This policy explains how the private practice of Mr David Allen, Consultant Orthopaedic Surgeon, handles your personal information when you use this website, contact the practice or receive care. We are committed to protecting your privacy and to meeting our duties under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Mr David Allen is the data controller for the personal information described in this policy. When you are treated at Nuffield Health Glasgow Hospital or NHS Golden Jubilee, the hospital is also a data controller for the records it keeps. You can contact us about this policy using the details on our Contact page.
Information we collect
- Contact details, such as your name, address, email address and telephone number
- Date of birth, NHS number and GP details
- Health information, including symptoms, medical history, imaging, test results and treatment notes
- Insurance details, such as your insurer, policy number and authorisation code
- Payment information for self-pay treatment
- Website usage data collected through cookies, where you have agreed to them
How we use your information
We use your information to arrange and provide your care, to communicate with you and with the professionals involved in your treatment, to process insurance claims and payments, to meet our legal and regulatory duties and to improve our services.
Our lawful basis
We process your personal information to provide the care you have asked for, to meet our legal obligations and for our legitimate interests in running a safe and effective practice. Health information is special category data. We process it to provide health care under Article 9(2)(h) of the UK GDPR, with appropriate safeguards and a duty of confidentiality.
Who we share it with
- Hospitals and clinics where you are seen or treated
- Your GP and other clinicians involved in your care
- Your medical insurer, to authorise and pay for treatment
- Medical secretaries and practice staff, who are bound by confidentiality
- Trusted IT, booking and secure email providers acting on our instructions
- Regulators or the police, only where the law requires it
We never sell your information, and we do not use it for marketing without your consent.
How long we keep it
We keep medical records for the periods set out in the Scottish Government’s Records Management Code of Practice for Health and Social Care. Enquiries that do not lead to an appointment are deleted after 12 months.
Keeping your information secure
Your information is stored on secure, access-controlled systems. Only people who need it for your care can see it. If any information is processed outside the UK, it is protected by appropriate safeguards.
Your rights
- Access a copy of the information we hold about you
- Ask us to correct anything that is inaccurate
- Ask us to delete or restrict your information, where the law allows
- Object to how we use your information
- Withdraw your consent at any time, where we rely on it
To make a request, contact the practice. We will respond within one month.
Concerns and complaints
If you are unhappy with how we have handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.