Privacy Policy

Last Updated: March 2026

Introduction

Highgate Medical Ltd ("myprivate.clinic," "we," "us," or "our") processes your personal data in accordance with the Data Protection Act 2018 and the UK General Data Protection Regulation ("UK GDPR") (together referred to as Data Protection Legislation).

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services.

Definitions

• Personal Data: Information that identifies you or relates to you, such as your name, contact details, date of birth, or medical history.
• Special Category Data: Sensitive personal data, including information about your health, medical treatment, racial or ethnic origin, religious beliefs, or sexual orientation.
• Processing: Any action taken with personal data, including collection, storage, sharing, amendment, or deletion.

Our Responsibilities

Highgate Medical Ltd is the data controller for the personal data you provide. We have appointed Dr Faizal Secretary as our Data Protection Lead, who oversees compliance with Data Protection Legislation and responds to data protection requests.

You can contact us at:
Email: hello@myprivateclinic.co.uk
Address: Fatima Health Centre, Garstang Road, Preston, PR2 9QB

Why We Process Your Personal Data

We process your personal data to:

• Provide healthcare services you request
• Manage appointments, prescriptions, investigations, and follow-up care
• Maintain accurate clinical records
• Fulfil contractual obligations
• Comply with legal and regulatory requirements
• Improve patient care and service quality

What Personal Data We Process

Patients

• Identity Data: Name, date of birth, gender
• Contact Data: Address, email, telephone number
• Medical Data: Consultation notes, diagnoses, medications, investigations, and test results

Suppliers

• Identity Data: Name, job title, organisation
• Contact Data: Business address, email, phone number
• Financial Data: Payment and invoicing details

Candidates

• Identity Data: Name and contact details
• Background Data: Education, work history, qualifications, and skills

Legal Basis for Processing

We process personal data under the following lawful bases:

• Performance of a contract (Article 6(1)(b))
• Compliance with legal obligations (Article 6(1)(c))
• Legitimate interests in delivering safe and effective healthcare (Article 6(1)(f))

Where we process health data, we rely on Article 9(2)(h) — processing necessary for medical diagnosis and the provision of health or social care. We may request consent in limited circumstances, but clinical record processing is generally required for healthcare delivery.

Third-Party Processors

We may share your personal data with trusted third parties where necessary, including:

• External diagnostic laboratories and medical specialists
• Semble, our Electronic Patient Record (EPR) provider, for secure clinical record storage
• Heidi Health, which provides transcription services to convert audio into clinical notes
• SignatureRx, for electronic prescription services
• Other regulated providers involved in your care

Heidi Health Processing: Audio is processed securely on UK-based AWS servers and pseudonymised. Audio is deleted within 7 days. Pseudonymised text may be processed by Anthropic under Standard Contractual Clauses (SCCs).

International Data Transfers

Some pseudonymised transcription data processed by Heidi Health may be transferred outside the UK/EEA. Where this occurs, transfers are protected using Standard Contractual Clauses (SCCs) and appropriate safeguards under UK GDPR.

Data Security

We take patient confidentiality seriously and use appropriate safeguards including encryption, access controls, secure clinical systems, and staff confidentiality obligations. All processing is carried out in accordance with our Information Security policies.

Data Retention

• Adult clinical records are typically kept for at least 8 years after the last entry
• Children's clinical records are retained until the patient's 25th birthday, or longer where required
• Transcription audio processed by Heidi Health is deleted within 7 days
• Non-clinical records (e.g., enquiries or supplier records) are retained only as long as needed for business or legal purposes

After retention periods expire, data is securely deleted or destroyed.

Cookies Policy

We use cookies to ensure website functionality, understand how visitors use our website, and improve user experience. Cookies may include:

• Essential cookies required for the operation of the website
• Analytical cookies, including Google Analytics, which helps us understand website traffic and usage patterns
• Preference cookies to remember user settings

Google Analytics may collect anonymised information such as pages visited, time spent on the site, and device/browser type. You can manage cookie settings through your browser or our cookie consent banner. Disabling cookies may affect website performance.

Your Rights

Under Data Protection Legislation, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion (in certain circumstances)
• Restrict processing
• Receive your data in a portable format
• Object to processing based on legitimate interests
• Withdraw consent where consent is relied upon

To exercise your rights, contact: hello@myprivateclinic.co.uk

Right to Complain

You also have the right to lodge a complaint with the UK regulator:
Information Commissioner's Office (ICO)
Website: www.ico.org.uk

Data Breach Notification

If a personal data breach poses a risk to your rights and freedoms, we will notify affected individuals, the ICO, and relevant processors within 72 hours, where required.

Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in law or our practices. The latest version will always be available on our website.

Contact Us

Highgate Medical Ltd
Email: hello@myprivateclinic.co.uk
Address: Fatima Health Centre, Garstang Road, Preston, PR2 9QB