Legal & Privacy
Privacy Policy
This policy explains how The PRP Clinic Ltd collects, uses, stores and protects personal information, including health and clinical information.
1. About this Privacy Policy
The PRP Clinic Ltd, trading as The PRP Clinic, is committed to protecting your privacy and handling your personal information lawfully, fairly and transparently.
This Privacy Policy explains how we collect, use, store and protect your personal information when you:
- visit our website;
- contact us by telephone, email, website form, social media or messaging service;
- make an enquiry or book a consultation;
- attend The PRP Clinic for assessment or treatment;
- purchase a product or service from us;
- communicate with members of our clinical or administrative team;
- participate in a training, educational or promotional activity where you have agreed to do so; or
- otherwise interact with The PRP Clinic.
For the purposes of UK data protection law, The PRP Clinic Ltd is the data controller responsible for the personal information described in this Privacy Policy.
2. Our Contact Details
The PRP Clinic LtdUnit 9
Sheepscar Way
Leeds
LS7 3JB
United Kingdom
Telephone: 0113 253 3662
Email: info@leedsprpclinic.com
Website: www.leedsprpclinic.com
For data protection enquiries:
Data Protection Officer
Email: james@leedsprpclinic.com
ICO registration number: ZB395356
3. The Information We Collect
The information we collect depends on your relationship with us and the services you use.
Personal and contact information
- your full name;
- date of birth;
- address;
- email address;
- telephone number;
- emergency contact information;
- preferred method of communication; and
- other information needed to identify or communicate with you.
Appointment and administrative information
- appointment dates and times;
- consultations;
- treatments booked or received;
- cancellations and rescheduling information;
- correspondence with the clinic;
- consent documentation;
- invoices;
- payment and transaction information; and
- information relating to complaints or queries.
Where payments are processed by a third-party payment provider, we may not receive or retain your complete payment card details.
Health and clinical information
As a specialist clinic providing regenerative and aesthetic healthcare services, we may need to process information concerning your health.
- medical history;
- current and previous medical conditions;
- medications and allergies;
- previous procedures or treatments;
- hair or skin conditions;
- relevant family or clinical history;
- clinical observations and examination findings;
- treatment plans and records;
- contraindications and risk assessments;
- treatment outcomes;
- adverse reactions or complications;
- test results;
- information supplied by another healthcare professional;
- referral information; and
- other information relevant to assessing whether a treatment is appropriate and safe for you.
Genetic information and diagnostic testing
Where you specifically request or receive a service involving genetic analysis or diagnostic testing, such as genetic hair analysis, we may process genetic or health-related information necessary to provide that service.
Genetic information is also special category personal data and is handled with an appropriately high level of confidentiality and security.
Clinical photographs and images
We may take photographs or other images where reasonably necessary for clinical assessment, documenting your condition, monitoring progress, treatment planning, maintaining an appropriate clinical record or documenting treatment outcomes.
Clinical photographs forming part of your medical record will be treated as confidential clinical information.
We will not use identifiable photographs, videos or clinical information for advertising, social media, promotional material, testimonials or other marketing purposes unless we have obtained appropriate consent from you.
4. Information Collected When You Use Our Website
When you visit our website, certain technical information may be collected automatically. This may include your IP address, browser type, device type, operating system, pages viewed, date and time of access, referring website, interaction with website features and cookie or similar technology information.
We use this information where appropriate to operate and secure our website, understand how it is being used, diagnose technical problems and improve our services.
Our website may contain embedded content or links provided by third parties, including services such as YouTube, Google, WhatsApp or social media platforms. When you interact with third-party content or leave our website to use a third-party service, that provider may process information about you under its own privacy policy.
5. How We Obtain Your Information
We may obtain personal information directly from you, through our website and communications, during consultation or treatment, from a person acting on your behalf, from healthcare professionals involved in your care, from consultants, laboratories, pharmacies or diagnostic providers, from payment or booking providers, from publicly available sources where lawful, or from another organisation where you have authorised disclosure or disclosure is otherwise lawful.
6. Why We Use Your Personal Information
We may use your information to:
- respond to enquiries and arrange consultations;
- book and manage appointments;
- assess whether treatment is appropriate for you;
- provide PRP, PRF and other treatments and services;
- maintain accurate clinical records and provide aftercare;
- contact you concerning your treatment;
- manage prescriptions, referrals or diagnostic testing where applicable;
- seek appropriate advice from other healthcare professionals;
- process payments and issue invoices and receipts;
- manage cancellations and deposits;
- investigate concerns, incidents or complaints;
- maintain patient safety;
- meet professional, regulatory and legal obligations;
- prevent or investigate fraud or misuse;
- establish, exercise or defend legal claims;
- operate, protect and improve our website and systems;
- monitor and improve service quality;
- send marketing communications where legally permitted; and
- maintain records of consent and marketing preferences.
7. Our Lawful Bases for Processing
Contract
We may process information where it is necessary to take steps at your request before entering into a contract or to provide a treatment, product or service you have agreed to purchase from us.
Legal obligation
We may process information where necessary to comply with a legal or regulatory obligation, including relevant financial, tax, regulatory, safeguarding and record-keeping obligations.
Legitimate interests
We may process information where necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and interests.
Consent
We may rely on your consent where appropriate, including for certain marketing, promotional photography, testimonials or other optional uses. Where processing is based on consent, you may withdraw that consent at any time.
Vital interests
In exceptional circumstances, we may process personal information where necessary to protect someone's life or vital interests, for example in a medical emergency.
8. Health and Other Special Category Information
Information about your health, and genetic information where applicable, is special category personal data.
Where we process this information, we must have both a lawful basis under Article 6 of the UK GDPR and an appropriate condition under Article 9.
For information used in connection with clinical assessment, diagnosis, healthcare or treatment, we will generally process it where necessary for the provision or management of health care or treatment, subject to appropriate duties of confidentiality and the applicable requirements of the Data Protection Act 2018.
9. Medical Confidentiality
Information you provide during consultations and treatment is confidential. Access to clinical information is limited to people who have an appropriate reason to access it.
Where another healthcare professional is involved in your care, we may share relevant information with them where this is necessary and lawful. Where practicable, we will discuss this with you.
There may be limited circumstances in which information can or must be disclosed without consent, for example where required by law, necessary to protect vital interests, required for safeguarding purposes or necessary in connection with legal proceedings.
11. Referrals and Multidisciplinary Care
The PRP Clinic may work with or refer patients to other healthcare professionals, including consultants, pharmacists, counsellors and other specialists.
Where a referral is made, relevant personal and clinical information may need to be shared so that the professional can assess or provide appropriate care. We will only disclose information that is relevant and necessary for that purpose.
12. Training, Education and Case Studies
The PRP Clinic is involved in professional training and education relating to regenerative medicine. We will take appropriate steps to protect patient confidentiality when information is used for legitimate training or educational purposes.
Where possible, information used for general teaching or training will be anonymised. We will not use identifiable patient information, photographs or videos for public-facing education, advertising, case studies or promotional material unless there is an appropriate lawful basis and, where required, your explicit consent.
13. Marketing Communications
We may contact you with information about treatments, services or clinic developments where data protection and electronic marketing laws allow us to do so.
You can opt out of marketing communications at any time by using the unsubscribe option in a message, replying asking us to stop, telephoning us or emailing info@leedsprpclinic.com.
Opting out of marketing will not prevent us from contacting you with non-marketing information concerning appointments, treatment, payments, safety information or other administrative matters.
16. Payment Information
Where you purchase treatment or services, we may process information about the transaction for appointment management, accounting, tax, fraud prevention and other legitimate business purposes.
Payment card transactions may be handled by specialist payment providers. Where a payment provider processes your card information independently, its processing will also be governed by its own privacy arrangements.
17. How Long We Keep Your Information
We will not keep identifiable personal information for longer than is reasonably necessary. Different types of information need to be retained for different periods.
When determining an appropriate retention period, we consider the purpose for which information was collected, healthcare and professional record-keeping requirements, patient safety, applicable limitation periods, legal and regulatory obligations, tax and accounting requirements, insurance requirements, the sensitivity of the information and whether it is required for legal claims.
When information is no longer required, we will securely delete, destroy or anonymise it, subject to technical and legal requirements.
18. Security
We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, alteration, inappropriate disclosure, destruction and other unlawful processing.
Measures may include access controls, passwords, secure systems, staff confidentiality requirements, appropriate data backups, secure disposal procedures and limiting access to people who need the information for their role.
19. International Transfers
Some technology, communications, cloud, website or other service providers may process information outside the United Kingdom.
Where personal information is transferred internationally, we will take steps required by UK data protection law to ensure that the information continues to receive an appropriate level of protection.
20. Automated Decision-Making
We do not intend to make decisions about your eligibility for clinical treatment solely by automated means where those decisions would have legal or similarly significant effects on you. Clinical treatment decisions are made or reviewed by appropriately qualified professionals.
21. Your Data Protection Rights
Depending on the circumstances and the lawful basis being used, you may have rights including:
- Access, to request a copy of information we hold about you.
- Rectification, to correct inaccurate or incomplete information.
- Erasure, in certain circumstances, to request deletion of your information.
- Restriction, in certain circumstances, to restrict how we use your information.
- Object, in certain circumstances, to object to processing, including direct marketing.
- Data portability, in certain circumstances, to receive information in a structured, commonly used and machine-readable format.
- Withdraw consent, where we rely on consent.
- Rights relating to automated decision-making, where applicable.
Not every right applies in every situation. We will explain if a particular right does not apply to your request.
22. How to Exercise Your Rights
To exercise your data protection rights, email james@leedsprpclinic.com or info@leedsprpclinic.com.
We may need to request reasonable information to confirm your identity before releasing personal information. We will respond in accordance with the timescales required by applicable data protection law.
23. Complaints About Our Use of Your Information
If you have concerns about how we have collected or used your personal information, please contact us first so that we have an opportunity to investigate and respond.
You also have the right to raise a concern with the UK data protection regulator:
Information Commissioner's Office (ICO)Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
24. Children
The PRP Clinic does not provide its normal treatment services to individuals under 18 years of age.
We do not intentionally collect personal information from children through the website for the purpose of providing adult treatment services. Where information relating to a child is lawfully required for another purpose, it will be handled with appropriate safeguards.
25. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technologies, data-processing activities, regulatory guidance or applicable law.
The current version will be published on our website with the date it was last updated.
26. Contact Us
If you have any questions about this Privacy Policy or how The PRP Clinic handles your personal information, please contact:
The PRP Clinic LtdUnit 9
Sheepscar Way
Leeds
LS7 3JB
Telephone: 0113 253 3662
General enquiries: info@leedsprpclinic.com
Data protection enquiries: james@leedsprpclinic.com
ICO registration: ZB395356
15. Social Media, WhatsApp and Third-Party Platforms
If you choose to contact us through WhatsApp, Facebook, Instagram or another third-party platform, that provider will process information in accordance with its own terms and privacy arrangements.
We recommend that highly sensitive or detailed medical information is provided through the communication method advised by the clinic rather than through public social media.