Privacy policy

Who I am

[Practice legal name] runs the private practice of Dr Brinda Christopher, Consultant in Sport and Exercise Medicine, at The Shard, 32 St Thomas Street, London SE1 9BS. In this policy, “I” and “me” mean Dr Christopher and the practice.

[Practice legal name] is the data controller for the personal information described here. That means it decides how the information is used and is responsible for protecting it. The practice is registered with the Information Commissioner’s Office (ICO), registration number [ZA000000]. [Company number [00000000], registered office [address], if the practice is a limited company.]

I handle personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a doctor registered with the General Medical Council, I also have a professional duty of confidentiality to every patient.

What I collect

Contact and identity details

Your name, date of birth, address, telephone number and email address, and your GP’s details. If you give them, the name and number of someone to contact in an emergency.

Health information

Your medical history and symptoms, examination findings, scan and test results, letters to and from other clinicians, your treatment plan, and the notes I make at each consultation. Health information is “special category data” under UK GDPR and has extra protection.

Payment and insurance details

Self-pay appointments are paid through Carebit, my booking and practice management system, using its card payment provider. I don’t see or store your full card number. For insured appointments, I record your insurer, membership number and authorisation code. The next-working-day review is self-pay only and never asks for insurance details.

Messages

Emails, website enquiry forms, WhatsApp messages and notes of telephone calls with the clinic.

Website use

If you accept analytics cookies, Google Analytics records how pages on this site are used. It does not tell me who you are. The cookie policy explains this in full.

How I use it

• To assess, diagnose and treat you, and to keep an accurate medical record.
• To arrange appointments and contact you about them.
• To write to your GP and to other clinicians involved in your care, such as a physiotherapist, radiologist or surgeon.
• To deal with your insurer if your care is insured.
• To take payment and keep the practice’s accounts.
• To reply to enquiries, including ones that don’t lead to an appointment.
• To meet my legal and professional duties, including to the General Medical Council and [the Care Quality Commission].

I don’t use your information for marketing, I don’t sell it, and I don’t make decisions about you by automated means.

Lawful bases

Data protection law requires a lawful basis for each use of personal information, and an extra condition for health information.

Providing your care

Article 6(1)(b), a contract with you or steps you ask me to take before one. For health information, Article 9(2)(h), the provision of health care by a health professional bound by confidentiality, with the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2.

Insured care

Article 6(1)(b) and Article 9(2)(h). I share only what your insurer needs to authorise and pay for the care you have asked it to fund.

Keeping records

Article 6(1)(c), legal obligation, for medical and financial records I am required to keep.

Replying to enquiries

Article 6(1)(f), legitimate interests in running the practice and answering the people who contact it. If an enquiry includes health information, Article 9(2)(h).

Legal claims

Article 9(2)(f), where information is needed to establish or defend a legal claim, for example with my medical defence organisation.

Emergencies

Article 6(1)(d) and Article 9(2)(c), vital interests, if you are seriously unwell and can’t give consent.

Analytics cookies

Article 6(1)(a), your consent, given through the cookie banner as the Privacy and Electronic Communications Regulations (PECR) require.

Who I share it with

People involved in your care

Your GP and other clinicians who treat you, imaging and test providers, and your insurer if your care is insured. I tell you before I write to your GP. If you’d prefer me not to, I’ll respect that unless there is a safety reason, which I’ll discuss with you first.

Service providers who act on my instructions

These organisations process information for the practice under a written contract. They can only use it to provide their service to me.

• Carebit: online booking, payments, medical records and clinical letters.
• [Carebit’s card payment provider]: card payments.
• [Email provider]: the practice’s email.
• [Form provider]: the website enquiry form.
• [Website host]: hosting this website.
• Google: website analytics, only if you accept analytics cookies.

Others, when the law requires it

My accountant [name of firm] receives financial records but not clinical notes. I may also share information with my medical defence organisation [name], with regulators such as the General Medical Council, or where a court order or safeguarding duty requires it.

WhatsApp

If you choose to message the clinic on WhatsApp, the content is end-to-end encrypted, but WhatsApp (Meta) processes some information about your account. I copy anything clinically important into your record and delete the chat after [30 days]. Please don’t send images by WhatsApp unless I ask for them.

Where it is stored

Your medical record is stored on Carebit’s servers in [the United Kingdom]. My other providers store data in the UK or the European Economic Area, which the UK recognises as protecting personal data adequately.

If a provider transfers data outside these areas, for example Google to the United States, I rely on the UK’s adequacy regulations, including the UK-US data bridge, or on the International Data Transfer Agreement, together with the provider’s own security measures.

How long I keep it

I keep records for the periods in the Records Management Code of Practice for Health and Social Care, which sets out how long health records should be kept in England.

• Adult medical records: [8 years] after your last appointment.
• Records of children and young people: until the patient’s [25th] birthday, or [26th] if they were 17 when treatment ended, and in any case at least [8 years] after the last appointment.
• Financial and payment records: [6 years] after the end of the financial year they relate to.
• Enquiries that don’t lead to an appointment: [12 months].
• Website analytics: [14 months].

I keep a record longer only if it is needed for a complaint or legal claim. At the end of the period it is securely deleted or destroyed.

Keeping it secure

Records are held in Carebit’s secure system, with access protected by passwords [and two-factor authentication]. Only people who need your information to do their job can see it, and they are bound by confidentiality. [Paper records, if any, are scanned and then securely shredded.] If a breach ever put your information at risk, I would report it to the ICO within 72 hours where the law requires, and tell you if it was likely to affect you significantly.

Your rights

You have the right to:

• Get a copy of your information, including your medical record. This is called a subject access request. It is free, and I reply within one month.
• Ask me to correct information that is wrong or incomplete.
• Ask me to delete information. Medical records usually can’t be deleted before the end of the retention period, because I have a legal and professional duty to keep them, but I’ll explain if that applies.
• Ask me to limit how I use your information, or object to a use based on legitimate interests.
• Receive information you gave me in a format you can pass to another provider.
• Withdraw consent at any time where I rely on it, such as for analytics cookies.

To use any of these rights, email [privacy@drbrindachristopher.co.uk] or write to the practice at the address above. I may ask you to confirm your identity first.

Cookies

This website uses cookies that are strictly necessary for it to work, and analytics and video cookies only if you agree. The cookie policy lists every cookie and explains how to change your choice.

Complaints

If you’re unhappy with how I’ve handled your information, please tell me first and I’ll try to put it right. You can also complain to the Information Commissioner’s Office:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone 0303 123 1113, or online at ico.org.uk/make-a-complaint.