other healthcare professionals
Where clinically necessary and in your child's best interests, we may share information with other healthcare professionals involved in their care. We will always tell you, except in an emergency.
With social services or other authorities
If we have a safeguarding concern about your child, we may share information with social services, the police, or other relevant authorities. In some circumstances we are legally required to share this information without your consent. We will always act in your child's best interests.
With our service providers
To run our service, we share personal data with trusted providers who process it only on our instructions - including secure cloud hosting and clinical records providers, our messaging platform, a payment processor, and an email provider. All are bound by data processing agreements and may only use your data to provide their service to us. We do not sell your data or share it for marketing without your consent.
Where required by law
We may share information where required by a court order, regulatory obligation, or other legal requirement. We will always satisfy ourselves that we have a lawful basis before sharing.
We will never sell your information. We will never share it for direct marketing purposes without your explicit consent.
(7) International Transfers
Your child's health records and clinical information are stored within the UK and EU and are never transferred outside of these regions.
Some limited non-health data is processed by US-based companies:
-
WhatsApp (Meta): Message metadata only (timestamps and phone number) is processed on Meta's US servers. The content of your health conversations is end-to-end encrypted and never leaves the UK/EU. Meta cannot access your health information.
-
Website tools: Our website uses analytics and marketing tools provided by non-UK-based companies. These collect website visitor information only, no health data is involved.
All transfers comply with UK GDPR and the Data Protection Act 2018. US-based providers are certified under the UK Extension to the EU-US Data Privacy Framework
(8) Your Rights
Under UK data protection law, you have the following rights.
Right of access
You can ask us for a copy of the personal information we hold about you
Right to rectification
You can ask us to correct any information that is inaccurate or incomplete
Right to erasure
You can ask us to delete your information in certain circumstances. For legal and clinical reasons we may be required to retain health records, we will always explain why
Right to restrict processing
You can ask us to limit how we use your information in certain circumstances\
Right to data portability
You can ask us to provide your information in a portable format, or transfer it to another provider
Right to object
You can object to us processing your information on the basis of legitimate interests or for direct marketing
Right to withdraw consent
Where we rely on your consent (e.g. for marketing), you can withdraw it at any time without affecting the lawfulness of previous processing
Right not to be subject to automated decisions
We do not make any automated decisions about you or your child that have a legal or significant effect
Children's Personal Data
Where a right is exercised in relation to a child, we will assess:
-
Whether the request is made by the child directly or by an adult purporting to act on the child's behalf
-
If made by an adult: whether the child has sufficient maturity to exercise the right themselves, whether the child has authorised the adult to act, and whether granting access is in the child's best interests
-
If made by the child: whether the child has sufficient understanding to exercise this right and to appreciate the implications of doing so
-
In all cases: any safeguarding considerations that may affect whether access should be granted, including any concerns about parental access
(9) How to Make a Complaint
We take all feedback about how we handle personal information very seriously. If you are unhappy with how we have used your information, please contact us first, we would like the opportunity to put things right.
Contact us first. Under UK data protection law, you have the right to make a complaint directly to us about how we handle your personal information. We will acknowledge your complaint within 30 days and respond as quickly as possible. You can contact us by email at info@askjoeynow.com.
If you remain dissatisfied
If you are not satisfied with our response, you have the right to make a complaint to the Information Commissioner's Office (ICO), the UK data protection supervisory authority:
-
Website: www.ico.org.uk
-
Helpline: 0303 123 1113
-
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
(10) Cookies
When you visit our website, cookies are placed on your device. We use the following types:
-
Essential cookies - necessary for the website to function. These are placed automatically without requiring your consent.
-
Analytics cookies - help us understand how visitors use our website so we can improve it. These are only placed with your consent.
-
Marketing cookies - used to measure the effectiveness of our marketing. These are only placed with your consent.
-
Functionality cookies - help us improve your experience of the site . These are only placed with your consent.
You can manage your cookie preferences at any time using the cookie banner on our website.
(11) Changes to This Notice
When we make significant changes, we will notify you by email. The date at the top of this notice shows when it was last updated.
We encourage you to review this notice periodically. If we make significant changes to how we process your information, we will contact you directly.