Privacy Policy | Mr Andrew Douglas

Mr Andrew Douglas and his representatives (“we”, “us”, “our”) are committed to protecting the privacy and confidentiality of our patients’ personal information. This notice explains how we collect, use, store and share your information when you use our services.

Information we collect

We may collect and use:

Your name, date of birth, address, contact details and identification details.
Appointment, referral, billing and payment information.
Health information, including medical history, symptoms, diagnoses, treatments, test results, prescriptions and clinical correspondence.
Information from your GP, other healthcare professionals, insurers, family members or carers where appropriate.
Communications with us, including emails, calls and feedback.
Technical information if you use our website, such as IP address, device information and cookie data.

Health information is “special category” personal data and receives additional protection.

Why we use your information

We use your information to:

Register you as a patient and arrange appointments.
Assess, provide and manage your medical care.
Communicate with you about your care, including appointment reminders.
Liaise with other healthcare professionals involved in your care.
Process payments, insurance claims and administrative matters.
Meet legal, regulatory, safeguarding, professional and clinical-record obligations.
Manage complaints, incidents, quality assurance and service improvement.
Protect patients, staff and others from harm.
Send marketing communications only where permitted by law and, where required, with your consent.

We do not make solely automated decisions that have legal or similarly significant effects on you.

Our legal basis for using your information

Under UK data protection law, we rely on one or more of the following legal bases:

Performance of a contract: where processing is necessary to provide services you have requested.
Legitimate interests: for the effective and secure operation of our practice, provided your rights and interests do not override ours.
Legal obligation: where we must comply with a legal or regulatory requirement.
Vital interests: where necessary to protect someone’s life.
Consent: for specific purposes where consent is the appropriate basis, such as certain marketing communications.

For health information, we normally rely on the UK GDPR condition allowing processing necessary for preventive or occupational medicine, medical diagnosis, provision of health or social care, or management of health or social-care systems, subject to professional duties of confidentiality. We may also rely on explicit consent, legal claims, substantial public interest, or vital interests where applicable.

You may withdraw consent at any time where we rely on it. Withdrawal will not affect processing already carried out lawfully.

Who we share information with

We share information only when necessary and appropriate. This may include:

Clinicians, laboratories, imaging providers, pharmacies and other healthcare providers involved in your care.
Your GP or referring clinician, unless you ask us not to and there is no overriding legal, clinical or safeguarding reason to share.
Health insurers or payment providers where relevant to your treatment or claim.
Our carefully selected service providers, such as clinical-record, IT, communications and secure-storage providers.
Professional advisers, regulators, insurers and auditors.
Police, courts, safeguarding bodies or other authorities where required or permitted by law.

All staff and providers are required to keep your information confidential and secure.

International transfers

Where a service provider processes personal data outside the UK, we will ensure appropriate safeguards are in place, such as an adequacy regulation or approved contractual safeguards.

How long we keep information

We retain clinical records for the period required by applicable law, professional guidance and our retention schedule. Other information is retained only for as long as necessary for the purpose for which it was collected, including legal, accounting and reporting requirements.

You may request further information about our retention periods by contacting us.

Your rights

Subject to applicable law, you have the right to:

Request access to your personal information.
Request correction of inaccurate or incomplete information.
Request erasure of information in certain circumstances.
Request restriction of processing in certain circumstances.
Object to processing based on legitimate interests.
Request transfer of information you provided to us, where applicable.
Withdraw consent where processing is based on consent.
Object at any time to direct marketing.

Some rights may be limited where we have a legal, regulatory or professional obligation to retain or use your information, including clinical records.

To exercise your rights, contact us using the details above. We may need to verify your identity before responding.

Security

We use appropriate technical and organisational measures to protect your information from loss, misuse, unauthorised access, alteration or disclosure. Access to clinical information is limited to people who need it for legitimate care or practice purposes.

Complaints

Please contact us first if you have a concern about how we use your information.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

Changes to this notice

We may update this privacy notice from time to time. The latest version will be available here.

Last updated: 29th June, 2026