1. Who's Looking After Your Data
Aviora Health, a private clinic in Oxfordshire, is what the law calls the "data controller" here. In plain terms, that's us deciding how your data gets used, and us being on the hook for keeping it safe.
2. What We Actually Collect
Depends on how you're in touch with us, but usually it's some mix of:
- Your name, date of birth, address, phone number and email, given when you register or book in
- Medical history, symptoms, test results and treatment notes, taken down during consultations, screenings or procedures
- Payment details, handled securely whenever you pay for something
- Whatever you send us, through the contact form, by email, over the phone
- The odd technical bit like your IP address and browser type, picked up automatically when you're on our site
- Your email, if you've signed up for our Health Insights updates
We only ask for what we actually need, not more than that.
3. Why We Ask for It
Nothing here is collected just because we can. We use your data to:
- Give you safe, accurate GP and dermatology care, diagnosis, treatment, the follow-up after
- Book you in, manage your appointment, and send a reminder if you need one
- Take payment and keep the books straight
- Refer you on to a specialist or another provider when that's the right call
- Get back to you when you've asked us something
- Make the website and our services a bit better over time
- Send you health updates or news from the clinic, only if you've said yes to that
4. Our Legal Basis for Using It
UK GDPR won't let us use your information just because it's handy, there has to be an actual reason. For most of the care we give, that's the contract we've got with you as a patient, and sometimes our legitimate interest in running a clinic properly and safely. Health data sits in a more protected category under the law, so for that, we rely on your explicit consent, or the fact that a qualified professional needs it to treat you. Marketing emails are consent-based too, and you can pull that consent whenever you like.
5. Who Else Sees Your Data
We don't sell it. Never have, never will. But there are times sharing makes sense:
- With specialists or hospitals you're referred to, so your care carries on smoothly
- With your NHS GP, where it's relevant
- With whoever processes our payments, securely
- With the IT and website people who keep aviorahealth.co.uk running
- With regulators like the Care Quality Commission, when the law says we have to
Anyone we share with has their own duty to keep things confidential. Nobody gets your data to go and market to you off the back of it.
6. How Long We Hold On to It
Medical records stick around in line with NHS and professional guidance, generally at least eight years after your last treatment for adults, sometimes longer, records involving children, for instance. Other bits, an enquiry form, a marketing preference, we keep only while it's useful, then it goes.
7. Keeping It Safe
We've got proper measures in place, secure storage, limited access, staff who know what confidentiality actually means in practice. Nothing's completely risk-proof, we know that, but we take it seriously and keep checking our own safeguards hold up.
8. What You Can Do
You've got real say over your own data. Under UK GDPR, you can:
- Ask what we hold on you
- Get something corrected if it's wrong
- Ask us to delete it, where that's legally possible
- Say no to certain uses, marketing, for example
- Ask us to hold off processing your data for a while
- Get a copy of it in a format you can actually use elsewhere
- Pull your consent back at any point, and it won't affect care you've already had
Want to use any of these? Just get in touch. We'll come back to you within the timeframe the law allows, a month, typically.
9. Where Your Data Lives
Mostly in the UK. If it ever needs to go further afield, say, through a cloud provider, we make sure the right protections travel with it, so it's kept to the same standard wherever it ends up.
10. If You're Booking for a Child
We only collect what's needed for their care, nothing extra, and it gets the same level of protection as anyone else's information. We won't take data straight from a child without a parent or guardian involved.
11. If This Policy Changes
We'll update this now and then, a new service, a change in the law, or just tidying up how we've explained something. Check the date at the top if you're ever unsure whether you're reading the latest version.
12. If You Want to Complain
Tell us first. We'd genuinely rather sort it out directly. Still not happy after that? You can take it to the Information Commissioner's Office (ICO), the UK's data protection regulator.