Privacy Policy.

ClinicRoot ("we", "us", or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website at clinicroot.com or engage with our services.

Please read this policy carefully. If you disagree with its terms, please discontinue use of our site.

1. Who We Are

ClinicRoot is a specialist marketing agency providing growth infrastructure services exclusively to medical and aesthetic clinics. ClinicRoot is a brand of WYY Group OÜ, a company registered in Estonia (registry code available upon request), with its registered address at Narva mnt 5, 10117 Tallinn, Estonia. For data protection enquiries, contact us at: hq@clinicroot.com.

2. Information We Collect

Information You Provide Directly

• Name, email address, phone number, and clinic details when you submit an enquiry or book a Growth Audit
• Business information including clinic name, location, and treatment specialties
• Communications you send us via email, contact forms, or telephone
• Payment information when you engage our services (processed securely by third-party payment processors)

Information Collected Automatically

• IP address, browser type, operating system, and device information
• Pages visited, time spent on pages, and navigation patterns
• Referring URLs and search terms used to find our website
• Cookie data and similar tracking technologies (see our Cookie Policy below)

3. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your enquiries and provide the services you have requested
• To send you information about our services, case studies, and clinic growth insights (with your consent)
• To improve our website, services, and marketing strategies
• To analyse website usage and optimise user experience
• To comply with legal obligations and protect our legal rights
• To prevent fraud and ensure the security of our services

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area and United Kingdom, we process your personal data under the following legal bases:

• Contractual necessity: Processing required to fulfil our service agreement with you
• Legitimate interests: Processing for our business operations, marketing, and service improvement
• Consent: Where you have explicitly consented to receive marketing communications
• Legal obligation: Processing required to comply with applicable law

5. How We Share Your Information

We do not sell, trade, or rent your personal information to third parties. We may share your information with:

• Service providers: Third-party vendors who assist us in operating our website and delivering our services (e.g., email platforms, CRM systems, analytics providers)
• Professional advisors: Lawyers, accountants, and other professional advisors where necessary
• Law enforcement: Where required by law or to protect our legal rights
• Business transfers: In connection with a merger, acquisition, or sale of assets

All third-party service providers are required to maintain appropriate security measures and are prohibited from using your data for their own purposes.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law. Enquiry data is retained for 3 years. Client data is retained for 7 years following the end of our engagement for legal and accounting purposes.

7. Your Rights

Under GDPR and UK data protection law, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your personal data in certain circumstances
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at hq@clinicroot.com. We will respond within 30 days.

8. Cookies

Our website uses cookies and similar tracking technologies to enhance your experience and analyse website traffic. We use:

• Essential cookies: Required for the website to function properly
• Analytics cookies: To understand how visitors use our website (Google Analytics)
• Marketing cookies: To deliver relevant advertising and track campaign performance (Google Ads, Meta Pixel)

You can control cookie settings through your browser preferences. Disabling certain cookies may affect website functionality.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include SSL encryption, access controls, and regular security assessments. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

10. International Transfers

Your data may be transferred to and processed in countries outside the UK and EEA. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

11. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated date. Your continued use of our website after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: hq@clinicroot.com

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been processed unlawfully.