Privacy Statement

Last updated: 20 October 2026

‍

This Privacy Statement explains how we collect, use, and protect your personal data when you visit https://harleystreetmd.com and when you receive care from us. Please read it carefully.

We comply with applicable privacy legislation, which means:

• We clearly state why we collect and process personal data.
• We limit the collection of personal data to what is necessary for legitimate purposes.
• We seek your explicit consent where required.
• We take appropriate security measures to protect your personal data and require the same from third parties who process data on our behalf.
• You have the right to access, correct, or delete your personal data upon request.

If you have any questions, please contact us using the details in Section 13.

‍

Data Controller

Harley Street Medical Doctors Limited is the Data Controller for personal data collected through this website and in the course of your care. We are registered with the Information Commissioner's Office (ICO) under registration number ZA178439.

Registered Office: First Floor, 57A Wimpole Street, London, W1G 8YP

‍

1. Cookies

Our website uses cookies. For details, please see our Cookie Policy.

‍

2. Our Lawful Bases for Processing (UK GDPR Article 6)

Every use we make of your personal data rests on one of the following lawful bases:

• Contract (Article 6(1)(b)) - to provide the consultation, treatment or service you have booked, and to administer appointments, payments and follow-up.
• Legal obligation (Article 6(1)(c)) - to create and retain clinical records, and to meet our obligations to the Care Quality Commission, the General Medical Council, the Medicines and Healthcare products Regulatory Agency and the Home Office.
• Legitimate interests (Article 6(1)(f)) - to run and improve the clinic, to keep the website secure and working, and to understand how the website is used. We balance these interests against your rights, and you may object at any time.
• Consent (Article 6(1)(a)) - for marketing communications and for non-essential cookies. You may withdraw consent at any time.

Where we process health data, an Article 9 condition applies in addition to the basis above. Article 9 does not replace Article 6; both are required.

‍

3. Special Category Health Data (UK GDPR Article 9)

As a healthcare provider, we collect and process special category personal data as defined under Article 9 of the UK General Data Protection Regulation. This includes data relating to your physical or mental health, medical history, and treatment information.

We process this data on the following conditions:

• Explicit consent (Article 9(2)(a)) - where you have given us clear, informed consent to process your health data for a specific purpose.
• Provision of healthcare (Article 9(2)(h)) - where processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care, or the management of health systems.
• Vital interests (Article 9(2)(c)) - in exceptional circumstances where processing is necessary to protect your vital interests or those of another person.

You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. To withdraw consent or request deletion of your health data, please contact us using the details in Section 13.

We will never sell, share, or use your health data for marketing purposes.

‍

4. How Long We Keep Your Data

We keep personal data only for as long as necessary, and apply the following periods:

• Clinical and patient records - 8 years after the last episode of care, in line with the Records Management Code of Practice for Health and Social Care, the NHS retention standard.
• Private prescription records - 2 years
• Controlled drug registers - 2 years from the last entry
• Medicines fridge temperature logs - 2 years
• Error and incident logs - minimum 2 years
• Booking and appointment data - retained with the clinical record
• Marketing contact details - until you withdraw consent
• Website analytics, event-level data - 2 months
• Website analytics, user-level data - 14 months from your most recent visit

Records are securely destroyed at the end of their retention period, paper by shredding and digital by secure deletion.

‍

5. Who We Share Your Data With

We share personal data only where it is necessary to provide your care or to meet a legal obligation. Our recipients are:

• Registered pharmacies that dispense and fulfil prescriptions issued by our clinicians: Fitzrovia Pharmacy, Pharmacierge Pharmacy, Crescent Pharmacy, Healthxchange Pharmacy, Specialist Pharmacy and Church Pharmacy.
• Laboratories that carry out blood tests and diagnostics, including HCA Laboratories and The Doctors Laboratories.
• Royal Mail, where medication is posted to you.
• PPS, the practice management system in which your clinical records are held.
• Nymo PMR, the pharmacy management system in which prescription, controlled drug and dispensing records are held.
• Our website host, which receives enquiry and booking form submissions.
• Our email provider, through which you may contact us and we may contact you.
• Our IT support and hosting providers, who maintain the systems above on our behalf.
• Our website and marketing agency, which has access to the systems above in order to maintain them on our behalf, acting only on our instructions.
• Egress, which provides the encrypted service we use to send records securely to you at your request.
• Google, for website analytics. We have a data processing agreement with Google, and Google may not use your data for other Google services.
• Law enforcement, courts or regulators, where we are required by law to disclose.
• A purchaser or successor, in the event of a sale, merger or acquisition of the business.

We do not sell your personal data to anyone.

‍

6. Transfers Outside the United Kingdom

Most of your data stays in the United Kingdom. Where our website analytics provider transfers data outside the UK, principally to the United States, that transfer is covered by the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, incorporated into our data processing agreement with that provider. You may ask us for details of the safeguards in place using the contact details in Section 13.

‍

7. Security

We implement appropriate measures to protect your data against unauthorised access, loss, misuse or alteration. Access is restricted to authorised personnel using individual logins, screens lock automatically when unattended, and our security procedures are reviewed regularly. Electronic transfers of records are encrypted.

‍

8. Third-Party Websites

Links on our website may lead to external websites. We are not responsible for how those sites handle your data. Please review their privacy policies before providing any personal information.

‍

9. Your Rights

You have the following rights under data protection law:

• To be informed - to know why and how your personal data is processed and how long it will be kept.
• Of access - to obtain a copy of the personal data we hold about you.
• To rectification - to have inaccurate data corrected.
• To erasure - to have your data deleted, where the law allows. Clinical records we are legally required to keep are an exception.
• To restrict processing - to ask us to pause our use of your data while a concern about its accuracy or our basis for holding it is resolved.
• To data portability - to receive your data in a portable format, or have it sent to another controller.
• To object - to processing carried out on the basis of our legitimate interests, unless there are compelling grounds to continue.
• To withdraw consent - at any time, where processing is based on consent.

Automated decision-making. We do not make decisions about your care or your treatment by automated means, and we do not carry out profiling that produces legal or similarly significant effects for you.

We may request proof of identity before acting on a request, to ensure your data is not disclosed, altered or deleted in error.

‍

10. Complaints

If you are dissatisfied with how we handle your personal data, please contact us first using the details in Section 13 so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office at any time:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Online: https://ico.org.uk/make-a-complaint

‍

11. Data Protection Contact

Our Data Protection Officer is Dr Qudsiyah Shah, who can be contacted at admin@harleystreet-md.co.uk.

For any question about how we handle your personal data, please use the same address.

‍

12. Children

Our services are provided to adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

‍

13. Contact Details

Harley Street Medical Doctors
First Floor, 57A Wimpole Street
London, W1G 8YP
United Kingdom

Website: https://harleystreetmd.com
Email: admin@harleystreet-md.co.uk
Telephone: 020 8127 8840

‍

14. Changes to this Privacy Statement

We may update this Privacy Statement from time to time. Please check it regularly. Where a change is significant, we will tell you directly wherever we can.

‍