Privacy Notice
Effective Date: [Insert Date]
Introduction
This Privacy Notice explains how I, as your treating clinician and custodian of your personal information, manage and protect your data. This includes information gathered for medical treatment, administration, and related services. I comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and relevant professional guidelines.
About Me
In this Privacy Notice, “I,” “me,” or “my” refers to your clinician and my medical secretarial team. For any privacy queries, please contact me via my medical secretary.
Your Personal Data
As a Data Controller, I collect, use, and store your personal information responsibly. This includes: - Medical information related to your treatment. - Financial data for billing purposes. - Images or other records related to your care.
All personal data is handled according to professional standards, including General Medical Council and British Medical Association guidance.
Use of Clinical Documentation Tools (Heidi Health)
To enhance clinical efficiency and patient care, I use Heidi Health, a secure AI-powered clinical documentation tool. Heidi Health assists with: - Clinical note-taking. - Appointment preparation and follow-up documentation. - Communication and workflow management.
Information processed through Heidi Health is encrypted, securely stored, and handled strictly under UK GDPR and the Data Protection Act 2018. Heidi Health operates solely to support healthcare services and administrative processes as outlined in this Privacy Notice.
Participation in PHIN (Private Healthcare Information Network)
In compliance with the Competition and Markets Authority Private Healthcare Market Investigation Order 2014, I am required to provide PHIN with certain information related to your treatment. This may include: - Your NHS, CHI, or Health and Care Number. - Procedure details, including any complications. - Patient feedback from PROMs surveys.
PHIN uses this information to monitor patient outcomes and quality of care within private healthcare. Any information published by PHIN is anonymised. Data is handled in accordance with UK data protection law and confidentiality obligations. Further information is available at: www.phin.org.uk.
What Personal Information I Collect
This includes: - Name, contact details, occupation, emergency contacts. - Financial information for billing. - Special category data such as: - Physical and mental health information. - Race, ethnicity, religion. - Genetic and biometric data. - Sexual orientation and related information.
Sources of Information
I collect information from: - Direct consultations. - GPs, dentists, hospitals (NHS and private), mental health providers. - Other healthcare professionals and service providers. - Your insurer, employer (if relevant), or government bodies.
Communication Methods
I may contact you via telephone, SMS, email, or post for: - Appointment reminders. - Administrative updates. - Clinical information.
Encrypted email is used for sensitive information where required.
Purposes and Legal Basis for Using Your Information
Your data is processed for: 1. Providing healthcare services. 2. Account settlement and billing. 3. Medical audits and research (with safeguards). 4. Communicating and handling complaints. 5. Updating other healthcare professionals. 6. Legal compliance and regulatory obligations. 7. Business operations and professional advice. 8. Marketing (only with your consent).
Disclosures to Third Parties
Information may be shared with: - Healthcare professionals involved in your care. - Insurance providers. - Regulatory bodies. - IT service providers and auditors. - Government agencies where required.
Where Heidi Health is involved, data is processed in compliance with applicable privacy laws.
Your Rights
You have rights regarding your personal data, including: - Accessing your information. - Correcting inaccurate data. - Requesting deletion (subject to exceptions). - Restricting or objecting to certain uses. - Data portability. - Withdrawing consent. - Filing a complaint with the Information Commissioner’s Office (ICO).
For detailed guidance, visit: https://ico.org.uk
Data Retention
Personal information is retained as long as necessary for medical, legal, or regulatory purposes.
International Data Transfers
If your data is transferred outside the UK/EEA, appropriate safeguards will be implemented.
Updates to This Privacy Notice
This Privacy Notice is reviewed regularly. Any material updates will be communicated via my website or directly to you.
Contact Details
For any questions or to exercise your rights, contact me via my medical secretary at: [Insert Contact Details]
This Privacy Notice was last updated on [15 July 2025].
Susannah Woodrow