Our Privacy Policy 

The Hip and Knee Clinic - Mr John-Paul Whittaker

Last updated: 25/09/26

 

Introduction

​

The Hip and Knee Clinic is committed to protecting and respecting your privacy. This privacy policy explains how we collect, use, and protect your personal and medical data when you use our private healthcare services, visit our clinic, or use our website www.jpwhittaker.co.uk

 

We act as the "Data Controller" under the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

 

What Information We Collect About You

 

To respond to enquiries and to provide safe and effective medical care and treatment, we need to collect and process personal data, including health information, which is considered "special category data.”

 

This may include: Identity & Contact Details: Full name, date of birth, title, home address, email address, and phone numbers.

 

Emergency Contacts: Name and phone number of your next of kin or emergency contact.

 

Medical History & Clinical Records: Consultation notes, treatment details, diagnoses, medical history, and clinical letters.Test Results: Laboratory pathology reports, imaging/X-ray results, and diagnostic investigations.

 

Administrative & Financial Data: Appointment records, billing information, and payment details

 

Please note we do not store and retain full credit card details.

 

Lawful Basis for Processing Your Data

 

Under the UK GDPR, we must have a lawful basis to process your information.

 

For medical data, we rely on:

Provision of Health Care: Processing is necessary for the provision of medical diagnosis, the provision of health or social treatment, or the management of health systems (Article 6(1)(b) and Article 9(2)(h) of the UK GDPR).

 

Our Legal Obligations: To comply with regulatory duties, such as maintaining clinical records and GMC (General Medical Council) guidelines.

 

Legitimate Interests: For the efficient administration and running of our private practice, such as appointment scheduling and maintaining patient records.

 

How We Share Your Information

 

We keep your medical records confidential. However, to coordinate your ongoing medical care, we may share relevant information with:

 

• Other healthcare professionals directly involved in your caresuch as - The hospitals where we see patients (Spire Yale and Ludlow Private Unit at RJAH Orthopaedic Hospital)

• Medical specialists

• GPs Independent contractors such as physiotherapists, dentists, opticians, pharmacists

• Private Sector Providers

• Voluntary Sector Providers

• Ambulance Trusts

• Social Care Services

• Local Authorities

• Education Services

• Police & Judicial Services

• Other ‘data processors’

• Laboratories, imaging providers, and hospitals for diagnostic testing.

• Third-party administrative service providers or IT service providers (e.g., electronic medical record software vendors) who are bound by strict data processing agreements.

​​

We will never sell your personal data or share it with companies for them to market to you.

 

How We Keep Your Data Secure

 

We store your information using a combination of secure physical storage (paper records) and encrypted digital databases/electronic health record systems.

 

Access to your clinical data is strictly limited to authorised medical and administrative personnel bound by confidentiality obligations.

 

How Long We Keep Your Records

 

We retain your medical records in line with the retention periods recommended by the NHS Records Management Code of Practice and medical defence organisations.

 

For adult patients, medical records are typically kept for a minimum of 8 years after your last interaction with the clinic (this could be longer for children or specific clinical specialities).

 

Your Data Protection Rights

 

Under UK data protection law, you have several rights regarding your personal information:

 

Right of access: You can request a copy of the personal and medical data we hold about you (usually provided free of charge).

 

Right to rectification: You can ask us to correct inaccurate or incomplete data.

 

Right to erasure: You can request the deletion of your data in certain circumstances (though medical record retention laws may limit this).

 

Right to restrict or object: You can object to or limit how we process your information.

 

Contact Us & Complaints

 

If you have any questions about this privacy policy, wish to exercise your rights, or want to make a complaint, please contact our designated Privacy Lead:

Name/Title: Mr John-Paul Whittaker

Email: info@jpwhittaker.co.uk

Phone: 01978 268051

Address: Spire Yale Hospital, Croesnewydd Road, Wrexham, LL13 7YP 

Registered Business Address: 2nd Floor, Refuge House, 33-37 Watergate Row, Chester, CH1 2LE

 

If you are unsatisfied with our response, you have the right to lodge a complaint with the UK supervisory authority for data protection issues, the Information Commissioner’s Office (ICO):
Website: ICO Website

Helpline: 0303 123 1113