Privacy Policy

Who we are

This privacy policy explains how His & Her Health collects, uses, and protects your personal data when you visit this website, get in touch, or become a patient of the practice.

The data controller for the purposes of UK GDPR and the Data Protection Act 2018 is the practice's registered legal entity name and addressPending confirmation.

What data we collect

We collect different data depending on how you interact with us:

• Enquiries and contact form submissions - name, email address, phone number, and any message you send us, plus the date and time of your consent to be contacted.
• Patient records - once you become a registered patient, we hold appointment details, care-related records, and results summaries relevant to your treatment.

Our lawful basis for processing

• Enquiries and marketing contact: your explicit, freely-given consent, captured at the point you submit an enquiry form. We record the timestamp of your consent and the version of this policy you agreed to, and you can withdraw consent at any time.
• Patient care: processing necessary for the performance of a contract for your care, our legitimate interest in running a safe and effective clinic, and - in urgent situations - the protection of your vital interests.

How we use your data

We use your data to respond to enquiries, book and manage appointments, deliver clinical care, meet our legal and regulatory obligations, and - only where you have consented - to send you relevant information about our services.

How long we keep your data

We keep personal and patient data only for as long as necessary for the purposes it was collected, including to meet professional, legal, and regulatory record-keeping requirements. A detailed retention schedule is to be finalised and published by the practicePending confirmation.

Who we share your data with

Your data is only accessible to clinical and administrative staff on a need-to-know basis. We do not share your data with third parties for their own marketing purposes. We may share limited data where required by law, to comply with a court order, or to protect someone's safety, including under our safeguarding obligations - see our Safeguarding policy.

How we protect your data

Access to patient records in our systems is restricted by role-based access control, so only staff who need to see a record for a legitimate purpose can do so. Every access to a patient record is recorded in an audit log.

Your rights

Under UK GDPR, you have the right to:

• be informed about how your data is used;
• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• request erasure of your data, in certain circumstances;
• request that we restrict processing of your data;
• receive a copy of your data in a portable format;
• object to processing based on legitimate interest or for marketing; and
• complain to the Information Commissioner's Office (ICO) if you believe your data has been mishandled.

Cookies

This website uses cookies. See our Cookie Policy for full details of what we use and how you can control them.

Children's data

We do not knowingly collect personal data from children through this website's public enquiry forms. Where a child becomes a patient of the practice, their data is handled in line with our clinical safeguarding responsibilities and with appropriate parental or guardian consent.

Contact us about privacy

For any question about this policy or to exercise your rights, contact our Data Protection Officer / Information Governance lead: DPO / Information Governance contact name, email, and postal addressPending confirmation.