top of page
CHL Logo.png
phone_icon.png

Central Health London LLP

Patient Privacy Notice


Dated: 21 st August 2026


This notice explains how Central Health London collects, uses, and protects your personal data, including information recorded in our clinical systems and telephone communications.

1. Who we are

Data Controller
Central Health London LLP
23 Devonshire Place
London
W1G 6JB
020 7118 7588
info@centralhealthlondon.com
www.centralhealthlondon.com


We are responsible for deciding how your personal data is used.

​

Data Protection Officer / Privacy Lead
Tim Lord
timlord@centralhealthlondon.com
020 7118 7588

2. Our clinical record systems

We use Semble, a specialist healthcare practice management and electronic health record (EHR)
system, to manage:

  • Clinical records and consultation notes

  • Appointment scheduling

  • Correspondence and documents

  • Billing and administrative records

 

Semble acts as a data processor, meaning it processes personal data only on our instructions and under a legally binding data processing agreement. Where we hold your data on Semble, we remain the data controller and decide how it is used.


A number of separate practices and practitioners also see patients at our premises (for example Childhealthy Limited). If your consultation is provided by one of them rather than by us, they keep your consultation records on their own clinical record system and are a separate data controller for those records. We hold your registration and contact details on Semble so that we can administer your attendance at our premises, and where we provide you with diagnostic, laboratory or facility services we keep a record of those services there too. Please see section 6 for further detail.

3. What personal data we collect

Personal and contact information

  • Name, date of birth, address

  • Email address and telephone number

  • Emergency contact details

 

Health and clinical data (special category data)

  • Medical and, where appropriate, mental health history

  • Consultation notes and assessments

  • Diagnoses, treatment plans, and outcomes

  • Test results, reports, and referrals

 

Administrative and financial data

  • Appointment history

  • Invoices and payment records

  • Insurance information (where applicable)

 

Telephone call recordings

  • Audio recordings of calls made to and from the clinic

  • Associated call metadata (such as date and time of calls)

4. Why we use your data and our legal basis

We use your personal data to:

  • Provide safe and effective medical and mental health care

  • Assess, diagnose, and treat you

  • Maintain accurate clinical records

  • Communicate with you about appointments and care

  • Meet legal, regulatory, and safeguarding obligations, including as a CQC-registered healthcare provider

  • Manage billing and payments

 

Legal basis under UK GDPR

​

We process your data under:

  • Article 6(1)(b) - performance of a contract (providing healthcare services you have requested)

  • Article 6(1)(c) - legal obligation (medical record-keeping, safeguarding, regulatory compliance)

  • Article 6(1)(f) - legitimate interests (practice administration and service quality)

  • Article 9(2)(h) - health or social care (processing necessary for medical diagnosis and treatment)

 

We do not rely on consent to process personal data that is necessary for your medical or mental health care.

5. Consent (where required)

We will ask for your explicit consent only where processing is not essential to your care, for example:

  • Non-essential communications

  • Research participation (where applicable)

  • Enrolment in optional digital services (such as Imunis)

  • Sharing a summary of your care with your GP

  • Use of data beyond direct care where required by law

 

You may withdraw consent for these purposes at any time. This will not affect your access to treatment or clinical care.

6. Who we share your data with

We may share your data, where necessary and appropriate, with:

  • Clinicians within our practice involved in your care

  • Other healthcare professionals or services involved in your treatment

  • Laboratories or diagnostic providers

  • Insurers (where relevant and authorised)

  • Our IT, billing and system providers, who act under strict confidentiality and security obligations

  • Imunis, a digital vaccination record service, where you have not opted out, so that your vaccination records are available to support your care. Imunis processes this data as a separate data controller in accordance with its own privacy notice.

​

Where your consultation is provided by a separate practice or practitioner

 

A number of separate practices and practitioners see patients at our premises (for example Childhealthy Limited). If your consultation is provided by one of them:

  • They keep your consultation records on their own system and are a separate data controller for those records.

  • If we provide you with diagnostic, laboratory or facility services (for example a blood test or scan), we keep a separate record of those services and act as a separate data controller for that information.

  • They will bill you for the consultation, and we will bill you separately for any diagnostic, laboratory or facility services, in each case to your insurer or to you directly.

​

If your consultation is provided by us, there may be occasions - for example for clinical cover - where you are seen by a clinician from one of those separate practices. Where this happens, we may share relevant clinical information about you with them so that they can provide your care.

​

If a patient safety incident occurs at our premises that involves both us and a separate practice or practitioner, we may share relevant information with them so that it can be investigated and responded to properly.


As the CQC-registered provider for these premises, we may need to access clinical information relating to all patients seen at the premises, including patients of the separate practices and practitioners, in connection with a CQC inspection, investigation or notification requirement. Where that information is held on their own systems, we will request it from them rather than accessing their systems directly.


We only share the minimum necessary information and always with appropriate safeguards.

7. Where your data is stored and international transfers

Semble uses secure cloud-based infrastructure to store and process data. Where your personal data is stored or processed outside the United Kingdom - for example by our IT, system or other service providers - we ensure that appropriate safeguards are in place to protect it in accordance with the UK GDPR, such as an adequacy decision or standard contractual clauses.

8. How long we keep your data

We retain medical and mental health records, administrative data, and call recordings in line with:

  • Legal requirements

  • NHS and professional guidance

  • Regulatory and insurance obligations

​

Records and recordings are not kept indefinitely and are reviewed in accordance with our retention policy. Further details are available on request.

9. Your rights

You have the right to:

  • Access your personal data (Subject Access Request)

  • Request correction of inaccurate or incomplete data

  • Request erasure (in limited circumstances)

  • Request restriction of processing

  • Object to certain types of processing

  • Receive a copy of your data in a portable format

  • Withdraw consent where processing is based on consent

​

If your consultation is provided by a separate practice or practitioner and your query relates to your consultation records, you should contact them directly. If your query relates to diagnostic, laboratory or facility services we have provided, please contact us.


We normally respond to requests within one month.

10. How to contact us or make a complaint

To exercise your rights or raise a concern, contact:

 

Data Protection Officer / Privacy Lead
timlord@centralhealthlondon.com
020 7118 7588


If you remain dissatisfied, you have the right to complain to:

 

Information Commissioner's Office (ICO)
www.ico.org.uk
030 3123 1113

11. Changes to this notice

We may update this notice from time to time. The most recent version will always be available from the practice or on our website.

​

Version Number: 0.1
Date Updated: 21 st August 2025

bottom of page