We respect your privacy and are committed to protecting personal data. This policy explains what we collect, why, how we use it, and your rights under UK data protection laws (UK GDPR & Data Protection Act 2018) and, where relevant, PECR (e-privacy rules for email/SMS marketing).
We act as Controller for personal data collected via our website, social channels, and our own sales/operations, and as a Processor for data we handle on behalf of clients inside GoHighLevel (GHL). Clients are Controllers of their lead/customer data.
We do not intentionally collect special category data unless necessary and agreed. Clinical suitability notes should live in your clinical system, not ours.
Provide & improve services — funnels, ads, CRM automations, support. Contract; Legitimate interests.
Sales & marketing — newsletters, offers, retargeting (where permitted). Consent (where required); Legitimate interests; Soft opt-in under PECR.
Billing & admin — invoicing, accounting, audits. Contract; Legal obligation.
Security & fraud prevention — access logs, abuse monitoring. Legitimate interests; Legal obligation.
Analytics & attribution — site performance, conversion tracking. Consent for non-essential cookies.
Processor activities for clients — lead capture, reminders, rebooking. Acting on Controller instructions.
You can withdraw consent at any time (e.g., cookie preferences, email/SMS opt-outs).
Email/SMS/WhatsApp: We contact you where permitted (consent or soft opt-in). Every message includes an unsubscribe/STOP option.
Retargeting & pixels: We use pixels (e.g., Meta) to show relevant ads. Manage consent via our cookie banner and your platform settings.
We use essential cookies for site functionality and, with your consent, analytics/advertising cookies (e.g., Meta Pixel, Google tools if enabled).
Manage preferences: Use the cookie banner to accept/reject non-essential cookies.
We share data with trusted processors that help us deliver services, including:
We require processors to safeguard data and act only on our instructions. We don’t sell personal data.
Where providers process data outside the UK (e.g., US), we rely on lawful transfer mechanisms (SCCs with UK addendum) and apply appropriate safeguards.
We apply technical and organisational measures (access controls, encryption in transit where supported, role-based permissions, auditing, least-privilege). No method is 100% secure; we review and improve safeguards continually.
You have the right to access, rectify, erase, restrict, object (including to direct marketing), data portability, and to withdraw consent where processing is based on consent.
To exercise rights, email [email protected]. You may also complain to the UK ICO; we’d appreciate the chance to resolve concerns first.
Our services are not intended for individuals under 16. We do not knowingly collect data from children.
When we process your clinic’s lead/customer data inside GHL and related tools, our Data Processing Addendum (DPA) applies (confidentiality, sub-processors, security, breach notification, deletion/return of data at end of contract).
We may update this policy periodically. The latest version will always be posted on this page with an updated “Effective date”.
© Outcome Reach Ltd. All rights reserved.
Outcome Reach® is a registered trademark in the United Kingdom.