1. Who We Are & Data Controller Information
Azalas Medical Services operates private medical clinics and expert medico-legal services across 10 consultation suites in Greater London and nationwide telehealth. The Data Controller responsible for your personal information is Dr. Asim Muhammad (Lead Consulting Physician).
If you have any questions about this privacy notice or how your information is handled, please contact our Data Protection desk at admin@azalasmedical.co.uk.
2. Caldicott Principle 4: Strict Clinical Data Minimization
In compliance with Caldicott Principle 4 (“Access to personal confidential data should be on a strict need-to-know basis”) and UK GDPR Article 5(1)(c), we practice absolute data minimization across all public web services:
- Zero Medical History in Website Database: We do NOT store medical histories, symptoms, clinical case notes, or health questionnaires within the public website MySQL database.
- Administrative Scheduling Only: When you book an appointment online, our scheduling engine captures only the administrative contact information strictly required to coordinate your appointment (name, email address, telephone number, and selected consultation time).
- Sovereign Document Vault: Legal instructions, medical records bundles, and driver identification documents submitted by solicitors or patients are transferred and stored within our sovereign, end-to-end encrypted Nextcloud Workspace vault hosted on dedicated European infrastructure.
3. Lawful Basis for Processing Your Information
Under UK GDPR, we process personal data and special category health data under the following legal bases:
- Article 6(1)(b) — Contract: Processing necessary to fulfill our agreement to provide medical consultations, driver medical assessments, or expert witness reports.
- Article 6(1)(f) — Legitimate Interests: Managing clinic scheduling, appointment reminders, and professional practice administration.
- Article 9(2)(h) — Health and Social Care: Processing special category health data for the direct provision of healthcare, clinical diagnosis, and occupational health fitness certification.
- Article 9(2)(f) — Legal Claims: Processing medico-legal reports and instructions for the establishment, exercise, or defence of civil legal claims compliant with CPR Part 35.
4. Telehealth Video Consultations (Google Meet)
Virtual appointments are conducted via Google Meet using enterprise 128-bit encryption in transit. Azalas Medical Services maintains a strict policy: consultations are live and are never recorded in audio or video format. Clinical observations made during the consultation are documented directly in the patient’s confidential medical record.
5. Information Sharing and Disclosure
Your confidential information is never sold, leased, or shared with third parties for marketing purposes. Disclosures occur only in the following clinical circumstances:
- With Your Consent: Sharing referral letters with private medical consultants or sending consultation summaries to your registered NHS GP.
- With Formal Legal Instruction: Sharing completed CPR Part 35 expert reports directly with instructing solicitors or the court.
- Medical Certification: Transmitting private fit notes (sick notes) and referral documentation securely to employers or private specialists at your explicit request.
- Mandatory Legal Obligations: In extraordinary circumstances where disclosure is required by law, court order, or paramount safeguarding concerns (protecting the patient or public from serious harm).
6. Data Retention Periods
In alignment with the NHS Records Management Code of Practice and GMC clinical governance guidance:
- Adult clinical consultation records are securely retained for a minimum of 8 years following the last date of treatment.
- Medico-legal civil litigation files are retained for 7 years following case conclusion.
- Website appointment scheduling logs (administrative timestamps) are retained for 12 months for rota verification and audit purposes.
7. Your Legal Rights Under UK GDPR
Under UK data protection legislation, you have significant rights regarding your personal and clinical data:
- Right of Access (Subject Access Request): You have the right to request a copy of the personal and medical data we hold about you. Requests are fulfilled free of charge within one calendar month.
- Right to Rectification: You may request corrections to inaccurate personal details or administrative records.
- Right to Erasure: In certain circumstances, you may request deletion of your personal data, subject to mandatory medical record retention laws.
- Right to Restrict Processing: You have the right to request restriction of processing while an inquiry or dispute is resolved.
8. Contacting the Information Commissioner’s Office (ICO)
If you have concerns about how your data has been handled, you have the right to lodge a formal complaint with the UK supervisory authority:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 • Website: ico.org.uk