Privacy Policy for Dermacutis

DermaCutis ("the Clinic", "we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information — including sensitive health information — when you visit our website, contact us, book an appointment, or become a patient of the Clinic.

We are the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

DermaCutis

10 Psalter Lane

Sheffield

S11 8YN

Website: www.dermacutis.co.uk

Email: info@dermacutis.co.uk

Governance Lead - Dr Raj Gaikwad

If you have any questions about this policy or how we handle your personal data, please contact us using the details above.

2. What Personal Data We Collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

2.1 Information you give us directly

- Name, date of birth, address, email address, and telephone number

- Appointment booking and enquiry details submitted via our website, phone, or email

- Payment and billing information (processed securely; card details are not stored by us directly — see Section 6)

- Next of kin / emergency contact details, where provided

2.2 Special category (health) data

As a medical and cosmetic dermatology clinic, we collect and process health data, which is a "special category" of personal data under UK GDPR, including:

- Medical history, current medications, and allergies

- Clinical notes, diagnoses, and treatment records

- Photographs and clinical images taken for diagnosis, treatment planning, and monitoring progress

- Results of blood tests, biopsies, and other investigations

- Prescription and medication records

 2.3 Information collected automatically via our website

- IP address, browser type, device information, and general location data

- Pages visited, time spent on site, and referring website

- Cookies and similar tracking technologies (see Section 8)

2.4 Information from third parties

- Referral information from other healthcare providers, where applicable

- Laboratory or histology results from external testing providers

- Information from pharmacies, where relevant to your prescription or care

3. How We Use Your Personal Data and Our Legal Basis

We only use your personal data where we have a lawful basis to do so under UK GDPR. This includes:

• Providing consultations, diagnosis, treatment, and ongoing care - Provision of healthcare (Article 9(2)(h) UK GDPR) and contract (Article 6(1)(b)
• Arranging blood tests, biopsies, and other investigations - Provision of healthcare (Article 9(2)(h))
• Issuing and managing private prescriptions - Provision of healthcare (Article 9(2)(h)) and contract (Article 6(1)(b)
• Contacting you about appointments, follow-ups, or monitoring requirements - Contract (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)
• Taking payment, applying cancellation or administration charges - Contract (Article 6(1)(b)
• Responding to enquiries submitted via our website or by email/phone - Legitimate interests (Article 6(1)(f)
• Maintaining clinical records for legal and regulatory purposes - Legal obligation (Article 6(1)(c)) and Article 9(2)(h)
• Complying with CQC and other regulatory requirements - Legal obligation (Article 6(1)(c)
• Sending marketing communications (e.g. newsletters, offers) only where you have opted in) - Consent (Article 6(1)(a)
• Improving our website and understanding how it is used - Legitimate interests (Article 6(1)(f)) and consent for non-essential cookies
• Preventing fraud and protecting the safety of patients and staff - Legitimate interests (Article 6(1)(f)

We will never use your health data for marketing purposes.

4. Photographs and Clinical Images

4.1 Where clinically necessary, we may take photographs or images as part of your diagnosis, treatment planning, or to monitor your progress. These form part of your confidential medical record.

4.2 We will never use identifiable clinical photographs for marketing, website content, social media, or training purposes without obtaining your separate, explicit, written consent, which you may withdraw at any time.

5. Follow-Up Care, Monitoring, and Prescriptions

5.1 Because certain conditions and medications require follow-up appointments and monitoring tests (such as blood tests) to be provided safely, we retain relevant clinical data to track and remind you of these requirements.

5.2 As we only issue private prescriptions, prescription records are retained as part of your clinical record and may be shared with a pharmacy of your choice solely to enable dispensing, with your consent.

6. Sharing Your Personal Data

We do not sell your personal data. We may share your information with:

• Laboratories and pathology services, for processing blood tests and biopsies.
• Pharmacies, to dispense private prescriptions, where you request this.
• Other healthcare professionals, such as your GP or a specialist, where relevant to your ongoing care and with your consent, unless there is an overriding safeguarding or legal reason to share without consent.
• Payment processors, to securely process card payments.
• Clinic management software and IT service providers (e.g. our practice management system), who process data on our behalf under strict data processing agreements.
• Regulators and authorities, such as the CQC, where we are legally required to do so.
• Professional advisers, such as insurers, auditors, or legal advisers, where necessary.

All third parties who process data on our behalf are required to maintain appropriate security and confidentiality and to only process data in accordance with our instructions.

7. International Data Transfers

Where any of our service providers (for example, cloud storage or software providers) store or process data outside the UK or European Economic Area, we ensure appropriate safeguards are in place, such as adequacy decisions or standard contractual clauses, to protect your data to UK GDPR standards.

8. Cookies and Website Tracking

8.1 Our website may use cookies and similar technologies to:

• Enable core website functionality.
• Understand how visitors use our site (analytics).
• Improve website performance and user experience.

8.2 You can control or disable cookies through your browser settings. Disabling certain cookies may affect the functionality of our website.

8.3 We will request your consent for any non-essential cookies (such as analytics or marketing cookies) via a cookie banner on first visiting our website, in accordance with UK privacy law.

9. Data Retention

9.1 We retain medical records in line with professional and regulatory guidance for healthcare providers, generally for a minimum of 8 years from the date of last treatment for adult patients (longer periods apply for certain records, such as those relating to minors).

9.2 Website enquiry and marketing data is retained only for as long as necessary to fulfil the purpose it was collected for, or until you withdraw consent.

9.3 Financial records are retained in line with HMRC and accounting requirements, typically for 6 years.

10. How We Protect Your Data

We take the security of your personal and health data seriously and have implemented appropriate technical and organisational measures, including:

• Secure, access-controlled clinic management software.
• Encrypted storage and secure transmission of sensitive data.
• Staff training on confidentiality and data protection.
• Restricted access to patient records on a need-to-know basis.
• Regular review of our data protection practices and policies.

11. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure of your data, in certain circumstances (this is limited for clinical records, which we are often legally required to retain).
• Restrict or object to certain processing.
• Data portability, where applicable.
• Withdraw consent at any time, where processing is based on consent (e.g. marketing communications or use of clinical photographs for non-clinical purposes).
• Not be subject to decisions based solely on automated processing.

To exercise any of these rights, please contact us using the details in Section 1. We may need to verify your identity before responding, and we will respond within one month as required by law.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at [www.ico.org.uk](https://www.ico.org.uk) or by calling 0303 123 1113, if you believe we have not handled your data appropriately.

12. Children's Data

We do not knowingly collect personal data from children via our website without appropriate parental or guardian consent. Where treatment is provided to a minor, we handle their data in accordance with relevant safeguarding and consent requirements for the provision of healthcare to minors.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. Any updates will be posted on our website with a revised "Last updated" date.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact:

DermaCutis

10 Psalter Lane

Sheffield

S11 8YN

info@dermacutis.co.uk