Privacy Policy

We collect different types of personal information depending on how you interact with us:

Information you provide directly:

• Name, date of birth, and contact details (email, phone, address)
• Medical history, symptoms, and health-related information
• Insurance details and billing information
• Emergency contact information
• Information provided through our contact and booking forms

Information collected automatically:

• IP address and browser type
• Pages visited and time spent on our website
• Referring website and search terms
• Device type and operating system
• Cookie data (see our Cookie Policy for details)

We use the personal data we collect for the following purposes:

• Providing and managing your medical care and treatment
• Scheduling and managing appointments
• Communicating with you about your care, including appointment reminders
• Processing payments and managing billing
• Responding to your enquiries and providing customer support
• Fulfilling our legal and regulatory obligations
• Improving our services and website through anonymised analytics
• Sending you relevant health information (with your consent)

Under UK GDPR, we process your personal data based on one or more of the following legal grounds:

• Consent: You have given clear consent for us to process your personal data for a specific purpose (e.g. marketing communications)
• Contract: Processing is necessary for a contract we have with you (e.g. providing medical services)
• Legal obligation: Processing is necessary to comply with the law (e.g. maintaining medical records)
• Vital interests:Processing is necessary to protect your life or someone else's life (e.g. medical emergencies)
• Legitimate interests: Processing is necessary for our legitimate business interests, provided these are not overridden by your rights

For special category data (including health data), we rely on the additional condition that processing is necessary for the provision of healthcare under Article 9(2)(h) of UK GDPR.

We may share your personal data with the following categories of recipients:

• Healthcare providers: Other clinicians involved in your care (e.g. referring GPs, specialists, hospitals)
• Insurance providers: When required for claims processing (with your consent)
• Service providers: Trusted third parties who help us operate our practice (e.g. IT systems, payment processors), bound by strict data processing agreements
• Regulatory bodies: When required by law (e.g. CQC, GMC, public health authorities)

We will never sell your personal data to third parties. Any data sharing is conducted with appropriate safeguards in place.

We retain personal data for as long as necessary to fulfil the purposes for which it was collected, and in accordance with legal and regulatory requirements:

• Medical records:Retained for a minimum of 8 years after the last treatment (or until the patient's 25th birthday, whichever is longer), in line with NHS guidelines
• Financial records: Retained for 7 years in accordance with HMRC requirements
• Website analytics data: Retained in anonymised form for up to 26 months
• Contact form submissions: Retained for up to 2 years unless related to ongoing care

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data (subject to legal retention requirements)
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, commonly used format
• Right to object: Object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact us. We will respond to your request within one month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls and role-based permissions
• Regular security audits and vulnerability assessments
• Staff training on data protection and information security
• Secure data backup and disaster recovery procedures
• Physical security measures at our premises

We may collect and process personal data of children under 16 where we provide healthcare services to them. In such cases, we obtain consent from a parent or guardian, unless the child is deemed competent to provide their own consent (Gillick competence). We apply additional safeguards to the processing of children's data, including restricting access and applying enhanced security measures.

Some of our service providers may process your data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place in accordance with UK GDPR, such as standard contractual clauses or an adequacy decision by the UK Government. We will only transfer data to countries or organisations that provide an adequate level of data protection.

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. Material changes will be communicated through our website. We encourage you to review this policy periodically to stay informed about how we protect your data.