Privacy Policy

Who we are

NewMed Healthcare Ltd (trading as The Medical Skin Clinic and MedHub), company registration number 08966527. Registered address: Ground Floor, The Maltings, Locks Hill, Rochford, England, SS4 1BB. Clinic address: 30 High Street, Newmarket, Suffolk, CB8 8LB.

Contact: reception@medicalskinclinic.co.uk · 01638 476423 · www.medicalskinclinic.co.uk

1. The data we collect about you

We may collect, use, store and transfer different kinds of personal data about you, grouped as follows:

• Identity Data: first name, last name, title, date of birth and gender.
• Contact Data: billing address, home address, email address and telephone numbers.
• Special Category Data (Health Data): medical history, GP details, current medications, allergies, previous aesthetic or dermatological treatments, clinical photographs (before and after), consultation transcripts, consultation notes and treatment plans.
• Transaction Data: details about payments to and from you, and details of treatments and products you have purchased from us.
• Insurance Data: your private health insurance provider, membership number and authorisation codes where applicable (e.g. Aviva, WPA, Vitality).
• Technical and Usage Data: information about how you use our website, including IP address, browser type and booking interactions.
• Marketing and Communications Data: your preferences in receiving marketing from us, your communication history (including emails, SMS and social media interactions) and any enquiries submitted via third-party platforms.

2. How we collect your data

• Direct interactions: you may give us your Identity, Contact and Health Data by filling in intake forms, booking appointments online, or corresponding with us by post, phone, email or otherwise.
• Third-party platforms: we may receive enquiry or contact data from third-party lead generation and directory platforms, including What Clinic, Top Doctors, Facebook, Instagram, TikTok and Nextdoor, where you have submitted an enquiry or expressed interest in our services.
• Private health insurers: we may receive referral or authorisation data from private health insurance providers, including Aviva, WPA and Vitality.
• Automated technologies: as you interact with our website, we may automatically collect Technical Data about your equipment and browsing actions using cookies. Please see our Cookie Policy for further details.

3. How we use your data and our lawful basis

We will only use your personal data when the law allows us to. The lawful bases we rely on under the UK GDPR are:

• Registering you as a new patient and booking appointments (Identity, Contact) — performance of a contract.
• Providing medical, dermatological or aesthetic treatments (Identity, Contact, Health) — provision of healthcare, Article 9(2)(h).
• Transcribing and recording consultation notes using AI scribing tools (Identity, Health) — provision of healthcare, Article 9(2)(h), with your knowledge and the option to decline.
• Processing payments and managing billing (Identity, Contact, Transaction) — performance of a contract.
• Processing and submitting insurance claims (Identity, Contact, Insurance, Health) — performance of a contract and legal obligation.
• Communicating with you regarding your care, such as reminders and follow-ups (Identity, Contact, Health) — provision of healthcare.
• Responding to enquiries received via third-party platforms (Identity, Contact) — legitimate interests (responding to your enquiry).
• Sending you marketing communications such as newsletters and offers (Identity, Contact, Marketing) — explicit consent, which you may withdraw at any time.
• Managing our accounts and financial records (Identity, Transaction) — legal obligation.

4. Third-party systems and data processors

To provide a seamless, safe and effective service we use carefully selected third-party software providers. These providers act as Data Processors on our behalf, meaning they only process your data under our instruction. We have Data Processing Agreements (DPAs) in place with all relevant providers.

• Clinical and practice management: Semble is our primary Electronic Health Record (EHR), scheduling and practice management system. All clinical notes, medical histories, consultation records and appointment schedules are securely stored within Semble, which is integrated with Healthcode for insurance billing and with our online booking system.
• AI medical scribing: Heidi Health is an AI-powered medical scribing tool integrated within Semble. Where you consent, Heidi Health uses ambient listening technology to transcribe your consultation in real time, generating structured clinical notes. Audio recordings are processed securely and are not retained beyond what is necessary to produce the clinical note. You will always be informed before any recording takes place and you may decline at any time.
• Marketing and CRM: Go High Level (GHL) is our Customer Relationship Management and marketing automation platform. If you have explicitly consented to receive marketing, your basic contact details (name and email address) will be stored in GHL, which is also used to manage general email and SMS communications. No clinical notes, medical histories or health records are stored in GHL.
• Social media and lead generation: we maintain a presence on Facebook and Instagram (Meta Platforms Ireland Ltd), TikTok (TikTok Technology Limited), Nextdoor (Nextdoor, Inc.), What Clinic (What Clinic Ltd) and Top Doctors (Top Doctors UK Ltd). When you submit an enquiry via any of these platforms, the information you provide will be received by us and stored in our CRM for the purpose of responding to you. We will always ask for your consent before adding you to any marketing lists.
• Private health insurance: we are recognised providers for Aviva Health, WPA (Western Provident Association) and Vitality Health. Where you are using insurance to fund your treatment, we will share relevant clinical and billing information with your insurer as necessary to process your claim.
• Billing and accounting: Healthcode is used to submit invoices directly to private health insurance providers on your behalf. Xero is our cloud-based accounting software; invoice and payment data is automatically synchronised between Semble and Xero for financial record-keeping.
• AI and administrative tools: Manus AI is an AI agent platform we use to assist with administrative tasks, including drafting communications, analysing anonymised data and generating content such as our monthly newsletter. Manus AI operates in secure, isolated sandbox environments and does not use your personal data to train its own AI models.

5. International data transfers

Some of our third-party processors are based outside the UK. Whenever we transfer your personal data outside the UK, we ensure it receives equivalent protection through one or more of the following safeguards: transfers to countries deemed adequate by the UK Government, or use of UK Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA).

The following processors involve international data transfers: Go High Level (United States), Manus AI (Singapore/United States), Meta — Facebook and Instagram (United States), TikTok (United States/Singapore) and Nextdoor (United States).

6. Data security

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, accessed without authorisation, altered or disclosed. Access to your personal data is limited to those employees, agents and contractors who have a strict clinical or business need to know. All such individuals are subject to a duty of confidentiality.

7. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes for which it was collected, including to satisfy any legal, regulatory, tax, accounting or reporting requirements.

Medical records (including clinical notes, consultation transcripts and clinical photographs) are retained for a minimum of 8 years from the date of last treatment, in line with NHS and medical defence guidance. Records relating to children are retained until the patient's 25th birthday, or 8 years after last treatment if longer.

Marketing data (for example your email address on our newsletter list) will be retained only for as long as you remain subscribed. You may unsubscribe at any time.

8. Your legal rights

Under the UK GDPR you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you (a Subject Access Request).
• Right to rectification: request that we correct any inaccurate or incomplete data.
• Right to erasure: request that we delete your personal data. This right does not apply to medical records we are legally required to retain.
• Right to restrict processing: request that we restrict how we use your data in certain circumstances.
• Right to object: object to processing for marketing purposes at any time, and to processing based on legitimate interests.
• Right to withdraw consent: where we rely on your consent (e.g. marketing emails or AI transcription), you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to data portability: in certain circumstances, request that we transfer your data to another organisation.

To exercise any of these rights, contact us at reception@medicalskinclinic.co.uk or in writing to our clinic address.

9. Cookies

Our website uses cookies to distinguish you from other users and to improve your experience. You can set your browser to refuse all or some browser cookies. For more information, please see our separate Cookie Policy.

10. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.

11. How to contact us and how to complain

If you have any questions about this Privacy Policy or our data protection practices, please contact us: The Medical Skin Clinic, 30 High Street, Newmarket, Suffolk, CB8 8LB · reception@medicalskinclinic.co.uk · 01638 476423.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF · www.ico.org.uk · 0303 123 1113.

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.