1. Who we are
For data protection purposes, [Mr Bas Ranganathan / Manchester Rhinoplasty Clinic] is the “data controller” of the personal data described in this policy.
This policy applies to personal data we collect through this website, by telephone, by email, and during consultations and treatment.
2. What personal data we collect
We may collect and process the following categories of personal data:
a) Information you give us directly
b) Information collected automatically
c) Information from third parties
We do not knowingly collect data from anyone under the age of 18 via this website without parental involvement.
3. Why we collect it, and our lawful basis
UK GDPR requires us to state the specific lawful basis for each purpose. Health data is “special category data” under Article 9 and requires an additional condition beyond the standard Article 6 basis.
|
Purpose
|
What data
|
Lawful basis (Art. 6)
|
Special category condition (Art. 9), where applicable
|
|
Responding to your enquiry via the contact form
|
Name, email, phone, message content
|
Art. 6(1)(b) — steps prior to a contract, or Art. 6(1)(f) — legitimate interest in responding to enquiries
|
N/A unless health details volunteered — then Art. 9(2)(a) explicit consent
|
|
Providing a medical consultation and treatment
|
Medical history, examination findings, photographs for clinical purposes
|
Art. 6(1)(b) — performance of a contract for services
|
Art. 9(2)(h) — provision of health care, by a health professional subject to a duty of confidentiality
|
|
Keeping clinical records
|
All treatment-related data
|
Art. 6(1)(c) — legal obligation (GMC/medical record-keeping requirements)
|
Art. 9(2)(h)
|
|
Using before/after photos for the website or marketing
|
Photographs
|
Art. 6(1)(a) — consent
|
Art. 9(2)(a) — explicit consent (separate, specific consent form required — see Section 6)
|
|
Website analytics
|
IP address, browsing behaviour
|
Art. 6(1)(a) — consent (via cookie banner) or Art. 6(1)(f) legitimate interests for strictly necessary cookies
|
N/A
|
|
Complying with legal/regulatory obligations (e.g. GMC, indemnity insurer requests)
|
Relevant clinical/administrative data
|
Art. 6(1)(c) — legal obligation
|
Art. 9(2)(h) or 9(2)(i) as applicable
|
4. How we use your information
We use your personal data to:
We do not use your data for automated decision-making or profiling.
5. Who we share your information with
We may share personal data with:
We do not sell personal data to third parties, and we do not share identifiable clinical information for marketing purposes without your explicit separate consent.
6. Before and after photographs — separate consent
Clinical photographs taken for treatment planning are part of your medical record and are covered under Section 3 above (Art. 9(2)(h)).
If we wish to use any photograph publicly (on this website, in print materials, or on social media), we will ask you to sign a separate, specific photo consent form, which will explain:
We will not use identifiable treatment photographs without this separate consent.
7. International data transfers
Some of our service providers (such as [hosting provider] or [email/CRM provider]) may store data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as the UK’s International Data Transfer Agreement (IDTA) or an adequacy decision, in line with UK GDPR requirements.”
If all your data stays within the UK/EEA, state that instead — this section must reflect the truth of your actual suppliers.
8. Cookies and website analytics
This website uses cookies to:
You can control or disable cookies through your browser settings. Non-essential cookies are only set with your consent via our cookie banner.
(If you don’t already have a separate, more detailed Cookie Policy, one should be created alongside this — cookie consent has its own specific requirements under PECR alongside UK GDPR.)
9. How long we keep your data
10. Your rights
Under UK GDPR, you have the right to:
11. How to complain
If you have concerns about how we’ve handled your personal data, please contact us first at
[enquiries@mmsecretaries.co.uk so we can try to resolve the issue directly. We aim to respond within
[e.g. 20 working days].
If you remain unsatisfied, you have the right to lodge a complaint with the UK’s supervisory authority:
Information Commissioner’s Office (ICO) Website:
ico.org.uk Telephone: 0303 123 1113 Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Security
We take appropriate technical and organisational measures to protect your personal data, including [e.g. encrypted storage, access controls limiting staff access to records on a need-to-know basis, secure clinical record-keeping systems]. No system is completely secure, but we review our safeguards regularly.
13. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top will reflect the most recent revision. We encourage you to review it periodically.
14. Contact us
Manchester Rhinoplasty Clinic
Call : Liz Costello (PS)
0161 447 6761
