PRIVACY POLICY

1. WHAT INFORMATION DO WE COLLECT?

Clinical & Special Category Data

• • Consultation notes
  • Medical history
  • Treatment details
  • Clinical photographs and imagery
  • Prescriptions or laboratory results
  • Referral information (if applicable)

Contact & Administrative Data

• • Name
  • Address
  • Email
  • Phone number
  • Date of birth
  • Appointment details
  • Payment and billing information

Website Usage Data

• • IP address
  • Browser type
  • Website interaction
  • information
  • Cookie preferences

We do not knowingly process data from individuals under 18 without parental or guardian involvement.

Processing is carried out under the UK GDPR on the basis of:

• • Provision of healthcare services (Articles 6(1)(b) & 9(2)(h))
  • Compliance with legal obligations (Article 6(1)(c))
  • Explicit consent for optional uses such as marketing photography (Article 9(2)(a))

Consent may be withdrawn at any time.

We use your data to:

• • Provide safe clinical care
  • Maintain accurate medical and treatment records
  • Manage bookings and follow-up care
  • Communicate regarding your healthcare
  • Process secure payments
  • Improve clinic services

We do not use clinical data for direct marketing.
Marketing communications are only sent with explicit consent.

Clinical photographs are used for:

• • Assessment and treatment planning
  • Medical record-keeping

Photos are used for marketing, education, or publicity only with your explicit written consent, which may be withdrawn.

5. Sharing Your Information

We only share personal data when necessary for:

• • Healthcare delivery
  • Legal or regulatory obligations
  • Secure data processing

This may involve:

• • Clinical professionals involved in your care
  • Pabau (practice management system)
  • respond.io (communication platform)
  • takepayments (secure payment processor)
  • HIS and ICO (when legally required)
  • We do not sell personal data.

Where systems operate outside the UK, data transfers comply with UK GDPR safeguards.

6. Data Security

We take reasonable steps to secure personal data including:

• • Encryption and secure electronic systems
  • Access limited to authorised staff
  • Staff confidentiality obligations
  • Secure hosting using AWS UK servers

Data breach procedures comply with ICO requirements.

7. Retention

• • Adult clinical records: at least 8 years after final treatment
  • Records of minors: retained until age 25 (or 26 if treated at 17)
  • Financial records: at least 6 years

Records are securely destroyed when no longer required.

8. Cookies & Tracking

We use essential cookies needed for site functionality.
Analytics cookies require user consent.
Details are provided in our Cookie Policy.

9. Your Rights

You may request to:

• • Access your data
  • Correct inaccuracies
  • Restrict processing in certain circumstances
  • Request deletion where lawful
  • Withdraw consent for optional processing

Concerns may be raised with the Information Commissioner’s Office (ICO).

10. Policy Updates

This notice may be updated periodically. The current version is always available on our website.

11. Contact

For privacy enquiries or access requests:
Data Protection Officer
Merchant City Medical Group
70 West Regent Street, Glasgow, G2 2QZ
Email: contact@merchantcitymedicalgroup.com
Phone: 0141 221 9699