How we look after your information

This privacy notice explains how OS Clinic Ltd (the website “operator”) handles personal information collected through this website and how enquiries submitted through it are processed. The site supports the practice of Professor Nima Heidari, who treats patients at OS Clinic, The London Clinic and Cromwell Hospital. It is written to be read alongside, not in place of, the privacy notices published by each of those hospitals.

1. Who is the data controller?

OS Clinic Ltd is the website operator and the data controller for the personal data submitted via this site (enquiries, booking requests, GP referrals).

Registered address: 45 Queen Anne Street, London W1G 9JF.

Professor Nima Heidari (Consultant Orthopaedic Surgeon, GMC-registered specialist in Trauma & Orthopaedic Surgery) is a treating clinician who works at OS Clinic and also holds practising privileges at The London Clinic and Cromwell Hospital. Each hospital where Professor Heidari sees patients is a separate data controller for the clinical records held at that hospital:

• OS Clinic, 45 Queen Anne Street, London W1G 9JF
• The London Clinic, 5 Devonshire Place, London W1G 6HL
• Cromwell Hospital, 164–178 Cromwell Road, London SW5 0TU

Once you become a patient, your medical record is held and controlled by the hospital where you are seen. Each hospital is a separate data controller for its own records and operates under its own privacy notice. Professor Heidari accesses those records as part of providing clinical care under each hospital’s practising-privileges arrangements.

2. What information do we collect?

2.1 Information you give us

• Contact-form and booking-enquiry submissions — your name, email address, telephone number (if provided), and any clinical information you choose to include in your message (for example, a description of your symptoms, scan results, or insurer details).
• Email or telephone enquiries — whatever information you share when you contact the practice directly.

2.2 Information collected automatically

• Server logs — the website’s hosting provider records the IP address, browser type, and pages visited for each request, for security and abuse-prevention purposes. These logs are retained for a short period by the host and are not used to identify individual visitors.
• Cookies — the site uses a small number of essential cookies and a single first-party preference flag to remember that you have seen the cookie banner. The site does not currently run third-party analytics, advertising, or tracking. See the Cookie Notice for details.

2.3 Special-category (health) data

If your message includes information about your health, that is “special-category” data under Article 9 of the UK GDPR and is treated with additional care. We ask that you keep clinical detail in website messages to a minimum and share full clinical information only after a secure clinical channel has been established.

3. Why do we collect it — and on what lawful basis?

Purpose	Lawful basis (Art 6)	Special category basis (Art 9, where relevant)
Responding to enquiries sent through the contact / booking form	Art 6(1)(b) — steps prior to entering a contract for treatment, and Art 6(1)(f) legitimate interests in operating the practice	Art 9(2)(h) — provision of healthcare, where the message includes health data
Providing clinical care once you become a patient	Art 6(1)(b) contract for care; Art 6(1)(c) legal obligations (medical records, regulatory)	Art 9(2)(h) provision of healthcare and treatment by a regulated health professional
Keeping the website secure (server logs, abuse prevention)	Art 6(1)(f) legitimate interests in protecting the site from misuse	n/a
Essential cookies and the “you’ve seen the banner” flag	Strictly necessary — PECR Reg 6(4); no consent required for cookies essential to the service you have requested	n/a
Marketing communications (e.g. occasional updates)	Art 6(1)(a) consent — only if you have explicitly opted in; you may withdraw consent at any time	n/a

Where processing relies on consent, you may withdraw it at any time by contacting the practice. Withdrawal does not affect processing carried out before the withdrawal.

4. How long do we keep it?

• Contact-form and general website enquiries — retained for up to 24 months from last contact, unless they are absorbed into a clinical record.
• Clinical records — held by the hospital concerned in line with its retention policy and applicable NHS / GMC guidance, which typically requires retention of adult medical records for at least 8 years after the conclusion of treatment, and longer for paediatric, obstetric, and certain other categories.
• Server logs — retained by the hosting provider for a short period (typically up to 30 days) for security purposes.
• Accounting and tax records — retained for 6 years from the end of the relevant tax year, as required by HMRC.

5. Who do we share it with?

The practice shares the minimum information necessary to deliver care and run the practice. Recipients may include:

• The practice manager and administrative team, who triage enquiries and manage diaries.
• The hospital where you are seen, if your enquiry leads to an appointment — The London Clinic, OS Clinic, or Cromwell Hospital. Each operates as a separate data controller for the records it holds.
• Other treating clinicians involved in your care — for example, a referring GP, anaesthetist, radiologist, or physiotherapist — on a need-to-know basis.
• Your medical insurer, if you are using insurance, for the purpose of pre-authorising and invoicing treatment.
• The website host and IT service providers (acting as data processors), to the extent strictly necessary to operate the site and the practice’s email.
• Regulators, professional bodies, and law-enforcement agencies, where there is a legal obligation to do so (for example, a GMC investigation, a court order, or a safeguarding referral).

The practice does not sell personal information and does not share it for advertising or marketing purposes.

6. International transfers

Some of the IT services that support this website are provided by suppliers based outside the UK. In particular, the website is hosted on infrastructure operated by Netlify, Inc. (United States), and email may pass through providers based outside the UK and EEA. Where personal data is transferred outside the UK, we rely on the UK Government’s adequacy regulations (where they apply) or on the UK International Data Transfer Agreement / EU Standard Contractual Clauses with the UK Addendum, together with appropriate supplementary measures.

Clinical records held by the hospitals named above are governed by each hospital’s own privacy notice and arrangements for international transfer.

7. Your rights

Under UK GDPR you have the following rights in relation to the personal information that the practice controls:

• Access — to ask whether we hold information about you and to receive a copy.
• Rectification — to ask us to correct information that is inaccurate or incomplete.
• Erasure — to ask us to delete information, in certain circumstances. Note that medical-record-retention obligations may prevent erasure of clinical records during the statutory retention period.
• Restriction — to ask us to limit processing while a query is resolved.
• Portability — to receive certain information in a structured, commonly used, machine-readable form.
• Objection — to object to processing carried out under the “legitimate interests” basis.
• Withdraw consent — for any processing that relies on consent, at any time.
• Lodge a complaint with the Information Commissioner’s Office (ICO).

To exercise any of these rights, please contact the practice via the secure message form. We will respond within one calendar month, and may ask for proof of identity before releasing information. Subject-access requests are normally free of charge.

8. Complaints

If you are unhappy with how the practice has handled your personal information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office:

• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• Online: ico.org.uk/make-a-complaint

9. Security

The practice takes appropriate technical and organisational measures to protect personal information from loss, misuse, unauthorised access, disclosure, alteration, and destruction. No method of transmission over the internet is completely secure, however, and you should avoid sending highly sensitive information through unencrypted channels.

10. Changes to this notice

We may update this notice from time to time to reflect changes in our practice or in the law. The “last updated” date below shows when the current version took effect. Material changes will be highlighted at the top of this page for a reasonable period.

Last reviewed: 16 July 2026.