Patient privacy notice

Privacy Notice for Patients

How the London Allergy and Immunology Centre collects, uses, shares and protects personal data and special category health information.

Organisation: London Allergy and Immunology Centre

Last updated: April 2026

Introduction Who we are What we collect Lawful basis Your rights

1. Introduction

This privacy notice explains what happens to any personal data you provide to us, or that we collect from or about you, when you contact us, use our website, book an appointment, receive treatment, undergo testing, or otherwise use our services.

Your privacy is important to us. We are committed to handling personal data lawfully, fairly and transparently, and to protecting your privacy rights.

ICO guidance states that people have the right to be informed about how their personal data is collected and used, including the purposes for processing, retention periods, and who data is shared with.

2. Who we are and how to contact us

For the purposes of applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018, the London Allergy and Immunology Centre is the data controller for the personal data covered by this notice. The UK GDPR and DPA 2018 remain the core framework, as amended by the Data (Use and Access) Act 2025.

Organisation: London Allergy and Immunology Centre

Address:
9 Harley Street, London W1G 9QY

Email: info@ukallergy.com

Phone: 020 3143 3449

3. The information we collect and why

Basic personal data

name
address
date of birth
telephone number and email address
emergency contact details where relevant

Special category data

Health information is special category data and receives extra protection under UK GDPR. ICO guidance explains that special category data needs both an Article 6 lawful basis and a separate Article 9 condition. :contentReference[oaicite:4]{index=4}

symptoms and medical history
test requests, results and diagnoses
treatments, medications and care plans
other sensitive information relevant to your care, such as ethnicity or other protected information where clinically necessary

How we collect it

directly from you during registration, booking and consultations
through our website, booking system and patient questionnaires
from other healthcare professionals involved in your care
from laboratories, imaging providers or pharmacies where relevant

4. Our lawful basis for processing your information

Important correction: for healthcare data, ICO guidance explains that you must identify both an Article 6 lawful basis and an Article 9 special category condition.

Article 6 lawful bases we may rely on

Article 6(1)(b) Contract – where processing is necessary to take steps at your request before entering into a contract, or to provide services you have asked for
Article 6(1)(c) Legal obligation – where we must comply with legal, regulatory, accounting, safeguarding or professional duties
Article 6(1)(f) Legitimate interests – for appropriate administration, service management, website security and communications, where your rights do not override those interests
Article 6(1)(d) Vital interests – in limited urgent situations where processing is necessary to protect life or safety

Article 9 condition for health data

For special category health information, we generally rely on Article 9(2)(h), which ICO guidance states applies where processing is necessary for medical diagnosis, the provision of healthcare or treatment, or the management of health or social care systems and services.

Where relevant, other legal conditions may also apply, depending on the nature of the processing.

5. How we use your information

providing consultations, allergy testing, immunology review and treatment
maintaining accurate and up-to-date records
communicating with you about appointments, results, invoices and care plans
sharing relevant information for your direct care with other healthcare professionals where appropriate
protecting patients and others through safeguarding processes where necessary
clinical audit, governance and service improvement
meeting legal, regulatory and professional obligations

6. How we keep your information confidential and secure

staff training and confidentiality duties
role-based access controls
secure systems and technical protections
appropriate organisational safeguards for both digital and paper records

We also aim to handle confidential patient information in line with professional confidentiality standards, legal obligations and good information governance practice.

7. Sharing your information

We may share information where necessary for your care, for administration of services, or where we are legally required or permitted to do so.

other healthcare professionals involved in your care
laboratories and diagnostic providers
secure IT, booking, payment and hosting providers acting on our instructions
pharmacies or treatment suppliers where relevant
regulators, safeguarding bodies, courts or law enforcement where required by law or justified by serious risk
professional advisers or insurers where reasonably necessary

8. Your data protection rights

ICO guidance states that privacy notices should explain the rights available to individuals and how to raise concerns.

the right to be informed
the right of access to your personal data
the right to rectification of inaccurate or incomplete information
the right to restrict or object in certain circumstances
the right to data portability where applicable
the right to withdraw consent where consent is the basis relied on

There is usually no fee for a valid subject access request, although lawful exemptions may apply in some situations.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how your data has been handled. ICO guidance linked above confirms that privacy information should explain this right. :contentReference[oaicite:8]{index=8}

9. How long we keep your information

We retain personal data in line with legal, clinical and regulatory requirements and with the Records Management Code of Practice for Health and Social Care.

NHS England’s Records Management Code states that the retention periods in the schedule are minimum periods and that, generally, most health and care records are kept for eight years after your last treatment, although some categories are retained longer.

We may retain records for longer where this is required or justified by law, safeguarding, complaints, insurance, litigation risk, or the type of record involved.

10. Updates to this privacy notice

We may update this privacy notice from time to time to reflect changes in law, guidance, systems or practice processes. The latest version will always be made available on our website.