Privacy Notice

1. Who we are

For data protection purposes, the data controller is Harley Street Imaging Group Ltd trading as Harley Street Ultrasound Group. We are responsible for deciding how and why we use personal information.

You can contact us about this notice or your personal information:

• Address: 99 Harley Street, Marylebone, London, W1G 6AQ
• Telephone: 0203 904 4441
• Email: contact@harleystreetultrasound.com
• ICO registration number: ZA537688

2. What information we collect

2.1 Patients and prospective patients

To provide safe diagnostic services, we may collect and use:

• Identity and contact details (for example name, date of birth, address, email address, telephone number).
• Appointment and referral information (for example the reason for your scan, referrer/GP details, and appointment history).
• Health information (special category data) including symptoms, medical history relevant to the scan, ultrasound images and reports, and related clinical correspondence.
• Payment and billing information (for example invoices, receipts and payment status).
• Next of kin or emergency contact details where relevant.

2.2 Website users and enquiries

When you use our website, contact form or other online features, we may collect and use:

• Contact details you provide (name, email address, telephone number) and the content of your message.
• Log data automatically sent by your browser (for example IP address, browser type/version, pages visited, date/time of visit, time spent and other statistics).
• Cookie data and similar technologies (see section 9).

2.3 Clinicians and referrers

If you refer a patient to us or contact us in a professional capacity, we may hold:

• Your name, professional contact details, and organisation.
• Correspondence relating to referrals, reports and clinical queries.

3. How we collect your information

We collect information:

• Directly from you (in person, by phone, email, post, via our website forms, or via our online booking platform).
• From clinicians or other healthcare providers involved in your care (for example referrers, GPs or hospitals).
• From third parties where appropriate (for example insurers or payment providers) and only where there is a lawful basis to do so.

4. How we use your information and our lawful bases

UK data protection law requires us to have a lawful basis for using personal information. Where we use health information or other special category data, we must also have a special category condition.

5. Who we share information with

We do not sell personal information. We may share personal information where needed for the purposes above, for example with:

• Your referrer/GP and other healthcare professionals involved in your care (with your consent where appropriate).
• Regulators and public bodies where required (for example the Care Quality Commission) and law enforcement agencies where required by law or court order.
• Our professional advisers (for example accountants, insurers and legal advisers) where necessary.
• Service providers who support our operations (for example IT, communications and customer support platforms).

Where we use suppliers to process information on our behalf, we ensure appropriate contracts are in place and suppliers are required to protect confidentiality and security. Examples of systems we use may include Microsoft 365/Windows, Google Workspace, Slack and clinical imaging and reporting systems.

6. International transfers

Some of our service providers may store or process personal information outside the UK. Where this happens, we use appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with other measures where required.

7. How we keep information secure

We take security seriously and use a combination of organisational and technical measures appropriate to the risks.

No online service can be guaranteed 100% secure. If you have concerns, please contact us using the details in section 1.

8. How long we keep your information

We keep personal information only as long as necessary for the purposes described in this notice, including to meet legal, regulatory and professional obligations. Our retention periods are informed by the Records Management Code of Practice for health and care records and radiology record retention guidance.

When retention periods expire, we securely delete, shred, anonymise or otherwise dispose of information in line with our procedures.

9. Cookies, log data and analytics

9.1 Log data

When you visit our website, we may automatically collect log data such as your IP address, browser type/version, the pages you visit, the date and time of your visit, and the time spent on pages. We use this information to operate, maintain and improve our website and to help keep it secure.

9.2 Cookies

Cookies are small files stored on your device. We use cookies and similar technologies to:

• Ensure the website functions properly and securely.
• Remember preferences.
• Understand how visitors use and engage with the website so we can improve it.
• Support advertising and measure engagement where used.

You can manage cookies through your browser settings and, where provided, our cookie settings tools. For more detail, please see our Cookie Policy on our website.

9.3 Service providers

We may use third-party providers to help us deliver, support and analyse our website and services. These providers may access personal information only to perform tasks on our behalf and must not use it for their own purposes.

10. Children’s information

Our clinical services include scans for children and young people. Where a patient is under 18, we may need to collect information about a parent/guardian and we will communicate appropriately based on the circumstances.

Our website is intended for a general audience and is not directed at children using the website on their own. If you believe a child has provided information through the website without appropriate involvement of a parent/guardian, please contact us and we will take appropriate steps.

11. Your rights

You have rights under UK data protection law. These rights are not absolute and may depend on the reason we use your information. Your rights include:

1. Access: request a copy of the personal information we hold about you.
2. Rectification: ask us to correct inaccurate or incomplete information.
3. Erasure: ask us to delete information in certain circumstances.
4. Restriction: ask us to limit how we use your information in certain circumstances.
5. Data portability: receive certain information in a structured, commonly used format.
6. Objection: object to processing based on legitimate interests or direct marketing.
7. Withdraw consent: where we rely on consent, you can withdraw it at any time (this will not affect processing already carried out).

To exercise your rights, please contact us using the details in section 1. We may need to verify your identity before responding. We aim to respond within one month.

11.1 Complaints

If you are unhappy with how we have handled your information, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office (ICO).

Information Commissioner’s Office (ICO) – Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone: 0303 123 1113. Website: ico.org.uk

12. Links to other websites

Our website may contain links to third-party websites. We do not control these sites and are not responsible for their content or privacy practices. Please review the privacy information for any external site you visit.

13. Changes to this notice

We may update this notice from time to time. The latest version will be published on our website. Please review it periodically for changes.