1. About Us
We are Harley Street Specialist Hospital (London) Ltd, trading as Harley Weight Loss Clinic. We are registered in England and Wales under company number 10006100 and registered with the Information Commissioner’s Office (ICO) under registration number ZB727254.
Our registered office is: Harley Street Specialist Hospital (London) Ltd, 18-22 Queen Anne Street, London, W1G 8HU.
2. Data Protection Officer
We have appointed a Data Protection Officer (DPO) to govern how we use and protect your data. The DPO can be reached at enquiries@hssh.health or by post at the address above (marked ‘for the attention of the Data Protection Officer’).
If you have concerns about how we process your personal data and we have not addressed them to your satisfaction, you have the right to contact the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/.
3. Our Lawful Bases for Processing Your Data
Under UK GDPR, we process your data using one or more of the following lawful bases:
- Consent: where you have given clear consent for us to process your data for a specific purpose
- Contract: where processing is necessary to fulfil a contract with you
- Legal Obligation: where processing is necessary to comply with a law or regulation
- Legitimate Interests: where processing is necessary for our legitimate business interests
- Explicit Consent: required when processing special category data such as health information
4. Personal Data We May Collect
Personal Data
- Identity Information: name, surname, title, date of birth, gender
- Contact Information: email address, telephone number, postal address
- Financial Information: payment card details, billing information
- Technical Information: IP address, browser type, device information, operating system
- Usage Data: how you use our website, pages visited, time spent on pages
- Marketing Data: your preferences in receiving marketing from us and third parties
Special Category Data
- Health Information: your physical and mental health, medical history, current medications, weight history, body measurements, treatment progress, side effects experienced
- Image Data: body composition scans, progress photos (if consented), images of formal identification
- GP Information: details about your continued care by other health professionals
- Race or Ethnicity Data: where relevant to treatment
- Biometric Information: details contained within formal identification documents
- Disability Information: details regarding any disability you may have
You must be at least 18 years old to use our services. We do not knowingly collect information from children.
5. How We Collect Your Information
We collect information directly from you when you register for an account, complete our health questionnaire, attend consultations, contact us via email or phone, purchase services or products, or subscribe to communications.
We also collect technical data automatically from your use of our website, including IP address, browser information, and usage data via cookies and similar tracking technologies.
6. How We Use Your Data
- To create your account and manage bookings
- To provide appropriate medical care and personalised treatment plans
- To assess your suitability for weight management medication
- To monitor your health, treatment progress, and manage side effects
- To process payments and complete transactions
- To verify your identity and prevent fraud
- To improve our website and services through analytics
- To communicate important information about your treatment
- To send marketing communications where you have consented
- To comply with our legal and regulatory obligations
7. Third Parties with Whom We Share Your Data
We share your data only with third parties who help us deliver our services, under strict data processing agreements. These include:
- Healthcare Service Providers: qualified prescribers, registered pharmacies, laboratory testing companies
- Operational Service Providers: payment processors, delivery services, identity verification companies, customer service platforms, IT and cloud providers
- Business and Professional Services: marketing and analytics providers, professional advisors, insurance providers
- Legal and Regulatory: the CQC, MHRA, GMC, GPhC, courts, and law enforcement where required
8. International Data Transfers
Almost all data is stored and processed in the UK or EEA. Where transfers outside these areas are necessary, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the ICO.
9. How Long We Keep Your Information
We retain your data for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, regulatory, accounting, or reporting requirements. Medical records are retained in line with NHS and CQC guidance, typically a minimum of 8 years for adults.
10. Your Rights
Under UK data protection law, you have the following rights:
- Right of access: to request a copy of the personal data we hold about you
- Right to rectification: to request that we correct inaccurate or incomplete data
- Right to erasure: to request deletion of your data in certain circumstances
- Right to restriction: to request that we limit how we use your data
- Right to data portability: to receive your data in a structured, machine-readable format
- Right to object: to object to processing based on legitimate interests or for direct marketing
- Rights in relation to automated decision-making and profiling
To exercise any of these rights, please contact us at enquiries@hssh.health. We will respond within one month.
11. Data Security
We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. All data is encrypted in transit and at rest.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Updates will be posted on our website and your continued use of our services implies acknowledgement of any changes. We will notify you of significant changes by email where appropriate. Historical versions are available on request.