Privacy Notice

Harley Street IBS & Autoimmune Clinic

Last updated: 7th July 2026

Who we are

Harley Street IBS & Autoimmune Clinic is the data controller responsible for your personal data. This means we decide how your personal data is processed and for what purposes.

Our contact details:

  • Name: Harley Street IBS & Autoimmune Clinic 
  • Address: 10 Harley Street, London, W1G 9PF
  • Telephone: 020 7467 1516
  • Email: holly@harleystreetibsclinic.co.uk

A data protection officer is not required for this clinic under Article 37 of the UK GDPR, but if you have any questions about how we handle your personal data, please contact us using the details above.

Who does this privacy notice apply to?

This privacy notice applies to information we collect from:

  • patients;
  • prospective patients;
  • former patients;
  • people who subscribe to our newsletters; and
  • people who make enquiries or contact us.

What personal data we collect and why

Personal data relates to a living individual who can be identified from that data, either alone or in conjunction with other information. We collect and use the following types of personal data for the purposes set out below.

Appointment management

We use your name, address, telephone number and email address to make, rearrange and manage appointments.

Diagnosis and treatment

We use the following information for the purposes of making a diagnosis, formulating a treatment strategy and planning your treatment:

  • your presenting complaint and symptoms as reported by you;
  • any relevant medical and family history you have told us;
  • our clinical findings about your health and wellbeing; and
  • your date of birth, which we may also use to help identify patients with the same name and to avoid errors in treatment, and for identification purposes when referring you to another health practitioner or writing to your registered medical practitioner.

Clinical records

We keep a record of any treatment given, details of the progress of your case and reviews of treatment planning. This enables us to review your diagnosis, treatment strategy and planning, and to retain evidence in the event of criminal proceedings, civil litigation, an insurance claim or a complaint.

We also record any information and advice we have given, especially when referring you to another health professional, and any decisions made in conjunction with you. This helps ensure you receive the most appropriate treatment and provides a record in the event of criminal proceedings, civil litigation, an insurance claim or a complaint.

Consent records

Where relevant, we maintain records of your consent to treatment (or the consent of a parent, guardian or next of kin) so that we can demonstrate that informed consent was obtained.

GP details

We use your GP's name and address in the event that we need to contact your GP, including in an emergency, and because it is a requirement under our professional Code of Conduct.

Marketing

We use your name, address, telephone number and email address to send you marketing materials, but only where we have your explicit consent to do so.

Enquiries

Where you submit an enquiry to us, we use the information you provide only to deal with your enquiry and any subsequent issues, and to monitor the level of service we provide.

Accident records

We keep accident records for any patients, visitors or staff involved in accidents at our clinic in accordance with UK health and safety legislation, including the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR).

Complaints

We keep personal information contained in complaint files to enable us to investigate and respond to complaints. This information is retained in a secure environment and access to it is restricted on a need-to-know basis.

Special category data

Some of the personal data we process is classified as special category data under the UK GDPR. This includes data concerning your health (for example, your patient notes, clinical findings and medical history).

We process special category health data where it is necessary for the provision of health care or treatment, and where that processing is carried out by or under the responsibility of a health professional who is subject to an obligation of professional secrecy. This falls within Article 9(2)(h) of the UK GDPR, read with paragraph 2 of Schedule 1 to the Data Protection Act 2018.

Where we process special category data on the basis of your explicit consent (for example, where you voluntarily provide us with information about your medical history by email), we rely on Article 9(2)(a) of the UK GDPR.

Our lawful bases for processing

Under the UK GDPR, we must have a lawful basis for each of our processing activities. The lawful bases we rely on are set out below.

Processing activity

Lawful basis (Article 6, UK GDPR)

Appointment management

Contractual necessity — processing is necessary for the performance of our contract with you to provide healthcare services (Article 6(1)(b)).

Diagnosis, treatment and clinical records

Contractual necessity — processing is necessary for the performance of our contract with you (Article 6(1)(b)); and/or Legitimate interests — it is in our legitimate interest to maintain accurate clinical records for the proper management of patient care and to defend potential legal claims (Article 6(1)(f)).

Consent records

Legal obligation — we are required to demonstrate that informed consent to treatment was obtained (Article 6(1)(c)); and/or Legitimate interests — it is in our legitimate interest to retain evidence of consent in the event of a claim or complaint (Article 6(1)(f)).

GP contact details

Legitimate interests — it is in our legitimate interest to be able to contact your GP in an emergency or as required by our professional Code of Conduct (Article 6(1)(f)).

Marketing

Consent — we only send marketing materials where you have given your explicit consent (Article 6(1)(a)).

Enquiries

Legitimate interests — it is in our legitimate interest to respond to enquiries and monitor our service quality (Article 6(1)(f)).

Accident records

Legal obligation — we are required by UK health and safety legislation, including RIDDOR, to maintain accident records (Article 6(1)(c)).

Complaint handling

Legitimate interests — it is in our legitimate interest to investigate and respond to complaints and to retain evidence in the event of further proceedings (Article 6(1)(f)).

Where we rely on legitimate interests, we have carried out an assessment to ensure that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests — see the "Your rights" section below.

Email communications

We are unable to send or receive encrypted emails. You should be aware that any emails we send or receive may not be protected in transit. We monitor emails sent to us, including file attachments, for viruses or malicious software. If you choose to send us personal information, including information about your medical conditions, by email, please be aware of this.

Whether you are obliged to provide your personal data

You are not under a statutory obligation to provide us with your personal data. However, where you engage us for healthcare services, the provision of certain personal data (such as your name, contact details, medical history and presenting complaint) is necessary for us to enter into and perform our contract with you. If you do not provide this information, we may be unable to provide you with our services.

For marketing communications, the provision of your contact details is entirely voluntary and based on your consent.

Sharing your personal data

Your personal data will be treated as strictly confidential and will only be shared in the following circumstances:

  • with named third parties, where you have given your explicit consent;
  • with a relevant authority, such as the police or a court, where necessary for compliance with a legal obligation (e.g. a court order);
  • with your doctor or the emergency services, where necessary to protect your life or the life of another person;
  • with the police or a local authority, for the purpose of safeguarding children or vulnerable adults;
  • with the Complementary Medical Association or our insurance company, in the event of a complaint or insurance claim; or
  • with our solicitors, in the event of any investigation or legal proceedings.

For further details about the circumstances in which information about you might be shared, please see the Information Commissioner's website at https://ico.org.uk/for-the-public/personal-information/sharing-my-info/.

International transfers

We do not transfer your personal data outside the United Kingdom. If this changes in the future, we will update this privacy notice and ensure that appropriate safeguards are in place in accordance with the UK GDPR.

How long we keep your personal data

We keep your personal data for no longer than is reasonably necessary. Our retention periods are as follows:

Type of data

Retention period

Patient records

7 years from the date of the last consultation, in accordance with our insurer's requirements.

Complaint files

6 years from closure of the complaint, to cover the limitation period for potential legal claims.

Enquiry records

12 months from the date the enquiry is resolved.

Marketing/newsletter subscriber data

Until you withdraw your consent or unsubscribe.

Accident records

3 years from the date of the incident, or longer where required by law.

At any time, you may request that changes are made to your contact details.

Automated decision-making

We do not carry out any automated decision-making or profiling using your personal data.

Your rights

Under the UK GDPR, you have the following rights in relation to your personal data. Please note that some of these rights apply only in certain circumstances, and some may be subject to exemptions.

  • Right of access — You have the right to request a copy of the personal data we hold about you.
  • Right to rectification — You have the right to request that we correct any personal data that is inaccurate or incomplete.
  • Right to erasure — You have the right to request that we delete your personal data where it is no longer necessary for us to retain it. This right does not apply where we are required to retain data for legal or regulatory reasons.
  • Right to restriction of processing — Where there is a dispute about the accuracy or processing of your personal data, you have the right to request that we restrict further processing.
  • Right to object — You have the right to object to the processing of your personal data where we are relying on legitimate interests as our lawful basis. You also have the right to object to processing for direct marketing purposes.
  • Right to data portability — Where processing is based on consent or contractual necessity and is carried out by automated means, you have the right to request that we provide your personal data to you or to another data controller in a commonly used, machine-readable format.
  • Right to withdraw consent — Where we rely on your consent as our lawful basis for processing, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. To withdraw your consent, please contact us using the details at the top of this notice.
  • Right to be informed of a personal data breach — If a personal data breach is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay. We will also notify the Information Commissioner's Office in accordance with the UK GDPR.

To exercise any of these rights, please contact us using the contact details at the top of this privacy notice. We will respond to your request without undue delay and in any event within one month. If your request is complex or we receive a number of requests, we may extend this period by a further two months, but we will notify you if this is the case.

Changes to this privacy notice

If we wish to use your personal data for a new purpose not covered by this privacy notice, we will provide you with a new notice explaining the new use before we begin processing and, where necessary, we will seek your prior consent.

We keep this privacy notice under regular review. This notice was last updated on 7th July 2026.

How to complain

If you have any concerns about our use of your personal data, please contact us in the first instance using the details below:

  • Email: holly@harleystreetibsclinic.co.uk
  • Address: 10 Harley Street, London, W1G 9PF
  • Telephone: 020 7467 1516

If you remain unhappy with how we have used your data after raising a complaint with us, you can complain to the Information Commissioner's Office: