Patient Privacy Notice

Velmont Institute (“Velmont Institute”, “we” or “us”) is the controller of the information held about you.

Velmont Institute, 121 Crawford Street, London W1U 6BE. Enquiries about this notice, and requests concerning your information, may be sent to velmontinstitute@gmail.com.

Everything arising from your care here: your clinical record, appointments, membership, billing and your presence in the building.

It also covers the limited information you give us through this website. When you request an appointment or ask to hear more about the clinic, we hold your name, your email address and, where you provide it, your telephone number. We use them to reply to you and, where you have asked to hear more, to send you what you have asked for. We do not use them for anything else, we do not pass them to anyone, and you may ask us to delete them at any time — there is an unsubscribe link in every email we send.

Separately from data protection law, and in addition to it, everything you tell a clinician here is held under the common law duty of confidence. That duty binds every member of staff in this building, clinical and non-clinical.

We will not disclose what you tell us without your consent, except where the law requires us to, or in the rare circumstances where there is an overriding public interest. Where either applies we will tell you, unless telling you would defeat the purpose or place someone at risk.

Your name and contact details; your medical history; the findings of examination and the notes of every consultation; results of laboratory analysis and imaging; clinical photography where taken; genomic sequence data where sequencing is undertaken; prescribing and treatment records; correspondence; your membership record and attendance; billing information; and records of your access to the building, including closed-circuit television footage of communal areas.

Health information is special category data. Processing it lawfully requires a basis under Article 6 of the UK GDPR and a further condition under Article 9.

We provide your care under our contract with you, and under the Article 9 condition for the provision of health care and treatment. We meet our legal and regulatory obligations — record-keeping, notification of certain infections, and submission of performance data to the Private Healthcare Information Network and the Care Quality Commission — as a legal obligation, and under the conditions for health and social care management. We administer your billing and membership under our contract with you. We respond to complaints and claims in our legitimate interests, and under the condition for legal claims. We use information to improve the quality of our care, wherever possible in a form from which you cannot be identified.

Anything beyond your direct care — research, teaching, publication, or the development of any tool or service — requires your explicit consent, given separately for that specific purpose and withdrawable at any time. We will not assume your agreement from the fact that you have been treated here, and declining changes nothing about your care.

Genomic data is the most identifying information that exists about a person, and it identifies your relatives as well as you. It is held under arrangements separate from, and stricter than, those governing the rest of your record: within the United Kingdom, in a named jurisdiction we will tell you; never used for research, teaching or the development of any product without your separate consent; never provided to a third party without your instruction; sequenced by a named accredited laboratory under written contract which may not retain or use it for any other purpose; deleted on request, with written confirmation; and with every access logged, attributed and audited.

A genomic result may be relevant to blood relatives who have consented to know nothing. Before any testing we will discuss with you who a result might affect and what you would wish us to do. We will not contact a relative without your agreement, other than in the exceptional circumstances where the law would require it, and we would discuss that with you first.

Photographs are taken where they are needed for your care — to record a finding, to plan a procedure, or to assess a result against a previous image. They form part of your clinical record, are held under the same arrangements as the rest of it, and are not used in marketing, on our website, in printed material or on any social media account. Any use beyond your own care requires your separate written consent for that specific use, withdrawable at any time. You may decline photography, and doing so will not affect your care in any other respect.

We do not record consultations unless you ask us to, or unless we have explained why we wish to and you have agreed. You are welcome to record your own consultation for your own use; please tell the clinician at the start rather than afterwards. A recording made for your own use remains yours, and we neither keep a copy nor place one in your record unless you ask us to.

Within the clinic, only those involved in your care and the small number of staff whose administrative role requires it. Every access is logged and attributed.

Outside the clinic: laboratories, imaging reporters and specialists contributing to your care, under written contract; any clinician you have asked us to write to; where the law requires it, such as notification of certain infectious diseases or a court order; where there is an overriding public interest, which is rare and which we would discuss with you wherever possible; the Private Healthcare Information Network and the Care Quality Commission, as our regulatory obligations require, in a form that does not identify you; and our insurers and legal advisers where a claim is made or threatened.

We do not write to your general practitioner, your insurer, your employer or any member of your family without your consent. That consent is given for a specific letter to a specific person, and is not taken once at registration to cover everything afterwards.

Your bank or card statement will not identify the service you attended for, and settlement in cash or through a private office is accepted. We do not confirm to anyone, including the press, that you are a patient here — nor do we confirm that someone is not. One named individual handles every enquiry of that kind, and no one else answers.

Where it is appropriate, you may be registered under a name of your choosing. A single named individual holds the record linking that name to your clinical file, and no one else has access to it. Please tell us at registration if this is something you would like: it is straightforward to arrange at the outset and considerably harder afterwards.

Your record is held within the United Kingdom, and we will tell you where and by whom if you ask. Where any processing takes place outside the United Kingdom, we rely on UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the European Commission’s standard contractual clauses. A list of our processors and the countries in which they operate is available on request.

Your clinical record is retained for eight years after your last contact with us, and the record of a patient who has died for eight years after death. Financial records are kept for six years for tax purposes, and records relating to a complaint or claim for as long as necessary to resolve it and for the limitation period afterwards. Records are then securely destroyed.

Every access to every record is logged and attributed, and the logs are audited whether or not a concern has been raised. Any member of staff who opens a record they are not treating is subject to disciplinary action, up to and including dismissal. Every member of staff, clinical and non-clinical, has signed a confidentiality agreement, and agency staff are not used in any role that brings them near a patient or a record. Our information security management system is certified to ISO/IEC 27001 and independently penetration tested each year. Results are not sent by unencrypted email, and no message we send you contains anything that would identify your condition. Photography by anyone, staff or visitor, is not permitted anywhere in the building.

Where a breach of your information occurs which is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within seventy-two hours of becoming aware of it, and where the risk to you is high we will tell you directly, promptly and in plain language.

Separately, where something goes wrong with your care, our duty of candour requires us to tell you what has happened, to apologise, and to explain what we are doing about it. That duty is set out in our Duty of Candour Statement.

You may ask to see what we hold about you and to have a copy; to correct anything factually wrong; to delete what we hold; to pause our use of it while its accuracy is established; to object to processing based on our legitimate interests; to receive certain information in a machine-readable format or have it sent onward; and, where we rely on your consent, to withdraw it at any time. We will not charge you for any of this.

Where you disagree with a clinical opinion rather than a fact, we will record your disagreement alongside it.

Most of your clinical record cannot be deleted on request. We are required by law to keep it, and we may need it to establish or defend a legal claim. Where that applies we will tell you which parts we must retain and why. Information held for other purposes — marketing preferences, or genomic data — can generally be deleted, and we will confirm in writing once it has been.

We respond within one month. Where a request is particularly complex, or where you have made several, we may take longer and will tell you if so. We may need to confirm your identity before we act, which is a protection for you rather than an obstacle.

You may see anything we hold about you, at any time, and you do not need a reason. For most requests it is simplest to ask your physician, who will go through it with you. Where you would like a copy to take away or to give to another clinician, write to our Data Protection Officer at the address in section 1 and we will provide it within one month, at no charge.

Two narrow exceptions exist in law: where disclosure would be likely to cause serious harm to your physical or mental health, and where the record contains information about another person who has not consented to its disclosure. Both are rare. Where either applies we will tell you, and explain what we can release.

No decision about your care is made by automated means alone. Some of the analysis we use — in imaging, in dermatology and in laboratory interpretation — is assisted by software, and in some cases by artificial intelligence. In every case the result is reviewed by a clinician and the decision is theirs. Where we use such tools we will tell you, and you may ask what part they played.

We provide care to adults only, and we do not knowingly hold information about anyone under the age of eighteen. Where a person under eighteen requires care, we will help them find a service able to provide it.

Cameras operate in the entrance, the vehicle access and the communal corridors, for the security of patients and staff. They do not operate in consulting rooms, treatment rooms, changing areas or lavatories. Footage is retained for 30 days and then deleted, and is viewed only where there is a specific reason to. You may ask for a copy of footage of yourself.

If you are unhappy with how we have handled your information, please tell us first so that we have the chance to put it right — contact our Data Protection Officer at the address in section 1. If you remain dissatisfied you may complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. You may do that at any point, and you do not have to come to us first.

Complaints about your care, rather than about your information, are handled under our Complaints Procedure, which includes a route to independent adjudication. Complaining will not affect your care or your membership in any respect.

We may update this notice. Any change will be published here, and where a change is material we will tell you directly. Last updated 04/09/2026, version 1. Previous versions are available on request.