Privacy Notice

1. Who we are

Bidaye ENT Surgery Ltd provides private ENT consultations and treatment and is the controller of personal information used for the practice’s clinical and administrative purposes. Company number: 15064933. Registered office: 6th Floor, 2 London Wall Place, London, England, EC2Y 5AU. In this notice, ‘we’, ‘us’ and ‘our’ mean Bidaye ENT Surgery Ltd.

2. Scope

This notice explains how we use personal information when you visit our website, contact us, complete the registration questionnaire, book or receive private care, use insurance, pay an invoice, correspond with the practice or are invited to provide optional feedback. Hospitals and some other organisations involved in your care may act as separate controllers and provide their own privacy notices.

3. Information collected

We may collect identity and contact details; date of birth; address; hospital number; GP/referrer details; next-of-kin or authorised-representative details; appointment and correspondence records; symptoms, history, medications, allergies and uploaded referral documents; examination findings, diagnoses, tests, images, transcripts, treatment and prescriptions; insurer, membership, authorisation and claim information; consultation dates, procedure/billing codes, invoices and payments; complaints and feedback; and technical website information such as IP address, browser and pages requested.

4. Sources

Information comes from you and, where relevant, your GP/referrer, hospitals, laboratories, radiology and pathology providers, other clinicians, your insurer, an authorised representative and service providers supporting appointments, records and billing.

5. Purposes and legal bases

We use information to respond to enquiries; arrange appointments; assess, diagnose and provide care; maintain clinical records; communicate with you and other care providers; prescribe and arrange investigations; verify insurance and administer claims; invoice and collect payment; manage complaints and legal claims; comply with professional, tax, regulatory and legal duties; protect systems; and improve services. Depending on purpose, the Article 6 basis is performance of a contract or steps requested before a contract (6(1)(b)); legal obligation (6(1)(c)); legitimate interests in operating a safe private practice, communicating, protecting systems, obtaining payment and defending claims (6(1)(f)); or consent for a specific optional activity (6(1)(a)). For health information used to provide/manage care, the additional condition is Article 9(2)(h) and the applicable Data Protection Act 2018 condition. Other conditions may apply for vital interests or legal claims.

6. Semble

We use Semble as our secure practice-management and clinical-record system for registration, appointments, correspondence and medical records. Accounts are held by Mr Bidaye, the practice manager and the private secretary, Mrs Amanda Pashley. Each has access to the complete patient record, including consultation notes and letters, where required to support care and practice administration. Each is contractually bound by confidentiality and uses an individual account protected by two-factor authentication.

7. Semble registration and patient letters

After an appointment is confirmed, Mrs Amanda Pashley sends a secure Semble registration questionnaire and the Welcome Letter. The questionnaire collects information relevant to care and records the required and optional acknowledgements described below. The patient-registration link is not published on the website. Your consultation letter is made available through Semble’s secure patient portal; you receive a link and must verify your date of birth before accessing it.

8. Heidi Health

Where clinically appropriate, Mr Bidaye may use Heidi Health, an AI-assisted medical scribe, to help prepare consultation notes and correspondence. Patients are informed about its use and may decline without affecting their care. Heidi processes consultation audio to produce a written transcript; the audio itself is not retained. The transcript is stored securely within Mr Bidaye’s professional Heidi account and may provide relevant context during later consultations, supporting continuity of care. It is retained while necessary for the patient’s ongoing care and deleted when no longer required under the practice’s retention policy. Mr Bidaye reviews the clinical note and correspondence before they are saved in Semble as part of the formal clinical record.

9. MedServ

MedServ provides invoicing, payment collection and billing administration. It does not have access to Semble or patients’ complete medical records. The practice manager separately provides the information required for invoicing and insurance administration: name, date of birth, address, email, telephone number, hospital number, insurer details, authorisation number, consultation date, and relevant procedure and billing codes. MedServ does not routinely receive diagnoses, consultation notes or clinical letters.

10. Insurer requests

If you use insurance, we may provide information reasonably required to confirm cover, obtain authorisation, administer or settle a claim, or answer an invoice query. If an insurer specifically requests clinical information, we will normally provide the relevant consultation letter. The request and letter will be reviewed first so that information clearly unrelated to the claim is not shared unnecessarily. The letter may be sent directly to the insurer or securely through MedServ when MedServ is managing the query.

11. GP/referrer

We normally send your consultation letter to your GP, including where you referred yourself, to support continuity and safety of care. If you do not want this, tell Mr Bidaye during the consultation and we will record and respect the request. We may still need to share relevant information where required by law, for safeguarding or to address a serious risk of harm. Where possible, we will discuss this with you first.

12. Treating hospitals

The hospital at which you are seen or treated receives information required to arrange and provide care. This commonly includes identifying/contact and appointment details, the consultation note and letter, and information about planned investigations or procedures. The hospital retains this within its own medical record and is responsible for its use, security and retention under its own privacy notice. It may issue separate invoices.

13. Other healthcare professionals

Where another clinician or provider is involved, we may send a separate referral or correspondence letter containing information relevant to their role. Where appropriate for safe coordinated care, we may copy them into the main consultation letter so they have the necessary context. Recipients may include consultant colleagues, radiology, pathology/laboratories, anaesthetists, audiologists, speech and language therapists, pharmacies and other treating professionals.

14. SignatureRx

Where Mr Bidaye issues an electronic private prescription, SignatureRx receives the information needed to create and deliver it, which may include identity and contact details, date of birth, prescribed medication, dosage and prescriber information. The patient receives the prescription token by email and presents it to a participating pharmacy. The dispensing pharmacy processes the prescription under its own privacy notice.

15. Doctify feedback

After a consultation, Mrs Amanda Pashley may send an optional Doctify review link through Semble. If you have specifically agreed, she may provide your mobile number to Doctify so Doctify can send an invitation by text. No diagnosis, consultation note or clinical letter is supplied for this purpose. Participation is voluntary and does not affect care. Any review submitted is handled under Doctify’s privacy notice and the patient’s chosen publication settings. Consent may be withdrawn for future invitations by contacting the practice.

16. No promotional marketing

We do not use patient contact details to send newsletters or promotional emails.

17. Other disclosures

We may disclose relevant information to professional advisers, accountants, auditors, indemnity providers, regulators, law-enforcement bodies or courts where reasonably necessary for advice, compliance, safeguarding, prevention/detection of crime or legal claims. We do not sell patient information.

18. Website and external content

The website processes technical information required to deliver and secure pages. It currently includes external content from Doctify, iWantGreatCare, YouTube and Google Maps. None of this content loads automatically: each item only loads once you choose to view it, or after you accept our cookie notice. Loading or interacting with external content may disclose technical information such as an IP address and may allow that provider to store or access information on the device. Their own privacy and cookie terms apply. The website does not currently use Google Analytics. You can change your choice at any time using ‘Cookie preferences’ in the footer.

19. International transfers

Some suppliers or subprocessors may process information outside the UK. Where this occurs, we require an applicable adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, together with any required assessment. Further information about relevant safeguards may be requested.

20. Retention

Formal adult clinical records in Semble are normally retained for at least eight years after the patient’s last treatment or discharge. Some records may be kept longer where required by the nature of the care, applicable records-management guidance, professional or indemnity requirements, an ongoing complaint or legal claim, or another legal obligation. Heidi transcripts are retained while needed for ongoing care and deleted when no longer required under the practice’s retention policy. Billing, company, security and consent records are retained for the applicable purpose and statutory period. Information is securely deleted or anonymised when no longer required.

21. Security

We use proportionate organisational and technical measures, including controlled access, individual accounts, two-factor authentication, confidentiality duties and supplier agreements. Please avoid sending urgent or highly sensitive information by ordinary email unless asked to use an approved route.

22. Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability; object to certain processing; and withdraw consent where consent is used. Rights are not absolute, and clinical, legal or professional duties may require some information to be retained or used. We do not make solely automated decisions producing legal or similarly significant effects about care.

23. Requests and complaints

For a privacy concern or data-protection request, email manager@bidayeentsurgery.com with ‘Data protection request’ in the subject line, or write to the registered office. We may need to verify identity and will respond within the applicable legal timeframe. You may also complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113. We would welcome the opportunity to address the concern first.

24. Changes

We may update this notice when services, suppliers or legal obligations change. The current version and date will be published here. Material changes affecting existing patients will be communicated where appropriate.