Privacy Notice

This website privacy policy aims to give you information on how Clinica London and its third parties collect and process personal data when you use our website and when we provide you with our products and services. This website privacy policy will clarify what data we collect and how we will use and share your data. It will help you understand your choices concerning how data is processed.

Our third parties include Mail Chimp and KD Webb.

Any data you provide will be processed when you:

• sign up to our newsletter;
• purchase a service;
• book an appointment to see us via Doctify or another third party;
• take part in a competition;
• complete a survey via Survey Monkey;
• attend an event via Eventbrite or Zoom;
• leave a review on Trustpilot; or
• contact us via our social media channels Facebook and Instagram.

This website maybe used by children and therefore, we may collect data relating to children.

A child is a person under the age of 18 years old. Please see our children’s privacy policy for further details of how we process child personal data.

It is important that you read this website privacy policy before using this website and ordering our services, together with any other privacy policy we provide on specific occasions when we are collecting or processing personal data so that you are fully aware of how and why we are using your data. This website privacy policy supplements our other policies and is not intended to override them.

• Data Protection Officer

We have appointed a data protection officer who is responsible for overseeing questions in relation to this website privacy policy. If you have any questions about this website privacy policy, including any requests to exercise your legal rights, please contact the Data Protection Officer (“DPO”) using the details set out below.

• Contact details

Full name: Karen Lewis

Email address: secretary@ClinicaLondon.co.uk

Postal address: 140 Harley Street London, W1G 7LB.

Telephone number: 0207 935 7990

You have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO“), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

• Changes to this website privacy policy and your duty to inform us of changes

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

• Third-party links and links to Social Networking
• Our website may include links to third-party websites, plug-ins and applications. Clicking on the links or enabling those connections may allow third parties to collect or share data about you.

Our services may contain links to social networking websites and other third party mobile applications. These are operated and controlled by third parties. We always endeavour to link to reputable websites that share our high data privacy standards however, we cannot take responsibility for any content or privacy practices deployed by third party websites, as we do not control them. When you leave our website, please read the privacy policy of every website you visit.

Any personal data you provide to any third parties will be collected by them and not by us. You will be subject to that third party’s privacy policy, rather than ours.

Personal data, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender;
• Contact Data includes billing address, delivery address, email address and telephone numbers;
• Financial Data includes bank account and payment card details;
• Health Data includes your health and GP records, NHS records, BUPA or private records, any doctors and medical practitioners notes or records, all information regarding your health, medications you have or continue to take and any treatments undertaken in the NHS or privately;
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us;
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website or if you access this website via your mobile device, mobile device identifier information;
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses;
• Usage Data includes information about how you use our website, products and services, your shopping cart information and adverts;
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences;
• Third Party Usage Data includes information obtained about you from a third party or third party website, including your name and contact data, live chat data, marketing data, data from completing and applying for third party offers, applications, forms, interaction by you on social media platforms, products and services which may be offered to you via third parties based on analytical information obtained by us.

We collect Special Categories of Personal Data (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data).

We collect information about criminal convictions and offences.

Failure to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case.

We use different methods to collect personal data including by:

• Direct interactions: You may give us your Identity, Contact and Financial Data or Special Categories of Personal Data by filling in forms or by corresponding with us by post, phone, and email or otherwise. This includes personal data when you:
• apply to buy our services, including when you purchase these via our website or by completing our website patient forms;
• request an appointment via KD Webb or by booking a consultation on our website;
• request an appointment via Doctify;
• request to be added to our patient list on Mail Chimp;
• contact us via our social media platforms Facebook and Instagram;
• subscribe to our service or publications;
• enter a competition, promotion or survey via Survey Monkey; or
• attend an event on Eventbrite;
• attend an event on Zoom;
• give us feedback via Trustpilot or by contacting us directly;
• requesting Third Party Usage Data to be sent to us; and
• interacting with our blog or social media pages on our website.
• Automated technologies or interactions: As you interact with our website, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs, service log files and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies.
• Third parties or publicly available sources: We may receive personal data such as Third Party Usage Data or Health Data from various third parties including the NHS, Private health care providers such as BUPA, other medical professionals and practitioners involved in your care;
• Public Forums: Our website may provide publicly accessible blogs, message boards, and community forums. Any information provided or contributed to in these public areas may be read, commented on, collected and used by others who access them;
• Third parties’ use of your data: Identity Data, Contact Data, Health Data or Third Party Usage Data collected by us may be sent to a third party or a third party website. Personal Data may be sent when you request for us to contact you or when you accept a third party offer, application or feature including live chat or by interacting with our social media pages Facebook or Instagram.

Additional personal data may be forwarded to us from a third party in connection with the personal data we collect through your use of our services. This is in order to enhance our services to focus particular content we provide and to offer various offers and opportunities available to purchase products or services that we feel may be of interest to you, based upon the analytical information we have collected;

Technical Data from the following parties:

• analytics providers such as Google based inside the UK;
• advertising and marketing networks such as Mail Chimp, KD Webb, Survey Monkey, Trustpilot, based inside the UK;
• social media networks such as Facebook and Instagram based inside the UK; and
• search information providers based inside the UK;
• Contact, Financial and Transaction Data from providers of technical, payment and delivery services such as i.e. Stripe based inside the UK;
• Identity and Contact Data from data brokers or aggregators based inside the UK;
• Identity and Contact Data is held by Mail Chimp and KD Webb based in the UK; and
• Identity and Contact Data from publicly available sources such as Companies House and the Electoral Register based inside the UK.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you to engage our services;
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override our interests; and
• Where we need to comply with the law or a regulatory obligation.

We do not always rely on consent as a legal basis for processing your personal data. We may obtain your consent before processing Special Categories of Personal data and we will get your consent when sending any third party direct marketing communications via email or text message. You have the right to withdraw consent to marketing at any time by contacting us.

• Purposes for which Clinica London will use your personal data

We have set out below a description of all the ways we plan to use your personal data and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Please note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we use your data. Please contact our DPO if you need details about any specific legal ground we rely on to process personal data.

Table 1

• Marketing
  • We aim to provide you with choices when we use your data for marketing and advertising purposes. We have instructed Mail Chimp and KD Webb to retain your Identity and Contact information to enable us to contact you to provide you with updated information on our products and services. You can opt out of receiving our marketing information at any time by clicking our unsubscribe icons.
  • We will get your express opt-in consent before we share your personal data with a third party for direct marketing purposes.
  • You can ask us to stop sending you marketing messages at any time by contacting us. Where you opt out of receiving these marketing messages, this will not apply to personal data you have provided us with from a product or service purchase.
• Change of purpose

We will only use your personal data for the purposes which we have collected it for, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We may process your personal data without your knowledge or consent where this is required or permitted by law.

We may share your personal data with the parties set out in this clause below for the purposes set out in Table 1 above.

• External Third Parties (as set out in the Glossary); and
• Third parties to whom we may choose to sell, transfer or merge parts of our business or assets. Alternatively, we may seek to acquire other businesses or merge with them.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

You can set your browser to refuse all or some browser cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.

We do not transfer your personal data outside the UK.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. Our IT security company is BlueCube IT Services and they can be found at: https://Bluecube.tech

We have put in place procedures to deal with any suspected personal data breach and will notify you of a breach where the law requires us to do so.

We will only retain your personal data for as long as necessary to fulfil the purposes we have collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements, in accordance with our data retention policy. By law we will also have to keep basic information about our patients for six years after they cease being patients for tax purposes.

In some circumstances you can ask us to delete your data and we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information in accordance with our data retention policy.

You will not have to pay a fee to access your personal data when you raise a data subject access rights request. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We may also refuse to comply with your request in these circumstances.

• We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
• We aim to respond to data subject access rights requests within one month. Occasionally it may take us longer than a month to respond if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

• Service providers based in the United Kingdom who provide IT services;
• Mail Chimp, KD Webb, Survey Monkey, Doctify, Trustpilot, Zoom, and BlueCube IT;
• Clinica London’s external security company, external IT managed and cyber security company, external staff, or agency staff;
• Professional advisers including lawyers, bankers, auditors and insurers based in the United Kingdom who provide consultancy, banking, legal, insurance and accounting services;
• HM Revenue & Customs, regulators and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances;
• Recipients of Clinica London London, including affiliates and other companies worldwide, including unaffiliated agents, suppliers or manufacturers; and
• Service providers which perform certain tasks including: marketing campaigns, location services, website analysis applications, marketing companies and social commerce services such as forum reviews and ratings services.
  • Your legal rights:
  • Request access to your personal data (“commonly known as a data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check we are lawfully processing it.
  • Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information about you corrected.
  • Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us to continue to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
  • Object to processing of your personal data where we are relying on legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
  • Request the restriction of processing of your personal data this enables you to ask us to suspend the processing of personal data about you, for example if you want the accuracy or the reason for processing of your personal data to be established.
  • Request the transfer of your personal data to another party.

Withdraw of consent at any time – where we are relying on consent to process your personal data this will not affect the lawfulness of any processing carried out before you may have withdrawn your consent. If you do withdraw your consent at any time, we may not be able to provide certain products or services.

If you want to review, verify, correct or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact our DPO.