Data privacy policy.

About this notice

This notice explains how Harrow Health Care Centre collects, uses and protects personal information about our patients and about people who contact us or use this website, and the rights you have. Please read it alongside our cookie policy.

Who we are

Harrow Health Care Centre is a trading name of HHCC Medical LLP, a limited liability partnership registered in England and Wales, number OC449406. HHCC Medical LLP is the data controller for the information described in this notice and is registered with the Information Commissioner’s Office (registration ZB879457).

Practice address: 1st Floor Reception & Consulting Suite, The Clementine Churchill Hospital, Sudbury Hill, Harrow HA1 3RX. Telephone 020 8861 1221, email info@harrowhealthcare.co.uk.

For any question about how we use your information, or to use any of your rights, please contact our data protection lead at the address or email above.

The information we hold

The health professionals who care for you keep records about your health and any treatment you have received, including letters from consultants and hospital reports. These records may be electronic, on paper, or both, and may include:

• your contact details, date of birth, next of kin, emergency contact and any legal representative
• appointments, consultations and other contact you have had with us
• notes and reports about your health, treatment and care
• results of investigations such as blood tests and scans
• relevant information from other health professionals, relatives or carers
• payment and invoice details for the services you have paid for

When you contact us or use this website, we may also hold the details you give us, such as your name, email address, telephone number and message, and the limited technical information described below.

How we use it, and our legal basis

Data protection law requires us to have a lawful basis for each use of your information, and a further condition when it concerns your health.

• Providing your care, including consultations, tests, treatment, referrals, prescriptions and follow-up. Lawful basis: to perform our contract with you (UK GDPR Article 6(1)(b)). For health information: the provision of health care by professionals who owe you a duty of confidentiality (Article 9(2)(h)).
• Keeping medical records and meeting our legal and regulatory duties, for example to the Care Quality Commission, professional regulators and public health authorities. Lawful basis: legal obligation (Article 6(1)(c)), with Article 9(2)(h) and, where relevant, public health (Article 9(2)(i)).
• Payments, invoices and accounts. Lawful basis: contract and legal obligation (Article 6(1)(b) and (c)).
• Answering enquiries made by telephone, email or our contact form. Lawful basis: our legitimate interest in replying to people who contact us, or steps you ask us to take before becoming a patient (Article 6(1)(f) or (b)).
• Handling complaints and improving our service, including clinical audit. Lawful basis: legitimate interests and legal obligation (Article 6(1)(f) and (c)). Audit results are reported without identifying individual patients.
• Website analytics, only if you accept analytics cookies. Lawful basis: your consent (Article 6(1)(a)), which you can withdraw at any time.
• Marketing emails, only if you have agreed to receive them. Lawful basis: your consent, which you can withdraw at any time.

We will always ask for your consent before your information is used for research. We do not make decisions about you by purely automated means.

Our website and online services

• Contact form. What you send (your name, email address, telephone number and message) goes straight to our reception mailbox in Microsoft 365. The website itself does not store it. Please do not include detailed medical information.
• Online booking and forms. Our booking calendars and some online forms, such as membership and repeat prescription requests, are provided by Semble, our practice management system, and what you enter goes directly into Semble. Semble uses Stripe to take any payments made when booking.
• Website hosting. This website is hosted by Vercel, whose servers record technical information such as your IP address and browser type when you visit, in order to deliver the site and keep it secure.
• Analytics. If you accept analytics cookies, Google Analytics records how the website is used. See our cookie policy.
• Maps and fonts. The map on our contact page comes from Google Maps, and the website’s fonts are loaded from Google Fonts, so Google receives your IP address when these load.

Who we share information with

We share your information only when it is needed for your care, when the law requires or allows it, or with your agreement. Depending on your care, this may include:

• consultants, private hospitals and other private healthcare providers
• laboratories that process your tests
• your NHS GP, NHS trusts and other NHS services
• pharmacists, dentists, opticians and other independent practitioners
• ambulance services, social care services and local authorities
• the police, courts, or safeguarding and regulatory bodies, where the law requires it or to protect someone from serious harm

We also use service providers who handle information on our behalf, under contracts that require them to keep it confidential and secure. These include Semble (practice management, booking and forms), Microsoft (email), Vercel (website hosting), Google (analytics, only with your consent) and archiving services. We do not sell your information.

Transfers outside the UK

Some of our service providers, such as Microsoft, Google and Vercel, are based in or may process data in the United States or elsewhere outside the UK. Where this happens, the transfer is protected by the safeguards UK law requires, such as the UK-US data bridge or the UK’s approved contract terms.

How long we keep information

• Medical records: at least as long as the Records Management Code of Practice for Health and Social Care recommends. For most adults this is at least 8 years after your last treatment, and for children at least until their 25th birthday (or 26th if they were 17 when treatment ended).
• Enquiries through our contact form or by email: for as long as we need to deal with your enquiry. If you become a patient, relevant details are added to your medical record.
• Payment and accounting records: at least 6 years, as tax and accounting rules require.
• Google Analytics data: no more than 14 months.

Your rights

You have the right to:

• ask for a copy of the information we hold about you (a subject access request)
• ask us to correct information that is wrong or incomplete
• ask us to delete your information or restrict how we use it, although we usually have to keep medical records for the periods above
• object to our use of your information where we rely on legitimate interests
• ask for information you gave us to be passed to another provider in a portable format, where the law allows
• withdraw your consent at any time, where we rely on consent

You can make a request in writing or by speaking to us, although writing helps us keep a clear record. We may ask you to confirm your identity, for example with your full name, address and date of birth. We will respond within 30 days, and copies of your records are normally provided free of charge. For records held by the hospital, please contact the hospital directly.

Keeping your information confidential

Everyone who works for Harrow Health Care Centre has a legal duty to keep information about you confidential. We follow the UK GDPR, the Data Protection Act 2018, the common law duty of confidentiality and the Caldicott principles. We only share information with others involved in your care who genuinely need it, unless the law requires otherwise or someone is at risk of serious harm.

Keeping your details up to date

Please tell us if your name, address, telephone number or other details change, so that your records stay accurate.

Complaints

If you have any concern about how we handle your information, please contact our data protection lead at the practice address or info@harrowhealthcare.co.uk. If you remain unhappy, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

We update this notice when our services or the law change. It was last updated on 19 September 2026.