1. Who we are

London Iron Infusion Clinic is a trading name of Pop Up Docs Limited, a company registered in England and Wales.

Pop Up Docs Limited is the data controller for the personal information collected and processed in connection with London Iron Infusion Clinic. This means we determine the purposes and means of processing your personal data and are responsible for doing so lawfully.

As a provider of private healthcare services, we are registered with the Care Quality Commission (CQC) and operate in accordance with professional standards set by the General Medical Council (GMC) and the Nursing and Midwifery Council (NMC).

2. What personal data we collect

We collect different categories of personal data depending on how you interact with us.

When you contact us or book an appointment

• Full name, date of birth, and contact details (phone number, email address, postal address)
• Appointment preferences and booking history
• Communications with us by phone, email, or WhatsApp

When you become a patient

• Medical history, current medications, and relevant clinical information
• Blood test results and laboratory reports
• Clinical notes, treatment records, and infusion details
• Allergies, contraindications, and adverse reaction records
• Next of kin or emergency contact details (where provided)

When you use our website

• IP address, browser type, and device information
• Pages visited, time spent on site, and referring website
• Cookie data (see our Cookie Policy for full details)

Health data is classified as special category data under Article 9 of the UK GDPR. We treat it with the highest level of care and apply additional legal safeguards to its processing.

3. Lawful basis for processing

We are required by law to identify a lawful basis for processing your personal data. We rely on the following:

For clinical and health data (special category data)

• Article 9(2)(h) UK GDPR, processing necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services. This is the primary basis on which we process your health records.
• Article 9(2)(b) UK GDPR, processing necessary for carrying out obligations in the field of employment, social security, and social protection law, where authorised by domestic law.
• Schedule 1, Part 1(2) of the Data Protection Act 2018, processing by a health professional for health care purposes.

For non-health personal data

• Article 6(1)(b) UK GDPR, processing necessary for the performance of a contract (your appointment and treatment).
• Article 6(1)(c) UK GDPR, processing necessary for compliance with a legal obligation (CQC requirements, clinical record-keeping obligations, professional regulatory standards).
• Article 6(1)(f) UK GDPR, processing necessary for our legitimate interests, for example to improve our services, manage our business operations, and maintain the security of our systems, where these interests are not overridden by your rights.
• Article 6(1)(a) UK GDPR, your consent, where we specifically ask for it (for example, for marketing communications).

4. How we use your personal data

We use your personal data for the following purposes:

• To provide you with clinical assessment, treatment, and follow-up care
• To maintain accurate and complete medical records as required by our professional and regulatory obligations
• To communicate with you about your appointments, treatment, and results
• To process payments and maintain financial records
• To fulfil our obligations to the Care Quality Commission and other regulators
• To respond to complaints and feedback
• To analyse website usage and improve our services (using anonymised or aggregated data where possible)
• To send you health information or clinic updates where you have consented to receive these

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

We do not sell your personal data to any third party. We do not share your data with advertisers.

5. Who we share your data with

We share your personal data only where necessary and only with parties who are required to protect it in accordance with the law.

Clinical and operational processors

• Semble – our clinical practice management and booking system. Semble acts as a data processor on our behalf and is contractually required to process your data only on our instructions. Their data processing agreement is available at semble.io.
• The Doctors Laboratory (TDL) – our primary laboratory partner for blood test processing. TDL processes blood samples and provides results directly to us. They are registered as a data controller in their own right for laboratory purposes.
• Randox Health – an additional laboratory used for certain blood tests. As with TDL, Randox processes samples and results in accordance with their own data protection obligations.
• Home phlebotomy service -where you opt for a home blood test, a qualified phlebotomist will visit your home. This service provider acts as a data processor and is contractually bound to our data protection standards.
• Google LLC – we use Google Analytics on our website to understand how visitors use our site. Google Analytics uses cookies to collect anonymised usage data. See our Cookie Policy for details. Google is certified under the UK-US Data Bridge.

When we may share data with other parties

• With your GP or other treating clinician, where you request or consent to this, or where it is necessary for your ongoing care
• With regulatory bodies (CQC, GMC, NMC) where required by law or as part of an inspection or investigation
• With our professional indemnity insurer, where necessary in connection with a clinical incident or complaint
• With law enforcement or a court, where we are legally required to do so
• With emergency services, where disclosure is necessary to protect your life or the life of another person

6. How long we keep your data

We retain personal data for as long as necessary to fulfil the purposes described in this policy and to comply with our legal obligations.

• Clinical records – retained for a minimum of 8 years from the date of your last treatment, in accordance with NHS guidance and medical defence recommendations. Records relating to treatment received as an adult are typically retained until age 26 or for 8 years from last contact, whichever is longer.
• Financial records – retained for 7 years from the date of the transaction, as required by HMRC.
• Marketing consent records -retained until you withdraw consent, and for a reasonable period thereafter as evidence of consent.
• Website analytics data – Google Analytics data is retained in accordance with Google’s standard retention periods, typically 26 months.
• CCTV footage – we do not currently operate CCTV within our clinical space. If this changes, we will update this policy.

7. Your rights under UK GDPR

You have the following rights in relation to your personal data. These rights are not absolute and may be subject to limitations, particularly where we are required to retain records for clinical or legal purposes.

• Right of access – you have the right to request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one calendar month. There is no charge for a first request.
• Right to rectification – you have the right to ask us to correct inaccurate or incomplete personal data.
• Right to erasure – you have the right to ask us to delete your personal data in certain circumstances. Note that we cannot erase clinical records where we are required to retain them by law or professional obligation.
• Right to restrict processing – you have the right to ask us to restrict how we use your data in certain circumstances.
• Right to data portability – you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to transfer it to another data controller.
• Right to object – you have the right to object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making – you have the right not to be subject to solely automated decisions that significantly affect you. We do not carry out this type of processing.
• Right to withdraw consent – where we rely on your consent as a lawful basis, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at hello@londonironinfusionclinic.co.uk. We will acknowledge your request within 5 working days and respond fully within one calendar month.

8. Data security

We take the security of your personal data seriously. We use appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction.

• Clinical records are stored within Semble, a GDPR-compliant, UK-based clinical system with encryption at rest and in transit
• Access to patient records is restricted to clinical staff who require it for treatment purposes
• All clinical staff receive data protection training
• We use secure, encrypted email for communications containing personal data where possible
• Passwords and authentication controls are in place on all systems containing personal data

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and notify you without undue delay where required.

9. International data transfers

Your personal data is stored and processed primarily within the United Kingdom.

Google Analytics may transfer data to the United States. Google LLC is certified under the UK-US Data Bridge, which provides an adequate level of protection for personal data transferred from the UK to the US under this framework.

We do not transfer clinical records outside the UK.

10. Complaints

If you have a concern about how we handle your personal data, please contact us first at hello@londonironinfusionclinic.co.uk. We take all complaints seriously and will respond within 10 working days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The date at the top of this page will always reflect when it was last updated.

Where changes are significant, we will notify patients directly by email.