Why we collect your data & our legal Basis

Last updated: 26th May 2026

When you supply your personal details to The Chiltern Clinic they are stored and processed for 3 reasons:

1. Providing Clinical Treatment (Medical Records) We need to collect personal information about your health in order to provide safe, effective treatment. Your request for treatment and our agreement to provide that care constitutes a contract. You can, of course, refuse to provide the information, but we cannot treat you without it.

• Legal Basis for Personal Data: Article 6(1)(b) – Processing is necessary for the performance of a Contract to provide your care.

• Legal Basis for Health/Special Category Data: Article 9(2)(h) – Processing is necessary for the provision of Health or Social Care Treatment.

2. Appointment Management & Administrative Contact. We may contact you to confirm appointments, send reminders, or update you on matters directly related to your medical care. 

• Legal Basis: Article 6(1)(b) – Necessary for the performance of a Contract (managing your healthcare service).

3. General Health Information and Newsletters.  From time to time, we may wish to send you general health information in the form of articles, advice or newsletters.

• Legal Basis: Article 6(1)(a) – Consent.

Your Rights: you may withdraw this consent at any time – just let us know by any convenient method.

Why we store your data, How we store it, How long we keep it

We have a legal obligation to retain your records for a minimum 8 years after your most recent appointment (or age 25, if this is longer), but after this period you can ask us to delete your records if you wish. Otherwise, we may retain your records longer where clinically necessary, legally required, or where it is in our legitimate interests to maintain continuity of care.

Your records are stored:

• on paper, in locked filing cabinets, and the offices are always locked out of working hours.

• electronically: Data is stored securely using password-protected and access-controlled systems, and the passwords are changed regularly.

We may also have copies of letters sent to your GP or other agencies stored on our computers. These too are stored with a password.

Who Are We Going to Tell?

We will never share your data with anyone who does not need access unless we have your written consent.

Only the following people/agencies will have routine access to your data:

• Your practitioner(s) in order that they can provide you with treatment.

• Reception staff, because they organise our practitioners’ diaries, and coordinate appointments and reminders.

Occasionally, we may have to employ consultants to perform tasks which might give them access to your personal data (but not your medical notes). We will ensure that they are fully aware that they must treat that information as confidential, and we will ensure that they sign a non-disclosure agreement.

We will not share your clinical information with your GP or other medical specialists unless we have your explicit verbal or written consent, except in rare emergencies where we are legally required to do so to protect your vital interests.

You have the right to see what personal data of yours we hold, and you can also ask us to correct any factual errors. Provided the legal minimum period has elapsed, you can also ask us to erase your records.

Your Rights

Under UK data protection law, you have the following rights:

• Right of Access: You can ask to see a copy of the personal data and medical records we hold about you.

• Right to Rectification: You can ask us to correct any factual errors in your data.

• Right to Erasure: You can ask us to delete your records, provided the legal minimum retention period (8 years, or age 25 for minors) has passed.

• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time.

Website - what will we collect?

When you contact us through our website, we may collect your name, telephone number, email address, and any information you provide in your enquiry. We use this information only to respond to your enquiry or provide information about our services.

• Legal Basis: Article 6(1)(b) – Necessary to take steps at your request prior to entering into a contract for services.

Please see our Cookie Policy for information about how cookies are used on this website.

Age

Our website is intended for users aged 16 and over unless supervised by a parent or guardian.

Links to External Sites

Our website may contain links to external websites. We are not responsible for the privacy policies, content, or security of third-party websites. We encourage users to review the privacy policies of any external sites they visit.

Complaints

We want you to be absolutely confident that we are treating your personal data responsibly, and that we are doing everything we can to make sure that the only people who can access that data have a genuine need to do so.

Of course, if you feel that we are mishandling your personal data in some way, you have the right to complain. Complaints need to be sent to what is referred to in the jargon as the “Data Controller”. Here are the details you need for that:

info@thechilternclinic.co.uk

The Chiltern Clinic, Fennels Lodge

St Peters Close, Loudwater, High Wycombe, HP11 1JT

If you are not satisfied with our response, then you have the right to raise the matter with the Information Commissioner’s Office.

• Authority: Information Commissioner’s Office (ICO)

• Website: ico.org.uk

• Helpline: 0303 123 1113