Cadogan Clinic - Privacy Notice

Last updated: 12 October 2026

This Privacy Notice explains what personal data Cadogan Clinic collects, why we use it, who we share it with, how long we keep it and what rights you have. It applies to patients, prospective patients, website visitors, consultants and other people who deal with us. Please read it together with our Patient Terms and Conditions and, if you are a patient, the consent and treatment information we give you on site.

Who We Are (Data Controller)

Cadogan Clinic is the trading name of Personal Health Service Ltd, the data controller for the personal data described in this notice. We decide why and how your data is used.

• Address: Cadogan Clinic, 120 Sloane Street, London SW1X 9BW, United Kingdom
• Telephone: 020 7901 8500
• Email: cadogan@cadoganclinic.com
• ICO registration reference: ZA373088

Our Data Protection Officer

We have a Data Protection Officer (DPO), who advises us on data protection law and monitors our compliance. You can contact the DPO about anything in this notice, or about how we handle your personal data or exercise your rights, by writing to the address above or emailing cadogan@cadoganclinic.com marked "For the attention of the Data Protection Officer".

Whose Data We Use and What We Collect

The data we hold depends on how you deal with us. This notice covers patients and clients (including children and young people, whose data is handled with the involvement of a parent or guardian where appropriate), enquirers, website visitors, and consultants and other people who work with us.

Website visitors: You do not need to give us personal data to browse our website. Your browser sends us some data automatically, such as the date and time of your visit, browser type and settings, operating system, the last page you visited, the data transmitted, the access status and your IP address.

Patients and clients: If you use our services, we need personal data to provide your care and to run the contract between us. This can include:

• Name, contact details (telephone, email) and patient number
• GP name and address
• Health insurance information
• Financial and banking details
• Confidential correspondence
• Digital images and photographs, together with identifiers
• Online identifiers, location information, and social network contact details where you use them to contact us
• Health information (see "Health and other special category data" below)

Consultants and staff: Where you work with us, we also hold employment and education history, performance data, and the information needed to manage your contract and keep our systems secure.

Why We Use Your Data and Our Legal Bases

We only use personal data where the law allows. The tables below match each purpose to its legal basis under Article 6 of the UK GDPR and, where health or other special category data is involved, to the condition under Article 9.

Patients, Clients and Enquirers (Including Children)

Purpose	Article 6 Legal Basis	Article 9 Condition (Special Category Data)
Providing your assessment, treatment, aftercare and repeat prescriptions	6(1)(b) contract	9(2)(h) provision of health care
Contacting you about your care, appointments and aftercare	6(1)(b) contract	9(2)(h) provision of health care
Clinical audit, quality assurance, outcomes monitoring, patient safety and clinical governance, including review by contracted reviewers	6(1)(f) legitimate interests (maintaining and improving the safety and quality of our care)	9(2)(h) management of health care services
Meeting legal, regulatory, financial and tax obligations, including accounting, VAT, inspections by our regulators and reporting required by law	6(1)(c) legal obligation	9(2)(h) where part of managing our health services; 9(2)(f) where needed for legal claims
Billing, payments, insurer and funder claims, and financial record keeping	6(1)(b) contract; 6(1)(c) legal obligation	9(2)(h) where health information is needed to process a claim
Handling complaints, incidents and legal claims, and protecting our legal rights	6(1)(f) legitimate interests; 6(1)(c) legal obligation	9(2)(f) establishment, exercise or defence of legal claims
Marketing and communications about our services	6(1)(a) consent (you can withdraw it at any time)	Not used for marketing
Before-and-after images and case information used for marketing or education	6(1)(a) consent	9(2)(a) explicit consent
Business intelligence, service improvement, sales and distribution of our products and services, and business operations	6(1)(f) legitimate interests; 6(1)(b) contract where you buy from us	Health data is not used unless 9(2)(a) explicit consent applies
Running and securing our website, systems and premises	6(1)(f) legitimate interests	Not applicable

 

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for more detail.

 

Consultants and Staff

Purpose	Article 6 Legal Basis
Recruitment and engagement	6(1)(b) contract (including steps before entering one)
Performance management and monitoring	6(1)(b) contract; 6(1)(f) legitimate interests
Information, system, network and cyber security	6(1)(f) legitimate interests; 6(1)(b) contract
Meeting legal, regulatory and tax obligations	6(1)(c) legal obligation

Health and Other Special Category Data

To care for you we collect health information, including medical history and conditions, medical reports, NHS number, blood test and other results, assessments, treatment records and clinical images. We may also hold information about your racial or ethnic origin where it is clinically relevant or you choose to give it to us.

We use health information to provide and manage your care under Article 9(2)(h) of the UK GDPR, which covers health care and the management of health services. This includes clinical audit, quality assurance and clinical governance. We do not rely on your consent for these uses. Separately, we ask for your consent to treatment before we treat you, as a matter of medical law and good practice. That consent is not the legal basis for using your data for audit or governance, and refusing to agree to those uses does not affect your care.

As part of clinical audit and quality assurance, we may use secure software tools that use artificial intelligence to help review clinical records, for example to identify gaps in documentation or patterns in outcomes. These tools are provided under contract, process data only on our instructions, and do not use your data to train their models. A member of our clinical or governance team reviews the results, and no decision about your care is made solely by automated means. Where possible, records are redacted before review.

We use explicit consent under Article 9(2)(a) only where no other condition fits, for example when we use your images for marketing or education.

Your health information is confidential. Only people who need it to provide, audit or manage your care, or who are legally required to receive it, can see it, and they are bound by a duty of confidentiality.

Who We Share Your Data With

We share personal data only where we need to, and only as much as is necessary. We do not sell your personal data. Information is often redacted when it is shared, so that recipients see only what they need. Recipients include:

• Consultants, clinicians and other health professionals who treat you or work with us, and your GP or other providers involved in your care
• Laboratories, imaging and pathology services, pharmacies and device or implant suppliers and registries, where relevant to your care
• Insurers, funders and finance providers, where you use them to pay for treatment
• Service providers acting on our instructions (data processors), such as providers of clinical, booking, payment, communications, cloud and IT systems, including software tools that use artificial intelligence. They are bound by contract and may use the data only for our purposes
• Professional advisers and reviewers working for us under contract and a duty of confidentiality, such as accountants, auditors, tax advisers, lawyers, and clinical audit or records reviewers
• Regulators and public bodies, including the Care Quality Commission, the Information Commissioner's Office, HMRC and professional bodies, where we are required or permitted to share data
• Courts, the police and other authorities, where the law requires it

Where a provider processes data outside the UK, we make sure an approved safeguard is in place.

How Long We Keep Your Data

We keep personal data only as long as we need it for the purposes above, or for longer if the law requires.

Data	How Long We Keep It
Patient and clinical records	At least 8 years after your last treatment. For children, until at least their 25th birthday, or their 26th if they were 17 when treatment ended, if that is longer
Financial and accounting records	At least 6 years from the end of the financial year to which they relate
Marketing preferences and consent	Until you withdraw consent
Consultant and staff records	For the duration of the contract and afterwards for as long as the law requires or we need them to deal with claims

 

If we keep data for historical or statistical purposes, we make sure it cannot be used to identify you.

How We Look After Your Data

We collect only the data we need for the purposes described above. We protect our physical and electronic information against unauthorised access, damage, loss and destruction. Access to health records is limited to people who need it. We take care to keep your data accurate and ask for your help in keeping it up to date.

Your Rights

Under data protection law you have the right to:

• Ask for a copy of the personal data we hold about you (subject access)
• Ask us to correct data that is inaccurate or incomplete
• Ask us to erase your data or restrict how we use it, in certain circumstances. We may need to keep clinical and financial records for the periods above
• Object to uses based on our legitimate interests, and to direct marketing at any time
• Withdraw consent at any time, where we rely on it. Withdrawal does not affect processing carried out before you withdrew
• Receive your data in a portable format, where we rely on consent or contract and process it by automated means

To make a request, use our Subject Access Request page or contact us using the details above.

Complaints and Changes to This Notice

If you are unhappy with how we have used your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO):

The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Telephone: 0303 123 1113 · ico.org.uk

We review this notice regularly and will update it when our processing changes. The date at the top shows when it was last updated.