Privacy Policy

1. Data Controller & Contact Details

The data controller responsible for your personal data is Lincolnshire Knee Clinic (correspondence address available on request).

If you have any questions about this privacy policy, wish to exercise your data rights, or would like to contact our Data Protection Officer, please contact us at:

• Email: info@lincsknee.com
• Telephone: 07770 473437
• Data Protection Officer: Data Protection Officer (info@lincsknee.com)

2. What Information We Collect

Enquiry Information

When you use our general contact form, we collect your name, email address, telephone number (optional), and the content of your general enquiry message. We do not use this information for marketing unless you have separately provided explicit consent.

Booking Information

For face-to-face consultations, appointments are arranged directly with the local reception team at your preferred clinic location by telephone. No patient details, contact details, or clinical information are collected or stored through this website for face-to-face bookings.

For video consultations, bookings are scheduled online using Google Calendar, and any required payments are processed securely through Stripe. Google Calendar collects your name, contact details, and appointment preferences, while Google Meet handles video consultation connectivity. We do not receive, store, or process payment card details on this website.

Clinical Information

During clinical consultations, we may collect symptoms, medical histories, diagnoses, medications, imaging reports (MRI/X-Ray/CT), and treatment histories. This is special category data under UK GDPR and is handled with strict security controls.

Optional Marketing Consent

If you choose to tick the optional email updates checkbox on our contact or booking pages, or sign up via our newsletter form, we will collect your name and email address for the sole purpose of sending occasional patient education updates about knee health and clinic services.

This consent is entirely optional. It is not required to book an appointment or to contact the clinic. The checkbox is unticked by default and can only be activated by you. We do not collect or store any clinical symptoms, diagnoses, or health history for marketing purposes. If you sign up through a specific page of our website (for example, a page about a particular treatment), we record the general topic area you appeared interested in — such as "knee replacement" or "injections" — purely so we can send you more relevant follow-up information. This is a broad marketing category, not clinical or medical data, and is used solely to tailor which educational emails you receive.

WhatsApp Business

Lincolnshire Knee Clinic uses WhatsApp Business as an administrative contact channel. If you contact us via WhatsApp, we may receive your name, telephone number, and the content of any messages you send. This information is used solely to respond to your administrative enquiry.

WhatsApp messages are processed and stored on WhatsApp servers in accordance with Meta's privacy policy. We recommend you review WhatsApp's own privacy policy before using this channel. We do not use WhatsApp as a clinical record system.

3. Why We Collect It & How We Use Your Information

• To respond to general administrative enquiries.
• To schedule and manage video consultations through Google Calendar and Google Meet.
• To coordinate clinical assessments, diagnoses, and treatment plans.
• To communicate with referrers (GPs, physiotherapists) regarding your care.
• To coordinate clinical referrals with selected third-party diagnostic imaging providers (MRI, X-ray, ultrasound).
• To process invoices and health insurance claims (Billing/Financial Data).
• To send patient education newsletters and service updates to patients who have explicitly opted in (marketing email only).

4. Google Calendar Appointment Scheduling

We use Google Calendar appointment schedules (part of Google Workspace Business Standard) to manage and confirm patient video bookings. When you book an appointment, you will be directed to a Google-hosted scheduling page. Your booking details are stored within our Google Workspace account and are subject to Google's data processing terms and our clinical confidentiality obligations.

5. Google Meet Video Appointments (Where Available)

Where video consultations are offered, they may be conducted via Google Meet. Google Meet links are generated and shared with you after your appointment is confirmed. These sessions are subject to Google's data processing terms. We do not record video consultations without explicit patient consent.

6. Stripe Payment Processing

Online payment for appointments is processed securely through Stripe, an approved payment services provider. Stripe handles all card data directly and is certified to PCI DSS Level 1 security standards. Lincolnshire Knee Clinic does not receive, process, or store any card payment details on this website.

7. External Links & Third-Party Services

Social Media Links

Our website may include links to our social media profiles (Instagram, Facebook, LinkedIn). Clicking these links will take you to an external platform operated by a third party. We are not responsible for the privacy practices of those platforms. Please review the respective platform's privacy policy before interacting with it.

Google Calendar Appointment Scheduling

When you book a video appointment, you will be directed to Google Calendar Appointment Schedules, hosted by Google. The booking process on Google's platform is subject to Google's own Privacy Policy and Terms of Service. We use Google Calendar to manage appointment availability only; we do not receive or store payment data through this service.

Stripe Payment Processing

Where payment is required, this is handled externally by Stripe. You will interact directly with Stripe's payment interface. Stripe processes all card details and is PCI DSS Level 1 certified. Lincolnshire Knee Clinic does not receive or store card details on this website.

8. Future Secure Data Storage — Supabase (Planned Phase 2)

In a future phase of our digital platform, we plan to integrate Supabase as a secure cloud database provider. Supabase will store only opted-in marketing contact records (name, email, consent status, consent timestamp, and consent source) using AES-256 encryption and SSL/TLS secure transit. No clinical or health data will be stored in this system. This integration will operate under a signed Data Processing Agreement and comply fully with UK GDPR and DPA 2018.

9. Marketing Consent, Unsubscribe Rights & Right to Object

We only send email updates to patients who have given explicit, freely given, informed, and unambiguous consent by ticking the optional marketing checkbox.

You have the right to object to direct marketing at any time and the right to withdraw your consent at any time. To unsubscribe:

• Click the unsubscribe link in any update email we send.
• Contact us directly at info@lincsknee.com.

On receipt of your unsubscribe request, we will cease all marketing communications immediately.

10. Referrals to Third-Party Diagnostic Providers (Future Phase)

When our consultant refers you to a third-party diagnostic imaging provider (for MRI, X-ray, or ultrasound scans), we will share relevant clinical and personal details with them.

• Disclosure authorization: Information is shared only where appropriate, clinically necessary, and authorized by the patient.
• Scope of data: The shared data is strictly limited to the minimum necessary information required to coordinate and perform the diagnostic scan (e.g., name, date of birth, contact details, and clinical history).
• Commercial arrangements: Lincolnshire Knee Clinic may have commercial or commission arrangements with selected diagnostic providers. Any relevant financial interest or referral arrangement will be disclosed clearly to patients, and referrals will always respect patient choice and clinical appropriateness.

[Draft wording requiring legal and professional review prior to publication]

11. Security of Special Category Health Data

Medical data is classified as special category data under UK GDPR Article 9. We implement strict security controls including encrypted storage, role-based access permissions, and access audit logging. Integration workflows (Microsoft 365, Google Workspace, Stripe) comply with clinical data processing obligations.

12. Data Retention

We retain clinical records for the period required by NHS record retention guidelines and applicable regulation. General enquiry records are retained for 8 years for clinical records (in line with NHS guidelines). Marketing consent records are retained until you unsubscribe, at which point they are flagged as unsubscribed and suppressed from future communications.

13. Your Rights Under UK GDPR

• Right to access your personal data.
• Right to correct inaccurate personal data.
• Right to erasure ("right to be forgotten") where applicable.
• Right to restrict processing of your personal data.
• Right to data portability.
• Right to object to processing, including direct marketing.

To exercise any of these rights, please contact us at info@lincsknee.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how your data has been handled.