Who I am
The data controller is Mr Haider Jan, trading as MIGynaecology ("I", "me"). I am responsible for deciding how your personal information is used. I am registered with the Information Commissioner's Office (ICO), registration number ZA097255.
You can contact me about anything in this notice through Helen Wood, my private secretary: email pa@migynaecology.com or telephone 07757 310098.
When you are treated at a hospital, that hospital is also a data controller for the records it holds about you, and its own privacy notice applies to those records.
The information I collect
When you use the enquiry form
The enquiry form on the booking page collects:
- your name, telephone number and email address
- the reason for your enquiry, your preferred clinic and, if you choose to tell me, how you heard about the practice
- a brief message, if you write one
- your confirmation that you have read this notice
I ask you not to include detailed medical information in the form. If you do, I will treat it with the same care as the rest of your medical information.
When you contact me or become my patient
If you telephone or email, or become my patient, I collect the information needed to arrange and provide your care: your contact details, date of birth, GP details, insurance details if you are insured, and information about your health, including your medical history, examination findings, scan and test results, and the letters and reports about your care.
If you need to send scans, reports or letters before your appointment, my secretary, Helen, will give you a link to upload them securely to Carebit, the practice management system I use for patient records and letters. Please use the link rather than ordinary email for medical documents.
When you browse this website
This website sets no cookies and does not identify you. Cloudflare, which hosts the website, processes technical information such as your IP address to deliver pages securely and protect the site from attack, and produces anonymous visit statistics from that server traffic; nothing is placed on or read from your device for those statistics. On the booking pages, Cloudflare Turnstile checks that a real person, rather than automated software, is sending the form. It processes technical information about your browser and device for that security purpose only. The cookie notice has more detail.
How enquiries are handled
When you send the enquiry form, your details are sent by email to my secretary, Helen, using Resend, an email delivery service that acts on my instructions. The enquiry is not stored in any database or file on this website; it is kept in the practice's email system for the period set out below. Resend keeps only the delivery records needed to run its service, for a limited period under its data processing agreement.
How I use your information, and the lawful basis
- To reply to your enquiry and arrange an appointment. The lawful basis is that you have asked me to take steps before providing care (UK GDPR Article 6(1)(b)), and my legitimate interest in responding to people who contact the practice (Article 6(1)(f)). If your enquiry, or anything you send before your appointment, includes information about your health, I also rely on Article 9(2)(h) (health care), with the condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, because it is used to assess and arrange your care by a health professional, and staff, bound by a duty of confidentiality. Ticking the box on the form confirms that you have read this notice; it is not the legal basis for using your information.
- To provide your care, including consultations, tests, treatment, letters and follow-up. The lawful bases are the provision of a service you have asked for (Article 6(1)(b)) and, for health information, the provision of health care by a health professional bound by a duty of confidentiality (Article 9(2)(h)).
- To meet legal and professional obligations, such as keeping medical records, responding to regulators and handling complaints (Article 6(1)(c), and Article 9(2)(h) and (f) where relevant).
- To keep the website secure and working (my legitimate interests, Article 6(1)(f)).
I do not use your information for marketing, I do not sell it, and I do not use it to make automated decisions about you.
Who I share it with
I share your information only when it is needed for your care or required by law, and only as much as is necessary:
- the hospital or clinic where you are seen or treated
- your GP, and any specialist or fertility clinic involved in your care, with your agreement
- your insurer, if you are using private medical insurance, so that your treatment can be authorised and paid for
- laboratories and imaging services that carry out your tests
- service providers who act on my instructions under contract: Carebit (practice management, patient records, letters and secure document upload), Cloudflare (website hosting, security, visit statistics and the spam check), Resend (delivery of enquiry form emails), and email and IT providers
- regulators, courts or other authorities, where the law requires it
Transfers outside the UK
Some service providers process information outside the UK. Resend sends enquiry emails from servers in Ireland, in the European Union, which the UK recognises as protecting personal data to UK standards; because Resend is a US company, they may also be processed in the United States. Cloudflare may process technical information in the United States. Transfers to the United States are protected by safeguards recognised under UK law: both companies are certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US "data bridge"), and their data processing agreements also include the UK International Data Transfer Addendum.
How long I keep it
- Enquiries that do not lead to an appointment are deleted within twelve months.
- If you become my patient, your records are kept for the periods set out in the NHS Records Management Code of Practice: normally eight years after your last treatment for adults; 25 years for records relating to pregnancy; and, for anyone treated as a child, until their 25th birthday (or 26th, if they were 17 when treatment ended).
Keeping it secure
Your information is kept confidential and protected by appropriate technical and organisational measures, including encrypted connections to this website, a secure system for patient records and document uploads, and access restricted to those who need it for your care.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the information I hold about you
- ask me to correct information that is inaccurate or incomplete
- ask me to delete information, or to restrict how I use it, in some circumstances
- object to my use of your information where I rely on legitimate interests
- ask for information you have given me to be transferred to another organisation, in some circumstances
- withdraw your consent at any time, where I rely on consent
Some rights are limited for medical records, which I must keep for legal reasons. To use any of these rights, contact my secretary, Helen, using the details above. I will respond within one month, and there is normally no charge.
Complaints
If you are unhappy with how I have handled your information, please tell me first so that I can try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint (opens in a new tab), telephone 0303 123 1113.
Changes to this notice
I review this notice regularly. Any changes will be posted on this page with a new date.
Last updated .