Who I am
The data controller is Mr Haider Jan, trading as MIGynaecology ("I", "me"). I am responsible for deciding how your personal information is used. I am registered with the Information Commissioner's Office (ICO), registration number ZA097255.
You can contact me about anything in this notice through Helen Wood, my practice manager, by email at pa@migynaecology.com, or by telephoning the practice on 020 8175 1333.
When you are treated at a hospital, that hospital is also a data controller for the records it holds about you, and its own privacy notice applies to those records.
The information I collect
When you use the enquiry form
The enquiry form on the booking page collects:
- your name, telephone number and email address
- the reason for your enquiry, your preferred clinic and, if you choose to tell me, how you heard about the practice
- a brief message, if you write one
- your confirmation that you have read this notice
I ask you not to include detailed medical information in the form. If you do, I will treat it with the same care as the rest of your medical information.
When you contact me or become my patient
If you telephone or email, or become my patient, I collect the information needed to arrange and provide your care: your contact details, date of birth, GP details, insurance details if you are insured, and information about your health, including your medical history, examination findings, scan and test results, and the letters and reports about your care.
If you need to send scans, reports or letters before your appointment, my practice manager, Helen, will give you a link to upload them securely to Carebit, the practice management system I use for patient records and letters. Please use the link rather than ordinary email for medical documents.
When you telephone the practice
Calls to the practice line are answered by Kathryn, an automated assistant (an artificial intelligence system) that I have built and run for my practice. At the start of every call Kathryn says that she is my AI assistant, that she takes notes as you talk, and asks your name. She answers questions about my clinics, fees and booking, can text you links and phone numbers, takes messages for Helen, and, if you are unwell after an operation, gives you the safety advice I have written and alerts me. She does not give medical advice or make decisions about your care: a person deals with everything that needs one.
Kathryn keeps a written transcript of the call, together with your phone number, the time of the call, and any messages and texts sent. The sound of the call is not recorded. If Kathryn is unavailable and you leave a voicemail, the recording and its transcription are sent to Helen. If you tell Kathryn that you were treated in the NHS, she gives you the NHS team's contact details and does not take a message for them; the note of your call is kept like that of any other call to the practice.
Three service providers act on my instructions to run Kathryn: Twilio provides the telephone service, the speech recognition and Kathryn's voice; Anthropic provides the artificial intelligence model that understands and replies, and does not use your call to train its models; and Cloudflare runs Kathryn's server, stores the call records and sends Kathryn's emails to Helen.
When you browse this website
This website sets no cookies and does not identify you. Cloudflare, which hosts the website, processes technical information such as your IP address to deliver pages securely and protect the site from attack, and produces anonymous visit statistics from that server traffic. When you arrive from another website, the site also counts the name of that website (for example google.com) and the page you arrived on, and nothing else about you; nothing is placed on or read from your device for any of these statistics. On the booking pages, Cloudflare Turnstile checks that a real person, rather than automated software, is sending the form. It processes technical information about your browser and device for that security purpose only. The cookie notice has more detail.
How enquiries are handled
When you send the enquiry form, your details are sent by email to my practice manager, Helen, using Resend, an email delivery service that acts on my instructions. The enquiry is not stored in any database or file on this website; it is kept in the practice's email system for the period set out below. Resend keeps only the delivery records needed to run its service, for a limited period under its data processing agreement.
How I use your information, and the lawful basis
- To reply to your enquiry and arrange an appointment. The lawful basis is that you have asked me to take steps before providing care (UK GDPR Article 6(1)(b)), and my legitimate interest in responding to people who contact the practice (Article 6(1)(f)). If your enquiry, or anything you send before your appointment, includes information about your health, I also rely on Article 9(2)(h) (health care), with the condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, because it is used to assess and arrange your care by a health professional, and staff, bound by a duty of confidentiality. Ticking the box on the form confirms that you have read this notice; it is not the legal basis for using your information.
- To provide your care, including consultations, tests, treatment, letters and follow-up. The lawful bases are the provision of a service you have asked for (Article 6(1)(b)) and, for health information, the provision of health care by a health professional bound by a duty of confidentiality (Article 9(2)(h)).
- To meet legal and professional obligations, such as keeping medical records, responding to regulators and handling complaints (Article 6(1)(c), and Article 9(2)(h) and (f) where relevant).
- To answer and handle telephone calls, including through the automated assistant described above, and to keep a record of each call. The lawful basis is my legitimate interest in answering calls promptly and accurately and keeping a record of what was said and done (Article 6(1)(f)) and, where you tell us about your health, the provision of health care by a health professional bound by a duty of confidentiality (Article 9(2)(h)).
- To keep the website secure and working (my legitimate interests, Article 6(1)(f)).
I do not use your information for marketing, I do not sell it, and I do not use it to make automated decisions about you.
Who I share it with
I share your information only when it is needed for your care or required by law, and only as much as is necessary:
- the hospital or clinic where you are seen or treated
- your GP, and any specialist or fertility clinic involved in your care, with your agreement
- your insurer, if you are using private medical insurance, so that your treatment can be authorised and paid for
- laboratories and imaging services that carry out your tests
- service providers who act on my instructions under contract: Carebit (practice management, patient records, letters and secure document upload), Cloudflare (website hosting, security, visit statistics and the spam check, and running the telephone assistant's server, call records and emails), Resend (delivery of enquiry form emails), Twilio (the telephone service, speech recognition and the assistant's voice), Anthropic (the artificial intelligence model used by the telephone assistant), and email and IT providers
- regulators, courts or other authorities, where the law requires it
Transfers outside the UK
Some service providers process information outside the UK. Resend sends enquiry emails from servers in Ireland, in the European Union, which the UK recognises as protecting personal data to UK standards; because Resend is a US company, they may also be processed in the United States. Cloudflare may process technical information in the United States. Transfers to the United States are protected by safeguards recognised under UK law: both companies are certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US "data bridge"), and their data processing agreements also include the UK International Data Transfer Addendum.
Telephone calls are also processed in the United States. Twilio is certified under the UK Extension to the EU–US Data Privacy Framework. Anthropic processes the content of calls to provide the assistant's replies; that transfer is protected by the safeguards recognised under UK law that are set out in its data processing agreement.
How long I keep it
- Enquiries that do not lead to an appointment are deleted within twelve months.
- Records of telephone calls, including transcripts and voicemails, are kept for eight years, or until a child's 25th birthday if that is later, because they may form part of your medical record.
- If you become my patient, your records are kept for the periods set out in the NHS Records Management Code of Practice: normally eight years after your last treatment for adults; 25 years for records relating to pregnancy; and, for anyone treated as a child, until their 25th birthday (or 26th, if they were 17 when treatment ended).
Keeping it secure
Your information is kept confidential and protected by appropriate technical and organisational measures, including encrypted connections to this website, a secure system for patient records and document uploads, and access restricted to those who need it for your care.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the information I hold about you
- ask me to correct information that is inaccurate or incomplete
- ask me to delete information, or to restrict how I use it, in some circumstances
- object to my use of your information where I rely on legitimate interests
- ask for information you have given me to be transferred to another organisation, in some circumstances
- withdraw your consent at any time, where I rely on consent
Some rights are limited for medical records, which I must keep for legal reasons. To use any of these rights, contact my practice manager, Helen, using the details above. I will respond within one month, and there is normally no charge.
Complaints
If you are unhappy with how I have handled your information, please tell me first so that I can try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint (opens in a new tab), telephone 0303 123 1113.
Changes to this notice
I review this notice regularly. Any changes will be posted on this page with a new date.
Last updated .