top of page

PRIVACY POLICY

General statement

At Lifestyle Medical Clinic Ltd, we prioritise the protection of your privacy. This policy, along with your rights under The Data Protection Act 2018 (DPA), ensures that your information is safeguarded. The DPA and this policy outline our commitment to securely storing and handling your information. Additionally, it grants individuals the right to access and obtain a copy of the information we hold about them. If you have any questions or concerns regarding this policy, please don't hesitate to contact us. It is important to read this policy alongside our terms and conditions for a comprehensive understanding of our practices.

Who are we

Lifestyle Medical Clinic Ltd is the controller of your personal information.

​

Company number: 13996937  
Registered address: 52 Connaught Road, Teddington, Middlesex, TW11 0PX  
Clinic: Studio 17, 392 Richmond Road, Richmond, London, TW1 2DY  
Email: info@lifestylemedicalclinic.co.uk  
Telephone: +44 7474 794887  
Information governance lead: Dr Tom Malak

​

This notice explains how we use personal information when you visit our website, create an account, book or pay for a service, complete a preventative-health assessment, provide laboratory or body-composition information, receive a report, or contact us.

Information we collect

Depending on the service, we may collect:​

  • your name, contact details, date of birth and account information;

  • booking, payment and communication information;

  • the reasons for your assessment and your health goals;

  • medical history, medicines, allergies and family history;

  • lifestyle information, including activity, nutrition, sleep, alcohol, smoking, wellbeing, stress and social or occupational factors;

  • clinical measurements, examination findings and body-composition measurements;

  • laboratory results and copies of source reports;

  • screening and vaccination status;

  • risk calculations, clinical findings, recommendations and reports;

  • your preferences, consent choices and requests;

  • technical, security and audit information generated when the service is used.

 

Health information is special-category personal data and receives additional protection.

Why we use your information

We use your information to:​

  • create and administer your account, booking and payment;

  • provide the assessment, interpret the information supplied and prepare your report;

  • identify safety concerns and arrange appropriate clinical review or escalation;

  • communicate with you about your service and follow-up;

  • maintain accurate clinical and business records;

  • meet legal, regulatory, professional, safeguarding and insurance obligations;

  • respond to your requests, complaints or legal claims;

  • keep our systems secure and investigate incidents;

  • monitor and improve the safety and quality of our services using the minimum necessary information;

  • send optional marketing only where the law permits and you have been offered the appropriate choice.

 

We do not sell patient information. We do not use your health information to target advertising.

Our legal bases

For ordinary personal information, we rely on one or more of:​

  • performance of our contract with you;

  • compliance with a legal obligation;

  • protection of vital interests in a genuine emergency;

  • our legitimate interests in providing, securing and improving a safe healthcare service, where those interests are not overridden by your rights;

  • consent for genuinely optional uses such as certain marketing communications.

 

For health information, we normally rely on the UK GDPR condition permitting processing necessary for preventive medicine, medical diagnosis, healthcare or treatment, or management of healthcare services. Processing is carried out by, or under the responsibility of, health professionals and people who owe duties of confidentiality. Other conditions may apply in emergencies, safeguarding situations or legal claims.

 

Where we ask for consent for an optional activity, you may withdraw it at any time. Withdrawal does not make earlier lawful processing unlawful and does not require us to delete clinical records that we must retain for another lawful reason.

Automated processing and artificial intelligence

Our systems may calculate measurements, validated questionnaire scores and rule-based clinical flags using defined software rules. We may also use an approved artificial-intelligence service to help draft explanatory text from minimised information.

​

Artificial intelligence does not approve your report, make a diagnosis or replace clinical judgement. Personalised interpretations and recommendations are reviewed by an authorised clinician before release. We do not use solely automated decision-making that produces legal or similarly significant effects for you.

Who receives your information

We disclose only the information necessary for the relevant purpose. Recipients may include:​

  • authorised Lifestyle Medical Clinic clinicians and administrative staff;

  • Wix, which provides our website, member account, assessment portal and secure content-management services;

  • our electronic patient-record and booking provider;

  • laboratories and other healthcare professionals involved in your care;

  • body-composition and clinical equipment/service providers where used;

  • payment providers, which process payments without us storing full card details;

  • email or messaging providers used for necessary service communications;

  • approved IT, security and artificial-intelligence suppliers acting under contract;

  • regulators, courts, insurers, safeguarding bodies or public authorities where disclosure is required or permitted by law.

 

Some recipients, such as another clinician providing care, may be controllers in their own right. Service providers acting for us must be subject to appropriate data-protection and confidentiality terms.

International processing

Some suppliers, including Wix and its subprocessors, may process information outside the United Kingdom. Where UK adequacy regulations do not apply, we require an approved transfer mechanism and appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful mechanism. We keep these arrangements under review.

How we protect your information

We use measures appropriate to the sensitivity of health data. These include authenticated patient access, restricted staff roles, multifactor authentication, admin-only clinical collections, encryption in transit and at rest, additional field-level encryption where supported, private document storage, short-lived download links, data minimisation, staff confidentiality, clinical review and incident-management procedures.

​

No online service can remove all risk. Please tell us promptly if you believe your account or information has been compromised.

How long we keep information

We retain information only for as long as needed for the purpose for which it was collected and to meet clinical, legal, regulatory, insurance and complaint-handling obligations.

​

Our current preventative-assessment schedule is generally:

  • abandoned assessment records: normally deleted after 90 days;

  • final clinical assessment records, reports and supporting results: normally retained for eight years after the conclusion of treatment or last clinical contact, then reviewed, subject to applicable professional, insurance or legal requirements;

  • superseded drafts, operational notifications and security records: retained for shorter documented periods unless needed for an incident, complaint or legal matter.

 

A legal, regulatory, safeguarding or complaint hold may require specific records to be retained longer. You may contact us for more information about a particular record.

Your rights

Subject to the circumstances and lawful exemptions, you may ask us to:

  • provide a copy of your personal information;

  • correct inaccurate or incomplete information;

  • erase information;

  • restrict how information is used;

  • provide certain information in a portable form;

  • stop processing based on legitimate interests;

  • stop direct marketing at any time;

  • explain relevant automated processing;

  • review a decision where applicable.

 

Clinical records cannot always be erased, for example where continued retention is necessary for healthcare, legal, regulatory or legal-claims purposes. If we cannot fulfil all or part of a request, we will explain why and describe your complaint rights.

​

To exercise a right, email info@lifestylemedicalclinic.co.uk. We may need proportionate information to confirm your identity. We normally respond within one month.

Cookies and similar technologies

Please contact Dr Tom Malak, our information governance lead, at info@lifestylemedicalclinic.co.uk if you have a question or concern.

​

You also have the right to complain to the Information Commissioner's Office:

Website: https://ico.org.uk/make-a-complaint/  
Telephone: 0303 123 1113

 

We would appreciate the opportunity to address your concern first, but you are not required to contact us before contacting the ICO.

Changes to this notice

We review this notice at least annually and whenever our services, suppliers or uses of information materially change. The current version and effective date will be published on our website.

bottom of page