Abergavenny Ear Clinic

1. Who we are

Abergavenny Ear Clinic (“we”, “us”, “our”) provides ear wax removal and related ear care services. We are the data controller responsible for your personal information.

Address: 63 Monmouth Road, Abergavenny, NP7 5HR.

Email: info@abergavennyearclinic.co.uk. Phone: 07386 211270.

ICO registration number: [to confirm once registered].

This policy explains what personal information we collect, how we use it, and the rights you have. It applies to our website and to the care we provide at the clinic and during home visits.

2. The information we collect

Information you give us directly, including when you book, enquire or attend an appointment:

• Your name, contact details (phone, email, address) and date of birth.
• Booking and appointment details.
• Health information relevant to your ear care, such as symptoms, relevant medical history, medication and the outcome of your treatment.
• Any correspondence you send us.

Information collected automatically when you use our website, such as your IP address, device and browser type, and how you use the site. This is collected through cookies and similar technologies (see section 7).

3. Health information (special category data)

The health information we record is “special category” data under UK data protection law and is given extra protection. We only collect what we need to provide safe, appropriate ear care, we keep it secure, and we do not use it for marketing. Our lawful basis for processing it is the provision of health care and treatment (UK GDPR Article 9(2)(h)), supported by your consent to treatment.

4. How we use your information and our lawful bases

We use your information to:

• Provide your appointment, treatment and aftercare, and keep accurate clinical records.
• Take payment and manage bookings, reminders and cancellations.
• Respond to your enquiries and contact you about your care.
• Meet our legal, regulatory and insurance obligations.
• Improve and maintain our website and services.

Our lawful bases under UK GDPR are: your consent (for example, optional cookies and marketing if you opt in); the performance of a contract (to provide the service you have booked); our legitimate interests (to run and improve the clinic, where these do not override your rights); and our legal obligations. For health information we rely on Article 9(2)(h) as set out above.

5. Booking and payments

Online bookings are handled through Timely, our appointment system. Card payments are taken in person using Square. These providers process your information on our behalf or as controllers in their own right, under their own privacy policies. We do not store full card details ourselves.

6. Sharing your information

We do not sell your information. We may share it with:

• Our booking and payment providers (Timely and Square), and our website host, who process data on our behalf under appropriate agreements.
• Your GP or another healthcare professional, where a referral or onward care is appropriate and with your knowledge.
• Our insurers or professional advisers, or regulators and authorities, where we are legally required to do so.

7. Cookies

Our website uses cookies to make it work and to understand how it is used. Essential cookies are needed for the site to function. Optional cookies, such as analytics, are only set with your consent through the cookie banner. You can change your choices at any time, and you can manage cookies in your browser settings.

8. How long we keep your information

We keep your information only as long as necessary. Clinical records are retained in line with professional and legal guidance [typically around 8 years after your last appointment for adults, to be confirmed]. Enquiry and website data is kept for a shorter period. When information is no longer needed, we delete or anonymise it securely.

9. How we protect your information

We take appropriate technical and organisational measures to keep your information secure, including secure storage, restricted access, and an encrypted (HTTPS) website. While no system is completely secure, we work to protect your information and limit access to those who need it.

10. Your rights

Under UK data protection law you have the right to:

• Access the personal information we hold about you.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete your information, where there is no legal reason for us to keep it.
• Restrict or object to how we use your information.
• Request a copy of certain information in a portable format.
• Withdraw consent at any time, where we rely on consent.

To exercise any of these rights, contact us using the details below. We will respond within one month.

11. Children

Where we provide care to a child, we collect and handle their information with the consent and involvement of a parent or guardian.

12. Changes to this policy

We may update this policy from time to time. The latest version will always appear on this page with the date it was last updated.

13. Contact us and how to complain

If you have any questions about this policy or how we handle your information, please contact us at info@abergavennyearclinic.co.uk or 07386 211270.