Privacy policy

The short version

• You can search and compare clinics without giving us your name or contact details.
• If you ask for an appointment, we collect your name, email, phone number, the service and the time, and pass them to the clinic you chose. The service can reveal something about your health, so we only use it with your explicit consent.
• We email you a receipt with a link to cancel your request and delete your details at any time.
• We never sell your data or use it for advertising.
• Google Analytics only runs if you click Accept.
• You can ask to see, correct or delete your data at any time by emailing contact@keystone.today.

Who we are

Keystone (keystone.today) is run by its founders, Erdem Arslan and Joseph Varghese, in England. Keystone is not yet a registered company, so for now Erdem and Joseph are together the controller of the personal data described in this policy. When we register a company we will update this policy.

On the main Keystone site we decide how your data is used. Once a clinic receives your details to book you in, it becomes a separate controller of its own copy. On clinic-branded booking pages it is the other way round: the clinic is the controller and Keystone handles your data on its behalf, as those pages explain.

For any privacy question or request, email contact@keystone.today with "Privacy" in the subject line.

Keystone is not a healthcare provider. The clinics listed on Keystone are independent businesses and are responsible for the care they give.

What we collect and why

We only ever use your postcode district to rank clinics by distance. We do not store your full postcode.

We don't ask for your date of birth, NHS number, medical history or payment details, and our booking forms have no free-text box.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time.

Health information

Asking for a service such as a sexual health test, a pregnancy scan or therapy reveals something about your health, even if you tell us nothing else. Health information is "special category data" and has extra protection under the law.

• We only use it with your explicit consent, which you give by ticking the box on the appointment form. We can't arrange an appointment without it, because the clinic has to know what you want to book.
• We share it only with the clinic you chose, and only what the clinic needs to book you in.
• We don't use it for marketing or profiling, and we never sell it or share it with advertisers.
• You can withdraw your consent at any time with the cancel link in your receipt email, or by emailing us. If you do before your appointment, we cancel the request. Either way we delete your name, email and phone number straight away. If the clinic already has your request, we ask it to delete your details too; it holds its own copy under its own privacy policy.

Our site statistics record which services people search for. They hold only your postcode district and a random ID that ends when you close the tab, never your name, email or IP address, so they can't be used to identify you. We use them only to understand demand.

Who we share it with

The clinic you choose. Before it accepts a request made through our booking pages, it sees only your first name, the service and the time. Once it accepts, we pass on your full name, email and phone number so it can treat you. When we arrange a booking by phone, we give the clinic only what it needs to book you in. The clinic then handles your data under its own privacy policy.

Clinics that take a deposit. Some clinics ask for a deposit before they confirm. For those clinics only, we show the clinic your full name, email and phone number before it confirms, so it can arrange the deposit with you directly. The booking form tells you when this applies. You pay the clinic; Keystone never handles payment.

Companies that run parts of Keystone for us:

These companies may only use the data to provide their service to us, under a data processing agreement.

Others, only where needed:

• professional advisers, such as lawyers, accountants and insurers;
• regulators, courts and the police, where the law requires it or to protect someone's life;
• a buyer or investor, if Keystone or part of it is sold or restructured. They must use your data in line with this policy, and we will tell you before it becomes subject to a different one.

We never sell your data and we don't use it for advertising.

Data sent outside the UK

Some of these companies are based in, or may access data from, the United States. Where they do, we make sure your data stays protected:

You can check a company's certification on the Data Privacy Framework list. Contact us for a copy of the safeguards for a particular provider.

How long we keep it

We delete data automatically when these periods end. If you ask us to delete your data sooner, we will, unless we need to keep it for a legal claim or the law requires it.

How we rank clinics

We sort clinics using things like price, distance and rating. This ranks clinics, not you. We don't make decisions about you by automated means that have legal or similarly significant effects.

If you work at a clinic

We collect business contact details of clinic staff, mostly from public sources such as clinic websites, so we can list clinics accurately and talk to them about Keystone. We use them only for business contact, and every message we send includes an easy way to opt out. If you are a sole trader or in a partnership, we only send you marketing emails with your consent.

Clinic prices come from clinics' own websites and from clinics directly. Where a listing names a practitioner, we use that to show accurate listings, on the basis of legitimate interests.

Marketing

We don't send marketing emails to patients. If we ever want to, we will ask first, and you can change your mind at any time. Emails about an appointment you asked for are not marketing.

Children

Keystone is for adults aged 18 and over. If you ask for an appointment for someone else, such as your child, you must be their parent or guardian or have their permission, and share only what the clinic needs.

Keeping your data secure

We protect your data with encryption in transit and at rest (our database is encrypted with AES-256), access controls that limit who on our team can see booking details, and contracts with the companies above. No system is completely secure. We have a written plan for data breaches: we report a breach to the ICO within 72 hours where the law requires it, and if it is likely to put you at high risk, we tell you without undue delay.

Your rights

You can ask us to:

• give you a copy of your data
• correct it
• delete it
• stop or limit how we use it, or object to it
• send it to you or another organisation in a reusable format

Where we rely on your consent, you can withdraw it at any time. You also have the right not to be subject to decisions made solely by automated means that significantly affect you.

Email contact@keystone.today. It's free, and we reply within one month. We may ask you to confirm who you are first. You can change your cookie choices at any time with the button below.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to sort it out first.

Changes to this policy

We will update this page when we change how we use data. If the change is significant, we'll say so on the site, or email you if it affects a booking you've made. Last updated 22 October 2026.