Privacy Policy

1Introduction

The Heart Clinic (Bedfordshire) Ltd, trading as "The Heart Clinic" ("we", "us", "our"), is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store, share and protect information about you when you visit our website, contact us, or use our cardiac diagnostic services.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our website or services, you acknowledge the practices described in this policy.

2Who We Are

The Heart Clinic (Bedfordshire) Ltd provides private cardiac diagnostic services across Luton, London, Bedfordshire, Hertfordshire and Buckinghamshire. We are the data controller responsible for your personal data.

• Registered name: The Heart Clinic (Bedfordshire) Ltd
• Email: info@theheart.clinic
• Phone: +44 7853 215671
• Data Protection Lead: available via the contact details above

3Information We Collect

We may collect the following categories of information:

Information you give us

• Name, date of birth, address, email address and telephone number
• Appointment and booking details
• Medical history, symptoms and health information relevant to your test or referral
• GP or referring clinician details, where applicable
• Payment and billing information
• Communications you send us (email, phone, chat, contact forms)

Information collected automatically

• IP address, browser type and device information
• Pages visited, time spent on our website and referring pages
• Cookie data (see our Cookie Policy)

4How We Use Your Information

We use your information to:

• Book, manage and deliver your cardiac diagnostic appointment
• Produce, review and share diagnostic reports with you and, where applicable, your GP or referring clinician
• Communicate with you about appointments, results and follow-up care
• Process payments and manage billing
• Improve our website, services and patient experience
• Meet our legal, regulatory and clinical governance obligations
• Send service updates or marketing communications where you have consented to receive them

5Our Legal Basis for Processing

We rely on the following legal bases under UK GDPR:

• Contract: to provide the diagnostic services you have booked
• Consent: for marketing communications and certain cookies
• Legal obligation: to meet clinical record-keeping and regulatory requirements
• Legitimate interests: to run and improve our business and website securely
• Vital interests / health or social care purposes: for the processing of health data in connection with your care

6Special Category (Health) Data

As a cardiac diagnostics provider, we process special category health data, including test results, medical history and clinical notes. This data is processed by qualified clinicians and physiologists under a duty of confidentiality, and is used solely for the purposes of providing your diagnostic care, clinical governance and, where legally required, safeguarding.

Access to your health records is restricted to authorised clinical and administrative staff who need it to carry out their role.

7How We Share Your Information

We do not sell your personal data. We may share information with:

• Your GP or referring clinician, with your consent or as clinically necessary
• Consultant cardiologists and clinical staff involved in reviewing or reporting on your results
• Registered partner clinics who facilitate services during our CQC registration period
• IT, hosting, payment processing and appointment-scheduling providers acting on our instructions
• Regulators and authorities, where required by law
• Corporate or occupational health clients, only where you have booked through that referral pathway and consented to results being shared

8Data Retention

We retain personal and clinical data for as long as necessary to fulfil the purposes described in this policy, and in line with applicable clinical record-keeping guidance (which for adult medical records is typically a minimum of eight years). Website and marketing data is retained only for as long as needed for those purposes, or until you withdraw consent.

9Your Rights

Under UK GDPR, you have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request erasure of your data, subject to our legal and clinical record-keeping obligations
• Object to or restrict certain processing
• Request data portability, where technically feasible
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, please contact us using the details below.

10Cookies

Our website uses cookies to operate correctly, understand how visitors use our site, and support live chat functionality. Full details of the cookies we use and how to manage them are set out in our Cookie Policy.

11Data Security

We use appropriate technical and organisational measures to protect your personal and health data against unauthorised access, loss, misuse or alteration, including secure hosting, access controls and staff confidentiality obligations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12International Transfers

Where any of our service providers process data outside the UK, we ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses, to protect your data to UK GDPR standards.

13Children's Privacy

Our services are intended for adults. Where a minor's data is processed, this is done with the consent of a parent or legal guardian and in accordance with applicable safeguarding requirements.

14Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "last updated" date at the top of this page indicates when it was last revised. We encourage you to review this page periodically.

15Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please get in touch: