1. Introduction

This privacy notice explains what happens to any personal data you provide to us, or that we collect from or about you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights.

This notice applies to personal information processed by or on behalf of the London Allergy and Immunology Centre (the "Practice", "we", "us", or "our").

2. Who We Are and How to Contact Us

For the purpose of applicable UK data protection legislation (the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018), the Practice is the 'Data Controller' of your personal data.

3. The Information We Collect and Why

We collect and process different types of personal data to provide you with safe, effective healthcare.

• Basic Personal Data: This includes your name, address, date of birth, contact details (phone, email), and emergency contact information.
• Special Category Data (Sensitive & Confidential): This includes detailed information about your health, medical history, symptoms, test results, diagnoses, treatments, and medications. We may also process other special category data, such as ethnicity or sexual orientation, where relevant to your care.

We collect this information directly from you during consultations, via our website booking system, or from other healthcare professionals involved in your care (e.g., your NHS GP, hospitals).

4. Our Lawful Basis for Processing Your Information

Under UK data protection law, we must have a lawful basis to process your personal data.

• For your personal data (e.g., name, contact details): We process this under Article 6(1)(e) of the UK GDPR, which allows processing necessary for the performance of a task in the public interest or in the exercise of official authority.
• For your special category health data: We process this under Article 9(2)(h) of the UK GDPR, which allows processing necessary for medical diagnosis, the provision of healthcare or treatment, and the management of health systems.

5. How We Use Your Information (Purposes of Processing)

Your information is used to ensure you receive the best possible care. Key purposes include:

• Providing clinical consultations, allergy testing, and treatment.
• Maintaining accurate and up-to-date medical records.
• Communicating with you about appointments, test results, and care plans.
• Sharing information, where necessary for your direct care, with other healthcare professionals (e.g., specialists, your GP).
• For safeguarding purposes to protect individuals from harm.
• For practice clinical audit to monitor and improve service quality.

6. How We Keep Your Information Confidential and Secure

We are legally and ethically committed to protecting your privacy. We ensure confidentiality through:

• Legal compliance with the Data Protection Act 2018, UK GDPR, and the Common Law Duty of Confidentiality.
• Robust internal policies and staff training.
• Confidentiality agreements signed by all employees and contractors.
• Appropriate technical security measures to protect electronic and paper records.

7. Sharing Your Information

We will only share your information without your explicit consent in exceptional circumstances, such as:

• Where there is a risk of serious harm to you or another person.
• Where we are legally required to (e.g., by a court order, or for the notification of certain infectious diseases).
• For the prevention, detection, or prosecution of a serious crime.

Where we use third-party service providers (e.g., for IT hosting or specialist laboratory analysis), we have strict data processing agreements in place to protect your information.

8. Your Data Protection Rights

Under data protection law, you have important rights, including the right to:

• Be informed about how we use your data (this notice).
• Access your personal data and health records.
• Rectify inaccurate or incomplete data.
• Object to or restrict processing in certain circumstances.
• Data portability (to receive your data in a structured, machine-readable format).
• Withdraw consent if processing was originally based on it (note: this does not apply to processing necessary for your care).

To exercise any of these rights, please contact our Data Protection Officer using the details in Section 2. There is usually no charge for making a subject access request for your health information. Please note that in specific cases, such as where disclosure could cause serious harm to your mental or physical health, exemptions to these rights may apply.

9. How Long We Keep Your Information

We retain your personal data in line with UK law and the NHS Records Management Code of Practice for Health and Social Care. This means we keep adult health records for a minimum of 10 years after your last contact, and often longer. Specific retention periods can be found in the NHS Code of Practice.

10. Updates to This Privacy Notice

We may update this notice periodically. The latest version will always be available on our website.

Last Updated: June 2025