healthXY Ltd is committed to protecting your privacy and ensuring that your personal information is handled lawfully, fairly and transparently.
This Privacy Policy explains how personal information is collected, used, shared and protected when you receive healthcare from the private practices of Professor Prabhakar Rajan or Mr Benjamin Lamb, contact us, or use our website and related services.
We recognise the confidential nature of healthcare information and process your personal data in accordance with:
• the UK General Data Protection Regulation (UK GDPR);
• the Data Protection Act 2018;
• applicable common law duties of confidentiality;
• professional guidance issued by the General Medical Council (GMC); and
• other applicable UK laws governing healthcare information.
Please read this Privacy Policy carefully. It explains what information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over your personal information.
Who is responsible for your personal data?
For the purposes of UK data protection legislation, the data controllers responsible for your clinical care and medical records are:
• Professor Prabhakar Rajan, in relation to patients receiving care through his private practice.
• Mr Benjamin Lamb, in relation to patients receiving care through his private practice.
Each consultant is independently responsible for decisions regarding the clinical information collected and processed in connection with the healthcare they provide.
About healthXY Ltd
healthXY Ltd provides marketing, administrative and practice management services to the private practices of Professor Prabhakar Rajan and Mr Benjamin Lamb.
Administrative functions undertaken by healthXY Ltd include:
• appointment booking and scheduling;
• patient communications;
• practice administration;
• management of referrals;
• coordination with hospitals and healthcare providers;
• maintaining administrative records;
• responding to patient enquiries; and
• supporting the day-to-day operation of the consultants’ private practices.
healthXY Ltd processes personal information only as necessary to perform these administrative functions and is subject to appropriate contractual confidentiality and data protection obligations.
Medical Billing
Medical billing services are provided by The Invoice Company Services Ltd on behalf of the consultants’ private practices.
Professional fees are charged by the relevant consultant through their professional company:
• Urovia Ltd – Professor Prabhakar Rajan
• Lamb Urology Consultants Ltd – Mr Benjamin Lamb
Accordingly:
• appointment confirmations, reminders and administrative correspondence may be sent by healthXY Ltd;
• invoices relating to professional fees will normally be issued by the relevant consultant’s professional company; and
• billing administration may be undertaken by The Invoice Company Services Ltd.
These organisations work together solely to support the administration of the consultants’ private practices.
What personal information do we collect?
Depending upon the services you receive, we may collect the following categories of personal information.
Personal information
This may include:
• your name;
• date of birth;
• postal address;
• email address;
• telephone number;
• NHS number (where relevant);
• private medical insurance details;
• emergency contact information;
• next of kin details; and
• information relating to appointments and correspondence.
Where you provide personal information about another individual (for example, your next of kin), you are responsible for ensuring that you have their permission to provide this information.
Health information
Healthcare providers are required to maintain accurate clinical records. We may therefore collect information including:
• presenting symptoms;
• medical history;
• previous illnesses;
• medications;
• allergies;
• examination findings;
• diagnoses;
• investigation results;
• imaging reports;
• pathology results;
• operative records;
• treatment plans;
• correspondence with other healthcare professionals;
• follow-up information; and
• clinical outcomes.
Health information is treated as confidential and is processed only for purposes connected with your healthcare or as otherwise permitted or required by law.
Administrative and financial information
We may also collect information including:
• referral letters;
• GP details;
• hospital details;
• appointment history;
• billing information;
• payment records;
• insurance authorisations;
• insurer correspondence;
• invoice records; and
• communications relating to your care.
Website information
When you visit our website, we may automatically collect limited technical information including:
• IP address;
• browser type;
• operating system;
• device information;
• pages visited;
• date and time of access;
• referring website; and
• information collected through cookies and similar technologies.
This information helps us maintain website security, improve website performance and better understand how visitors use our website.
How do we collect your information?
We collect personal information in a number of ways, including when you:
- contact us by telephone, email, online enquiry or through our website;
- book or attend an appointment;
- complete registration or medical history forms;
- are referred by your GP, another consultant or another healthcare provider;
- provide information during consultations or treatment;
- undergo investigations or procedures;
- make payments or provide insurance information;
- communicate with our administrative team;
- provide feedback regarding our services; or
- use our website or online services.
We may also receive information from:
- your GP;
- referring clinicians;
- hospitals or clinics involved in your care;
- diagnostic providers;
- pathology laboratories;
- imaging providers;
- your private medical insurer;
- other healthcare professionals involved in your treatment; or
- organisations authorised by you to provide information relating to your care.
Where appropriate, telephone calls made to or received by our administrative team may be recorded for purposes including staff training, quality assurance, maintaining accurate records and supporting the safe administration of patient care.
How do we use your personal information?
We use your personal information only where it is necessary to provide healthcare services, administer your care, comply with legal obligations or manage our professional practice.
Providing your healthcare
We use your information to:
- assess your symptoms and medical condition;
- diagnose medical conditions;
- recommend investigations;
- provide medical advice;
- undertake surgical or non-surgical treatment;
- maintain accurate clinical records;
- arrange follow-up appointments;
- monitor your progress; and
- ensure continuity of care.
Managing your care
We use your information to:
- arrange appointments;
- send appointment confirmations and reminders;
- coordinate investigations and procedures;
- communicate with hospitals and healthcare providers;
- manage referrals;
- respond to your enquiries;
- maintain administrative records; and
- support the day-to-day management of your care.
Billing and financial administration
We use your information to:
- prepare invoices;
- administer payments;
- process private medical insurance claims;
- obtain treatment authorisation from insurers;
- verify insurance details;
- respond to insurer enquiries;
- manage outstanding balances;
- maintain financial records; and
- comply with accounting and taxation requirements.
Billing administration may be undertaken by The Invoice Company Services Ltd on behalf of the consultants’ private practices.
Quality improvement
We continually review our services to ensure that patients receive high-quality care. This may include:
- reviewing clinical outcomes;
- undertaking clinical audit;
- investigating complaints;
- monitoring patient safety;
- reviewing incidents;
- evaluating patient experience; and
- improving our administrative processes.
Where possible, information used for audit, reporting or service evaluation will be anonymised or aggregated.
Patient feedback
We may invite you to provide feedback regarding your experience of our services. Feedback may be collected through patient surveys or independent review platforms. Any feedback you choose to provide will be used to improve the quality of our services. We will never publish confidential medical information or identify you as a patient without your explicit permission.
Our legal basis for processing your information
UK data protection legislation requires us to identify the legal basis upon which personal information is processed.
Healthcare information
Health information is classified as “special category personal data” under UK GDPR. We process this information because it is necessary for:
- the provision of healthcare;
- medical diagnosis;
- medical treatment;
- management of healthcare services;
- maintaining clinical records;
- ensuring patient safety; and
- complying with legal and professional obligations.
Where required, processing is undertaken in accordance with Article 6 and Article 9 of the UK General Data Protection Regulation together with the Data Protection Act 2018.
Administrative information
We process administrative information because it is necessary:
- to fulfil our contract with you;
- to administer your appointments and treatment;
- to manage billing and payments;
- to comply with legal obligations;
- to protect our legitimate business interests; and
- to maintain appropriate business records.
Marketing
We do not use your health information for marketing purposes. Where we send newsletters or other marketing communications, we will only do so where permitted by law and, where required, with your consent. You may withdraw your consent to receive marketing communications at any time.
Who do we share your information with?
We only share your personal information where it is necessary to provide your healthcare, administer your private care, comply with legal or regulatory obligations, or where you have asked us to do so. Depending on the care you receive, we may share relevant information with the following organisations or individuals.
Healthcare providers
Where necessary for your care, we may share information with:
- hospitals and clinics where you receive treatment;
- your General Practitioner (GP);
- referring clinicians;
- other consultants involved in your care;
- anaesthetists;
- radiologists and imaging providers;
- pathology laboratories;
- specialist nurses and allied healthcare professionals;
- pharmacists; and
- other healthcare professionals involved in your diagnosis or treatment.
We will only share the information necessary to support your care.
Administrative support providers
To help us manage our private practices, we may share relevant personal information with:
- healthXY Ltd, which provides marketing, administrative and practice management support;
- The Invoice Company Services Ltd, which provides medical billing services on behalf of the consultants’ private practices; and
- Carebit, which supports appointment scheduling, patient communications and practice management.
These organisations process personal information only for the purposes of providing services on our behalf and are subject to appropriate contractual confidentiality and data protection obligations.
Private medical insurers
Where your treatment is funded by private medical insurance, we may share information with your insurer or its authorised representatives in order to:
- obtain treatment authorisation;
- process insurance claims;
- verify treatment;
- administer billing; and
- facilitate payment.
Only information reasonably necessary for these purposes will be provided.
Professional advisers and service providers
Where necessary, we may also share information with trusted professional advisers and service providers, including:
- accountants;
- auditors;
- legal advisers;
- professional indemnity insurers;
- IT service providers;
- secure cloud hosting providers; and
- providers of secure digital technologies used to support our clinical or administrative services.
These organisations are required to maintain appropriate confidentiality and security standards and process personal information only in accordance with applicable data protection legislation.
Website and digital services
Our website uses trusted third-party providers to support website functionality, analytics and patient engagement.
These may include:
- Google Analytics, to help us understand how visitors use our website;
- Google Reviews, where patients choose to leave public reviews;
- Doctify, which provides consultant profiles and patient review services; and
- Top Doctors, which provides consultant profiles and facilitates appointment enquiries.
We do not routinely disclose your confidential clinical records or health information to Google Reviews, Doctify or Top Doctors. If you choose to submit a review or enquiry through these services, any information you provide will be processed directly by the relevant organisation in accordance with its own privacy policy.
Legal and regulatory disclosures
We may disclose personal information where required or permitted by law, including to:
- the Care Quality Commission (CQC);
- the General Medical Council (GMC);
- the Information Commissioner’s Office (ICO);
- NHS organisations where appropriate;
- courts and tribunals;
- law enforcement agencies; and
- other public authorities exercising lawful powers.
We will always seek to disclose only the minimum information necessary to meet the relevant legal or regulatory requirement.
Sharing information with your GP
Where clinically appropriate, we will normally communicate with your GP to support safe and effective continuity of care.
If you ask us not to share information with your GP, we will carefully consider your request. However, there may be circumstances where sharing information is necessary to protect your health or comply with our professional obligations.
Sharing information with hospitals
Where you receive treatment in a hospital or clinic, we will share the information necessary for your care. Hospitals and clinics are usually independent data controllers and maintain their own clinical records in accordance with applicable legal and professional requirements.
Private medical insurers
Where your treatment is funded by private medical insurance, we may share information necessary to:
- obtain authorisation;
- process claims;
- verify treatment;
- provide invoices;
- respond to insurer queries; and
- facilitate payment.
Only information reasonably necessary for these purposes will be shared.
Legal and regulatory disclosures
We may disclose information where required or permitted by law, including to:
- the Care Quality Commission (CQC);
- the General Medical Council (GMC);
- the Information Commissioner’s Office (ICO);
- NHS organisations where relevant;
- the courts;
- law enforcement agencies; or
- other public authorities exercising lawful powers.
Where appropriate, we will disclose only the minimum information necessary.
Website, Cookies and Online Services
When you visit our website, we may collect limited technical information about your device and your use of the website through cookies and similar technologies.
Cookies are small text files that are placed on your device when you visit a website. They help websites function correctly, improve security, remember your preferences and provide information about how visitors use a website.
Types of cookies we use
Essential Cookies
These cookies are necessary for the operation, security and functionality of our website. They enable core features such as page navigation, security, online forms and other services that you request.
Because these cookies are essential for the website to function, they cannot be disabled through our website.
Analytics Cookies
We use Google Analytics to help us understand how visitors use our website. Google Analytics collects information such as:
- pages visited;
- time spent on the website;
- browser and device type;
- approximate geographic location; and
- how visitors navigate our website.
This information is aggregated wherever possible and helps us improve the content, performance and usability of our website.
Where required by law, Google Analytics cookies will only be used with your consent.
Third-Party Services
Our website may incorporate or link to services provided by trusted third-party organisations, including:
- Google Reviews, allowing visitors to view or leave public reviews about our services.
- Doctify, providing consultant profiles, patient reviews and information about our services.
- Top Doctors, providing consultant profiles and facilitating appointment enquiries.
- Carebit, which supports online appointment booking, patient communications and aspects of practice management.
These providers may place cookies or collect information when you interact with their services through our website. Any personal information you choose to provide directly to these organisations will be processed in accordance with their own privacy policies.
We do not routinely share your confidential clinical records or health information with Google Reviews, Doctify or Top Doctors. If you choose to submit a review or enquiry through these services, you do so voluntarily and your information will be processed by the relevant provider in accordance with its own privacy policy.
Where Carebit processes personal information on our behalf in connection with appointment booking, patient communications or practice administration, it does so under appropriate contractual data protection obligations.
Managing Cookies
Where required by law, we will ask for your consent before placing non-essential cookies on your device.
You can withdraw or change your cookie preferences at any time using our website’s cookie preference settings (where available). You may also manage or delete cookies through your web browser settings.
Please note that disabling certain cookies may affect the functionality and performance of our website.
Further information about cookies and your rights can be found on the Information Commissioner’s Office (ICO) website at www.ico.org.uk.
Marketing Communications
We do not use your health information for marketing purposes. If you have requested information about our services or subscribed to receive newsletters or updates, we may occasionally send information that we believe may be of interest to you.
Where your consent is required by law, we will only send marketing communications if you have given that consent. You may withdraw your consent or unsubscribe from marketing communications at any time by contacting us or by using the unsubscribe link included in our communications. Administrative communications relating to your appointments, treatment, investigations, billing or follow-up care are not marketing communications and may continue to be sent where necessary.
How long do we keep your information?
We retain personal information only for as long as necessary for the purposes for which it was collected and in accordance with applicable legal, regulatory and professional requirements. Clinical records are retained in accordance with NHS Records Management Code of Practice (where applicable), professional guidance and other applicable record retention requirements for independent healthcare providers. Administrative and financial records are retained for the periods required by tax, accounting and other legal obligations. Once information is no longer required, it will be securely deleted, destroyed or anonymised where appropriate.
International Transfers
Most of the personal information we process is stored within the United Kingdom. Where it is necessary to transfer personal information outside the United Kingdom, we will ensure that appropriate safeguards are in place in accordance with UK data protection legislation. These safeguards may include the use of adequacy regulations, the UK International Data Transfer Agreement (IDTA), or other lawful transfer mechanisms.
Keeping your information secure
Protecting the confidentiality of your personal information is fundamental to the way we provide healthcare.
We maintain appropriate technical and organisational measures designed to protect personal information against:
- unauthorised access;
- accidental loss;
- destruction;
- misuse;
- disclosure;
- alteration; and
- cyber security threats.
Examples of these measures include:
- encrypted systems where appropriate;
- secure password management;
- restricted staff access based upon roles;
- confidentiality agreements;
- secure electronic communication systems;
- regular software updates and security monitoring; and
- secure destruction of confidential records.
Although we take appropriate security measures, no method of electronic transmission or internet storage can be guaranteed to be completely secure.
Artificial Intelligence and Digital Technologies
We may use secure digital technologies, including software incorporating artificial intelligence (AI), to support the delivery and administration of healthcare services. These technologies may assist with activities such as:
- drafting clinical correspondence;
- preparing consultation summaries;
- administrative tasks;
- appointment management;
- document management;
- coding and practice administration; and
- improving the efficiency of our services.
AI technologies are used only as tools to support our clinical and administrative processes. They do not replace the professional judgement or clinical decision-making of your consultant. Where third-party AI or software providers process personal information on our behalf, they do so under contractual agreements requiring them to:
- comply with UK data protection legislation;
- maintain appropriate technical and organisational security measures;
- protect the confidentiality of patient information; and
- process personal information only in accordance with our instructions.
Where appropriate, we will seek to minimise the amount of personal information processed and use anonymised or pseudonymised information wherever practicable. We continually review the use of digital technologies to ensure they remain appropriate, secure and consistent with our professional and legal obligations.
Your rights
Under UK data protection legislation you have a number of rights regarding your personal information. These include the right to:
- request access to the personal information we hold about you;
- request correction of inaccurate or incomplete information;
- request restriction of processing in certain circumstances;
- object to certain types of processing where applicable;
- request transfer of your personal information where legally applicable;
- request erasure of personal information where the law permits; and
- withdraw consent where processing is based on consent.
Please note that these rights are not absolute and may be subject to legal or professional obligations, particularly in relation to clinical records. To exercise any of your rights, please contact us using the details below. For your protection, we may ask you to verify your identity before responding to your request.
Complaints
If you have any concerns about how your personal information has been handled, we encourage you to contact us first so that we have the opportunity to investigate and resolve your concerns. If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Website: www.ico.org.uk
Telephone: 0303 123 1113
Address:
Information Commissioner’s Office
Wycliffe House, Water Lane,
Wilmslow,
Cheshire,
SK9 5AF
Changes to this Privacy Policy
We keep this Privacy Policy under regular review and may update it from time to time to reflect changes in legal requirements, professional guidance or the way our private practices operate. The latest version will always be available on our website. We encourage you to review this Privacy Policy periodically.
Contact us
If you have any questions about this Privacy Policy or how your personal information is handled, please contact:
Email: admin@healthxy.co.uk
Website: www.healthxy.co.uk
Administrative enquiries received by healthXY Ltd will be directed to the appropriate consultant’s private practice where necessary.