Enquiries and appointments
To respond, arrange appointments and take steps requested before providing a service. We may rely on contract, steps before a contract and legitimate interests in running a safe and effective clinic.
Privacy notice
Your information and your care
This notice explains what personal information Resolve MSK Clinic Ltd handles, why it is needed and the choices and rights available to you.
1. Who this notice applies to
This notice applies to people who visit the Resolve MSK Clinic website, contact the clinic, make or manage an appointment, receive care, act on behalf of a patient, supply services to the clinic or otherwise communicate with us.
Resolve MSK Clinic Ltd is the data controller for personal information it decides how and why to use. A booking, payment or communication provider may also act as a separate controller for parts of its own service; its privacy information will apply alongside this notice.
2. Information we may collect
- Identity and contact details, including name, date of birth, address, telephone number and email address.
- Appointment, communication, payment and administrative information.
- Health information relevant to safe assessment and care, including symptoms, medical history, medicines, allergies, examination findings, clinical opinions, treatment, consent, outcomes and relevant reports or images.
- Information provided by a GP, specialist, insurer, family member or other person involved in your care where there is an appropriate reason to receive it.
- Website and device information, including pages viewed and interactions, when optional analytics has been accepted.
Health information is special category data under UK data protection law and receives additional protection.
3. Why we use information and our lawful bases
Assessment and clinical care
To assess, document and provide health care, communicate about care and maintain appropriate records. We rely on an applicable Article 6 lawful basis and the health or social care condition in Article 9(2)(h), supported by UK law and professional confidentiality.
Legal and professional duties
To meet regulatory, safeguarding, medicines, insurance, accounting, complaints and legal obligations. We may rely on legal obligation, legitimate interests, vital interests or the establishment and defence of legal claims as appropriate.
Website analytics
To understand website use and improve the service. Optional Google Analytics is used only after a visitor accepts analytics cookies; consent can be changed at any time.
Consent to treatment is a clinical requirement and is separate from the lawful basis used to process personal information. We do not use consent as the default lawful basis for keeping records necessary to provide and document care.
4. Who information may be shared with
Information is shared only when there is an appropriate reason and proportionate safeguards. Recipients may include:
- Clinicians and authorised staff involved in your care.
- Fresha and other providers supporting appointment management, communications or payments.
- Your GP, specialist, pharmacist, insurer or another health professional when this supports safe care and confidentiality requirements are met.
- Accountants, professional advisers, indemnity providers, IT, email, analytics and website-hosting providers acting under appropriate arrangements.
- Regulators, safeguarding bodies, courts, emergency services or public authorities when disclosure is required or otherwise lawful.
We do not sell patient information.
5. International processing
Some technology providers may process information outside the UK. Where this occurs, we expect an applicable adequacy decision or approved contractual and organisational safeguards to be used. You may contact us for further information about relevant safeguards.
6. How long information is kept
Clinical records are retained in line with applicable professional, legal, regulatory and insurance requirements. Financial records are kept for statutory accounting and tax periods. Enquiries, communications and website information are kept only for as long as reasonably needed for their purpose, dispute management, security and legal obligations.
Retention periods can differ according to the patient's age, the type of record and the circumstances of care. Information is securely deleted or anonymised when it is no longer required.
7. Security and confidentiality
We use proportionate administrative, technical and organisational safeguards designed to protect information from unauthorised access, loss, alteration or disclosure. Access to clinical information is limited to people who need it for an appropriate purpose and who are subject to confidentiality obligations.
8. Your data protection rights
Depending on the circumstances and lawful basis, you may have rights to:
- Ask for access to your personal information.
- Ask for inaccurate or incomplete information to be corrected.
- Ask for information to be erased or its use restricted where the law permits.
- Object to certain processing based on legitimate interests.
- Receive information you provided in a portable format where applicable.
- Withdraw consent for optional processing, including analytics, without affecting earlier lawful use.
These rights are not absolute. For example, clinical records may need to be retained despite an erasure request. Contact admin@resolvemsk.co.uk to make a request. We may need to verify your identity and will normally respond within one month.
9. Questions and complaints
Please contact us first if you have a concern about your information. If you remain dissatisfied, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint ↗ or call 0303 123 1113.
10. Related information
Read our Cookie information for details about browser storage and Google Analytics. This notice may be updated when services, providers or legal requirements change; the revision date will be shown at the top.