1. About Us
We are Harley Street Specialist Hospital (London) Ltd, trading as Harley Weight Loss Clinic. We are registered in England and Wales under company number 10006100 and registered with the Information Commissioner’s Office (ICO) under registration number ZB727254.
Our registered office is: Harley Street Specialist Hospital (London) Ltd, 18-22 Queen Anne Street, London, W1G 8HU.
2. Data Protection Officer
We have appointed a Data Protection Officer (DPO) to govern how we use and protect your data. The DPO can be reached at enquiries@hssh.health or by post at the address above (marked ‘for the attention of the Data Protection Officer’).
If you have concerns about how we process your personal data and we have not addressed them to your satisfaction, you have the right to contact the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/.
3. Our Lawful Bases for Processing Your Data
Under UK GDPR, we process your data using one or more of the following lawful bases:
- Consent: where you have given clear consent for us to process your data for a specific purpose
- Contract: where processing is necessary to fulfil a contract with you
- Legal Obligation: where processing is necessary to comply with a law or regulation
- Legitimate Interests: where processing is necessary for our legitimate business interests
- Explicit Consent: required when processing special category data such as health information
4. Personal Data We May Collect
Personal Data
- Identity Information: name, surname, title, date of birth, gender
- Contact Information: email address, telephone number, postal address
- Financial Information: payment card details, billing information
- Technical Information: IP address, browser type, device information, operating system
- Usage Data: how you use our website, pages visited, time spent on pages
- Marketing Data: your preferences in receiving marketing from us and third parties
Special Category Data
- Health Information: your physical and mental health, medical history, current medications, weight history, body measurements, treatment progress, side effects experienced
- Image Data: body composition scans, progress photos (if consented), images of formal identification
- GP Information: details about your continued care by other health professionals
- Race or Ethnicity Data: where relevant to treatment
- Biometric Information: details contained within formal identification documents
- Disability Information: details regarding any disability you may have
You must be at least 18 years old to use our services. We do not knowingly collect information from children.
5. How We Collect Your Information
We collect information directly from you when you register for an account, complete our health questionnaire, attend consultations, contact us via email or phone, purchase services or products, or subscribe to communications.
We also collect technical data automatically from your use of our website, including IP address, browser information, and usage data via cookies and similar tracking technologies.
6. How We Use Your Data
- To create your account and manage bookings
- To provide appropriate medical care and personalised treatment plans
- To assess your suitability for weight management medication
- To monitor your health, treatment progress, and manage side effects
- To process payments and complete transactions
- To verify your identity and prevent fraud
- To improve our website and services through analytics
- To communicate important information about your treatment
- To send marketing communications where you have consented
- To comply with our legal and regulatory obligations
7. Third Parties with Whom We Share Your Data
We share your data only with third parties who help us deliver our services, under strict data processing agreements. These include:
- Healthcare Service Providers: qualified prescribers, registered pharmacies, laboratory testing companies
- Operational Service Providers: payment processors, delivery services, identity verification companies, customer service platforms, IT and cloud providers
- Business and Professional Services: marketing and analytics providers, professional advisors, insurance providers
- Legal and Regulatory: the CQC, MHRA, GMC, GPhC, courts, and law enforcement where required
8. International Data Transfers
Almost all data is stored and processed in the UK or EEA. Where transfers outside these areas are necessary, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the ICO.
9. How Long We Keep Your Information
We retain your data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, or reporting requirements. Medical records are retained in line with NHS and CQC guidance, typically a minimum of 8 years for adults.
10. Protected Health Information (PHI): Notice of Privacy Practices
10.1 What Is PHI
10.2 How We May Use and Disclose Your PHI
We may use and disclose your PHI for the following purposes:
- Treatment: to provide, coordinate, or manage your medical care, including consultations with prescribers,
pharmacies, and other healthcare professionals involved in your care. - Payment: to bill for and collect payment for the treatment and services provided to you.
- Healthcare Operations: for quality assessment, staff training, clinical audits, and other activities necessary to
operate our clinic and improve the care we provide. - Legal and Regulatory Compliance: where required by law, or requested by regulators such as the CQC,
MHRA, GMC, or GPhC, or in response to a court order. - With Your Consent: for any other purpose not described above, we will ask for your written consent before
using or disclosing your PHI. You may withdraw that consent at any time.
10.3 Your Rights Regarding Your PHI
In addition to the general data protection rights set out in Section 11, you have the following specific rights
regarding your PHI:
- Right to Inspect and Copy: you have the right to request access to inspect and obtain a copy of the PHI held in
your medical records. - Right to Amend: if you believe information in your medical records is inaccurate or incomplete, you have the
right to request that we amend it, stating your reason for the request. - Right to an Accounting of Disclosures: you have the right to request a list of certain disclosures we have made
of your PHI. - Right to Request Restrictions: you have the right to ask us to limit how we use or disclose your PHI for
treatment, payment, or healthcare operations. - Right to Confidential Communications: you have the right to request that we communicate with you about
your health information in a particular way or at a particular location. - Right to a Paper Copy: you have the right to request a paper copy of this Notice at any time, even if you have
agreed to receive it electronically.
Instructions for exercising these rights: submit a written request to our Data Protection Officer at
enquiries@hssh.health, or by post to the address in Section 1, stating which right you wish to exercise. We will
respond within one month. If we deny a request to amend your records, we will explain our reasons in writing.
10.4 How to File a Complaint
10.5 Our Legal Duties
11. Your Rights
(For rights specific to your Protected Health Information, including your right to inspect, copy, and amend your
medical records, and how to file a complaint, see Section 10 above.) Under UK data protection law, you have the
following rights:
- Right of access: to request a copy of the personal data we hold about you
- Right to rectification: to request that we correct inaccurate or incomplete data
- Right to erasure: to request deletion of your data in certain circumstances
- Right to restriction: to request that we limit how we use your data
- Right to data portability: to receive your data in a structured, machine-readable format
- Right to object: to object to processing based on legitimate interests or for direct marketing
- Rights in relation to automated decision-making and profiling
To exercise any of these rights, please contact us at enquiries@hssh.health. We will respond within one month.
12. Data Security
We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. All data is encrypted in transit and at rest.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Updates will be posted on our website and your continued use of our services implies acknowledgement of any changes. We will notify you of significant changes by email where appropriate. Historical versions are available on request.
Questions? Contact us at enquiries@hssh.health or call +44 (0)20 4513 2244.