Chase Lodge Hospital is the data controller for personal information used to operate the hospital and provide services where it decides how and why that information is processed.
Chase Lodge Hospital, trading as Chase Lodge Hospital
Hospital address: Chase Lodge Hospital, Page Street, Mill Hill, London NW7 2ED.
Privacy contact: Dr Ibrahim Yahli. Until confirmed, enquiries may be sent to info@chaselodgehospital.com or made by telephone on 020 8358 7100.
Some independent consultants, laboratories, imaging providers, pharmacies and other clinicians may act as separate data controllers for the care they provide. Where this applies, they are responsible for explaining how they use your information.
2 The information we collect
The information we collect depends on your relationship with us and the services you use. It may include:
Identity and contact details, including:
your name, date of birth, address, telephone number, email address, NHS number or other patient identifier; details needed to verify identity, parental responsibility, authority to act for another person or eligibility for a service; health and care information, including symptoms, diagnoses, medical and family history, medication, allergies, test and imaging results, photographs, treatment plans, clinical notes, referral letters and correspondence; information about disability, accessibility, communication, cultural or religious needs where relevant to safe and appropriate care; payment, billing, insurance, authorisation and claims information; appointment, attendance, telephone, email, online-form and complaint records; information about your next of kin, emergency contacts, GP, referrer and other professionals involved in your care;
CCTV images and access or security records when you visit our premises; website and device information, including IP address, browser type, pages viewed and cookie or analytics data; and marketing preferences and records of communications you choose to receive.
Health data is special category personal data. We may also process other sensitive information when it is relevant to your care or when the law requires or permits us to do so.
3 Where the information comes from
We usually obtain information directly from you or from a parent, guardian, carer or authorised representative. We may also receive it from your GP, consultant, dentist, therapist, hospital, pharmacy, diagnostic provider, laboratory, insurer, employer or another organisation funding or arranging your care. In urgent or safeguarding situations, information may come from emergency services, public authorities or others involved in protecting you or another person.
We may receive technical information automatically when you use our website. If information comes from another source, we will provide privacy information when required by law unless an exemption applies.
4 Why we use information and our lawful bases
We only use personal information when we have a lawful basis under the UK GDPR. When we use health information or another special category of data, we also identify an additional condition for doing so.
| Purpose | Article 6 basis | Special category condition |
| Arrange and provide healthcare | Contract; legitimate interests; vital interests or legal obligation where applicable | Health or social care and treatment; vital interests in an emergency |
| Maintain clinical records and continuity of care | Contract; legal obligation; legitimate interests | Health or social care and treatment |
| Tests, imaging, prescriptions, referrals and follow-up | Contract; legal obligation; legitimate interests | Health or social care and treatment |
| Payments, insurer authorisation and claims | Contract; legal obligation; legitimate interests | Health or social care and treatment, or legal claims where health data is involved |
| Safeguarding and serious safety concerns | Legal obligation; vital interests; public task where applicable | Vital interests; substantial public interest; health or social care |
| Clinical governance, audit, incident review and service quality | Legal obligation; legitimate interests | Health or social care; substantial public interest where applicable |
| Complaints, disputes and legal claims | Legal obligation; legitimate interests | Establishment, exercise or defence of legal claims |
| Security, fraud prevention and CCTV | Legitimate interests; legal obligation | Substantial public interest or legal claims if special category data is involved |
| Respond to enquiries and manage the website | Steps before a contract; legitimate interests; consent for non-essential cookies | Explicit consent or health or social care where an enquiry contains health data |
| Marketing | Consent, or legitimate interests where permitted | We do not intentionally use health data for marketing without explicit consent |
Our legitimate interests include operating a safe and effective hospital, communicating with patients, preventing fraud, securing our premises and systems, improving services and protecting or defending legal rights. We balance those interests against your rights and reasonable expectations.
We do not rely on consent to provide ordinary clinical care where another lawful basis applies. If we do rely on consent, you may withdraw it at any time, although this does not affect processing that took place before withdrawal.
5 When you must provide information
You may choose whether to make an enquiry or receive marketing. However, we need certain identity, contact, health and payment information to assess you safely, provide treatment, keep an appropriate clinical record and meet legal obligations. If you do not provide necessary information, we may be unable to offer or continue a service. We will explain this where relevant.
6 Children and young people
We provide services to children and young people and take particular care with their information. Depending on the child’s age, understanding and the circumstances, information may be provided by or shared with a person who has parental responsibility. A child who has sufficient understanding may exercise data protection rights independently. We will consider confidentiality, safeguarding duties and the child’s best interests in each case.
7 Who we share information with
We share the minimum information reasonably necessary for the relevant purpose. Recipients may include:
consultants, GPs, nurses, dentists, pharmacists, therapists and other professionals involved in your care; diagnostic imaging providers, laboratories, pathology services, pharmacies and other clinical service providers; your GP, referrer or another care provider, where appropriate for safe and coordinated care; private medical insurers, sponsors, employers or other funders, subject to the authority and confidentiality arrangements that apply; payment processors, appointment and clinical-record system providers, IT, hosting, secure communications, document-storage and other suppliers acting under contract; professional advisers, auditors, accreditation bodies and regulators, including the Care Quality Commission, where applicable; public authorities, courts, law-enforcement bodies, safeguarding organisations or emergency services where the law requires or permits disclosure; and a prospective buyer, investor or adviser in connection with a restructuring or sale, subject to appropriate confidentiality and data-protection safeguards.
We will not sell your personal information. We do not permit suppliers acting as processors to use it for their own purposes and require them to protect it and follow our instructions.
Medical confidentiality remains important. We may share information without consent where this is required by law or justified to protect you or another person from serious harm, support safeguarding, prevent or detect serious crime, respond to a court order or defend legal rights.
8 Private medical insurance and third party funding
If an insurer, employer or another organisation pays for or arranges your care, we may provide information needed to verify cover, obtain authorisation, submit invoices, manage claims and answer reasonable queries. This may include clinical information where necessary. We will not routinely give an employer detailed medical information without an appropriate lawful basis and, where required, your permission.
9 Website forms cookies and analytics
When you submit an enquiry or booking form, we use the details you provide to respond, arrange an appointment and administer the requested service. Please avoid including more health information than is necessary in an unencrypted website form.
Our website may use strictly necessary cookies to operate and secure the site. Analytics, advertising and other non-essential cookies should only be used after you have made a choice through the cookie banner. You can change your preference or delete cookies through the website controls or your browser. A separate cookie notice should list each cookie, its provider, purpose and duration.
Our pages may include content or links from third parties, such as map, video, booking, analytics or social-media providers. Those providers may process information under their own privacy notices. Their inclusion does not make us responsible for their independent processing.
10 Marketing communications
We may send service messages about appointments, treatment, safety or administration because they are part of delivering care and are not marketing.
We will send promotional emails or text messages only where we have the permission or another lawful route required by data protection and electronic marketing law. You can opt out at any time by using the unsubscribe method in the message or contacting us. Opting out of marketing will not affect clinical or essential service communications.
We do not use clinical information to target marketing unless we have a clear lawful basis and, where required, explicit consent.
11 CCTV and premises security
CCTV may operate in appropriate public and access areas for safety, security, incident investigation and the prevention and detection of crime. Signs identify monitored areas. Cameras should not be used in locations where people reasonably expect a high degree of privacy. Footage is accessed only by authorised people and disclosed when there is a lawful reason.
12 International transfers
Some technology or support providers may store or access information outside the United Kingdom. Where personal information is transferred internationally, we will use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, and apply additional safeguards where required. You may contact us for more information about safeguards relevant to your data.
13 How we protect information
We use proportionate technical and organisational measures designed to protect personal information against loss, misuse, unauthorised access, alteration or disclosure. Measures may include role-based access, authentication, encryption, secure backups, logging and monitoring, staff confidentiality and training, supplier due diligence, incident management and physical security.
No system or transmission method is completely secure. If a personal data breach creates a risk to people, we will assess it, take appropriate action and notify the Information Commissioner’s Office and affected individuals when the law requires.
14 How long we keep information
We keep information only for as long as necessary for care, patient safety, legal and regulatory obligations, complaints or claims, and legitimate business needs. Our approved retention schedule should reflect applicable healthcare records guidance and professional requirements. Records may be kept longer where litigation, an investigation, safeguarding, a preservation requirement or another lawful reason applies.
| Record type | Indicative approach to retention |
| Adult clinical records | Generally 8 years after the end of treatment, unless a longer period applies |
| Children’s clinical records | Generally until the 25th birthday, or 26th birthday if treatment ends at age 17, unless a longer period applies |
| Certain specialist records | Longer periods may apply, including to maternity, oncology, mental health, implant and other records |
| Financial and tax records | Normally 6 years plus the current financial year, subject to legal requirements |
| CCTV | Usually a short period appropriate to security needs, unless footage is required for an incident or investigation |
| Enquiries not leading to treatment | For a limited period needed to respond and manage follow-up |
| Marketing records | Until consent is withdrawn or an objection is made, with a suppression record retained to respect the preference |
The periods above are indicative and must be checked against Chase Lodge Hospital’s approved retention schedule before publication. When information is no longer required, we securely delete, anonymise or destroy it.
15 Your data protection rights
Depending on the circumstances and lawful basis, you may have the right to:
be informed about how your personal information is used;
request access to personal information held about you;
ask us to correct inaccurate or incomplete information;
ask us to erase information in certain circumstances;
ask us to restrict processing in certain circumstances;
object to processing based on legitimate interests or to direct marketing;
receive certain information in a portable format where the right applies;
withdraw consent at any time where we rely on consent; and
ask for safeguards relating to decisions made solely by automated means where such processing applies.
These rights are not absolute. For example, we may need to retain clinical information for patient safety, professional, regulatory or legal reasons. Information about another person may also need to be protected.
Your right to object: you have an absolute right to object to the use of your personal information for direct marketing. You may also object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims.
To exercise a right, contact the privacy contact shown in section 1. We may ask for information to verify your identity and authority. There is normally no fee, and we will respond within the period required by law. If a request is complex or repeated, the law may allow more time; we will tell you if this applies.
16 Access to health records after death
Data protection law generally applies to living individuals. Requests for the health records of a deceased person are considered under other applicable law and duties of confidentiality. Access is limited and may depend on the requester’s legal status, the purpose of the request and any wishes recorded by the patient.
17 Automated decision making
We do not currently make decisions about access to or provision of care based solely on automated processing where the decision would have a legal or similarly significant effect. If this changes, we will provide the information and safeguards required by law.
18 Complaints and the Information Commissioner
Please contact us first if you have a question or concern about how we use your information. We will investigate and aim to resolve the matter.
You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator:
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
19 Changes to this policy
We may update this policy when our services, systems, suppliers or legal obligations change. The latest version will be published on our website with its effective date. We will draw attention to material changes where appropriate.
Legal framework
This draft is designed around the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and relevant healthcare confidentiality and records-management requirements, taking account of the Data (Use and Access) Act 2025. It is not a substitute for advice on Chase Lodge Hospital’s specific legal entity, systems and processing activities.