Privacy Policy
Who we are
Windsor Cardiac Clinic Limited ("we", "us") is the data controller for the personal information we hold about you. This notice explains what we collect, why, who we share it with, how long we keep it and your rights.
| Controller | Windsor Cardiac Clinic Limited, company number 12673732, registered in England and Wales |
|---|---|
| Registered office | Suite 585, 24-28 St. Leonards Road, Windsor, Berkshire, SL4 3BB |
| Registered Manager | Dr Paresh Mehta |
| ICO registration number | ZB245569 |
| CQC provider ID | 1-11308424377 |
| Data protection contact | Data Protection Officer / Data Protection Lead Dr Paresh Mehta, pa@windsorcardiacclinic.co.uk, 020 8866 9682 |
| Caldicott Guardian | Dr Paresh Mehta |
We see patients at Berkshire Grove Hospital, Grove House, Waltham Road, White Waltham, Maidenhead SL6 3TN. Where a hospital provides facilities or tests for your care, it may also hold records about you as a separate controller and will have its own privacy notice.
Our doctors are bound by the common law duty of confidentiality and General Medical Council guidance, as well as data protection law.
What we collect and where it comes from
We collect only what we need to arrange and provide your care, run the clinic and meet our legal duties.
Information about you
- Identity and contact details: name, date of birth, sex, address, phone, email, and next of kin or emergency contact.
- Health information: symptoms, medical history, medications, test results (ECGs, echocardiograms, monitor recordings, scans), diagnoses, treatment plans, letters and reports.
- Other special category information, only where relevant to your care: for example ethnicity, where it affects clinical risk.
- Insurance and payment details: insurer, policy and authorisation numbers, invoices and payment records. Card payments are processed by Xero and Stripe; we do not store full card numbers.
- Correspondence: enquiries, emails, call notes, complaints and feedback.
- Website information: what you submit through our contact form, and technical data described under Website and cookies.
Where it comes from
- You, when you contact us, complete forms or attend appointments.
- Your GP or another referring clinician.
- Your insurer, when you use private medical insurance.
- Hospitals, imaging providers and laboratories involved in your care.
- A relative or carer, where you have asked them to act for you.
If you give us details about someone else, such as a next of kin, please let them know.
How we use it and our lawful bases
We use your health information mainly to provide your care. Under UK GDPR we must have a lawful basis for each use (Article 6) and, for health information, an additional condition (Article 9). We do not rely on your consent to provide care, so you will not be asked to consent to routine use of your records.
| Purpose | Lawful basis (Article 6) | Health data condition (Article 9) |
|---|---|---|
| Responding to your enquiry and booking appointments | Steps before a contract, 6(1)(b) | Health or social care, 9(2)(h) |
| Assessing, diagnosing and treating you, including tests and reports | Contract, 6(1)(b) | Health or social care, 9(2)(h) |
| Writing to your GP and referring clinicians | Legitimate interests in continuity of care, 6(1)(f) | Health or social care, 9(2)(h) |
| Billing you or your insurer | Contract, 6(1)(b) | Health or social care, 9(2)(h); legal claims, 9(2)(f) |
| Keeping clinical records, clinical audit and safety reporting | Legal obligation, 6(1)(c) | Health or social care, 9(2)(h); public health, 9(2)(i) |
| Handling complaints and incidents | Legal obligation, 6(1)(c) | Health or social care, 9(2)(h) |
| Meeting CQC, GMC and other regulatory requirements | Legal obligation, 6(1)(c) | Health or social care, 9(2)(h) |
| Defending legal claims | Legitimate interests, 6(1)(f) | Legal claims, 9(2)(f) |
| Patient satisfaction surveys | Legitimate interests in improving care, 6(1)(f) | Not needed (no health data used) |
| Protecting you or others in an emergency | Vital interests, 6(1)(d) | Vital interests, 9(2)(c) |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can object at any time (see Your rights).
Health information is used for 9(2)(h) only by, or under the responsibility of, health professionals bound by a duty of confidentiality, as required by the Data Protection Act 2018.
Marketing. We do not use your information for marketing. If we ever want to, we will ask for your consent first.
Automated decisions. We do not make decisions about you by automated means alone.
Who we share it with
We share only what each recipient needs, and we never sell your information.
| Recipient | Why |
|---|---|
| Your GP and referring clinician | To keep them informed of your care, unless you ask us not to |
| Consultants, radiologists and physiologists in our team | To provide, report on and review your care |
| Berkshire Grove Hospital | They provide the rooms, equipment and some tests for your care |
| Imaging centres, laboratories and other hospitals | When you are referred for tests or treatment elsewhere |
| Your insurer | To get authorisation and settle invoices, when you use insurance |
| Our IT, clinical systems, email and secure messaging suppliers | To host and run our systems, under contract and our instructions |
| Payment processor Xero/Stripe | To take card payments |
| Regulators and official bodies (CQC, GMC, PHIN, NHS England, UKHSA) | Where the law requires it, or for national audits and registries |
| Police, courts and safeguarding authorities | Where the law requires it, or to protect someone from serious harm |
| Our insurers and legal advisers | If there is a claim or complaint |
| People you nominate, such as a relative or carer | Only with your agreement |
Our suppliers act as processors: they may use your information only on our instructions and must keep it secure.
Transfers outside the UK
We store your information in the UK. Where a transfer happens, we use a UK adequacy decision, or the International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses. You can ask us for a copy of the safeguards.
How long we keep it
We follow the NHS Records Management Code of Practice for Health and Social Care, then securely destroy records.
| Record | How long we keep it |
|---|---|
| Adult clinical records | 8 years after your last treatment |
| Clinical records for patients treated under 18 | We do not treat under 18's |
| Records of patients who have died | 8 years after death |
| Enquiries that do not lead to an appointment | 12 months |
| Invoices and payment records | 6 years after the end of the financial year |
| Complaints | 10 years after closure |
| Call recordings | 12 months, if applicable |
We may keep records longer where there is a legal claim, an investigation or a regulatory requirement.
Your rights
You have the following rights over your information. Some are limited for clinical records; we will explain if a limit applies.
- Access: a copy of the information we hold about you. This is free, and we reply within one month (up to three months more for complex requests).
- Rectification: correcting inaccurate facts. A clinical opinion cannot be changed, but we can add your comments to your record.
- Erasure: deleting information. We usually cannot delete clinical records during the retention periods above.
- Restriction: limiting how we use your information while a concern is checked.
- Objection: objecting to uses based on legitimate interests, for example surveys.
- Portability: receiving information you gave us in a portable format, where the use is based on contract.
- Withdrawing consent: where we rely on consent, you can withdraw it at any time.
To use any right, email pa@windsorcardiacclinic.co.uk or write to us. We may ask you to confirm your identity first.
Website and cookies
Contact form. Information you send through our website goes to our clinic team to answer your enquiry. Please don't include detailed medical information in the form. If you have chest pain or think you are having a heart attack, call 999.
Cookies. We use strictly necessary cookies to make the site work. We set analytics cookies and load Google Maps, which sets its own cookies, only if you agree through our cookie banner. You can change your choice at any time using Cookie settings.
How we use cookies
A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.
We have tried to cover all cookies in this list that we or our service providers use. Please be aware that there may be a delay in updating this list. If you do notice any discrepancies please be sure to let us know.
Content management and responsibility
Windsor Cardiac Clinic, and the hosts of this website, accept no responsibility for, and exclude all liability in connection with browsing this website, use of information on this website and downloading any material from it, including, but not limited to, any liability for errors, inaccuracies, omissions or misleading or defamatory statements.
Downloads
Although every reasonable effort is made to ensure that files are free of defects and viruses, there are no guarantees that they are free from defects or computer viruses. Therefore, no warranty or guarantee is given by Windsor Cardiac Clinic, regarding files downloaded or accessed through Windsor Cardiac Clinic's website or through a link accessed via Windsor Cardiac Clinic's website.
Website contents
This website is intended to enable information relevant to the work of Windsor Cardiac Clinic, to be freely available on the World Wide Web. Whilst Windsor Cardiac Clinic hopes you find this website interesting and informative, the contents are for general information only. Windsor Cardiac Clinic believes the contents to be true and accurate as at the date of writing, but can give no assurances or warranties regarding the accuracy, currency or applicability of any of this website's contents. As such, the contents of this website should not be relied upon. In addition, none of the content of this website will form any contract between Windsor Cardiac Clinic and any user of the website, nor constitute any offer by Windsor Cardiac Clinic. The use of and access to pages of the Windsor Cardiac Clinic website is subject to the foregoing disclaimer, and the terms and conditions set out below. By using or accessing this website, you agree to be bound by these terms and conditions.
Windsor Cardiac Clinic shall not be liable for any loss or damage howsoever arising in connection with the content of the website. Windsor Cardiac Clinic does not guarantee that the website will be error-free, omission-free, uninterrupted or without delay.
Website security
Whilst Windsor Cardiac Clinic makes all reasonable attempts to exclude viruses from the website, we cannot guarantee that the website will be virus free and accept no liability in the unlikely event that the website is not virus free.
Users are recommended to take appropriate safeguards before downloading information from this website.
Access to information
Windsor Cardiac Clinic will not share your confidential information with anyone outside of Windsor Cardiac Clinic. You are prohibited from posting or transmitting, to and from, the website any unlawful, threatening, defamatory, obscene, and pornographic or other material which would violate any law.
Unless otherwise specified, the materials on this website are directed solely at those who access this website from the United Kingdom mainland. Windsor Cardiac Clinic makes no representation that any information, product or services referred to in the materials on this website are appropriate for use, or available, in other locations. Those who choose to access this website from other locations are responsible for compliance with local laws if and to the extent local laws are applicable.
We are committed to respecting and protecting your privacy when we deal with your personal information. The following privacy notice gives you details on the information we collect about you, how we protect and use it, and your rights. If you have any questions about how we use your information, please email us at pa@windsorcardiacclinic.co.uk.
Further information can be provided from our Data Protection Officer on pa@windsorcardiacclinic.co.uk.
Keeping your information secure
We use access controls, encryption, secure clinical systems, staff confidentiality agreements and data protection training. We report serious data breaches to the ICO and tell you without undue delay if a breach is likely to put you at high risk. Email is not fully secure, so please use it for clinical information only if you are comfortable doing so.
Changes to this notice
We review this notice at least once a year. This version took effect on 01/11/2026. If we make significant changes, we will tell you.