Privacy Notice

Our Clinic — Patient Data Protection Notice

This notice is issued by the clinic as Data Controller. For how Pulse Health Ltd processes platform account data, see the Platform Privacy Policy.

1. Who We Are

Our Clinic is committed to protecting your personal data. This privacy notice explains how we collect, use, store, and share your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Data We Collect

We collect the following categories of personal data:

  • Identity Data: Name, title, date of birth, NHS number
  • Contact Data: Address, email, phone number, emergency contacts
  • Health Data: Medical history, treatment notes, clinical records, prescriptions
  • Financial Data: Invoice records, payment history (card details are processed securely by payment providers and not stored as full PAN by the clinic systems)
  • Technical Data: IP address, browser type (for system security only)
  • Communication Data: Appointment reminders, follow-up messages, satisfaction surveys

3. Lawful Basis for Processing

  • Legitimate Interest / healthcare purposes: Providing clinical care and treatment
  • Contract: Billing, invoicing, and payment processing
  • Legal Obligation: Regulatory and record-keeping requirements
  • Consent: Marketing communications and optional surveys (you can withdraw consent at any time)

4. How We Use Your Data

  • Providing clinical treatment and care
  • Managing appointments, bookings, and waitlists
  • Generating invoices and processing payments
  • Sending appointment reminders via SMS and email
  • Clinical record keeping and treatment planning

5. Processors

We use Pulse Health Ltd as our practice management platform provider (Data Processor). Other processors may include payment, SMS, and email providers under appropriate agreements.

6. Data Retention

We retain clinical records in line with applicable professional guidance (commonly up to 8 years from last attendance unless a longer period is required). Financial records may be retained for HMRC compliance.

7. Your Rights

Under UK GDPR you may have rights of access, rectification, erasure, portability, restriction, and objection. To exercise rights, contact us or speak to reception.

8. Complaints

You may lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk

9. Updates

This notice was last reviewed on 3 September 2026.