Privacy Policy and Notice

For patients, carers, programme participants and website visitors

1. Who we are

Synthesis Clinic Ltd, trading as Synthesis Clinic, company number 11457261, registered office Unit 6 Castle End Business Park, Castle End Road, Ruscombe, Reading, Berkshire RG10 9XQ. We are the data controller for your personal data. We are regulated by the Care Quality Commission, Provider ID 1-7720456969, and registered with the Information Commissioner's Office under registration ZA550819.

Data protection queries: our Data Protection Lead, at dataprotection@synthesisclinic.co.uk, or by telephone on 01628 964330.

Our Medical and Company Director is our Caldicott Guardian, which means she is responsible for how patient information is protected and appropriately shared.

2. Who this notice covers, and what we hold

We hold different information about different people. Most of this notice concerns registered patients, because that is where we hold the most. If you are not a registered patient, the table below tells you what applies to you.

You give us information through questionnaires, registration and consent forms, during consultations in person, by video or telephone, and by email, phone or post. Testing laboratories, your GP and other healthcare providers may also send us information about you with your agreement.

3. How to send us confidential information

The most secure ways to send us anything confidential are the messaging and upload functions on your patient portal, or Egress secure email. Both are always available, and there is no charge for either. You can request any clinic coordinator or reception staff to send you a secure Egress email to which you can reply without holding a paid account.

You may prefer to use ordinary email instead. That is your choice, and we will not refuse it. We want you to know before you decide that ordinary email is not encrypted while it travels, which makes it less secure than the two routes above.

Whichever route you choose, once your message reaches us, we look after it to the same standard as everything else we hold. Where it holds clinical information the email is filed to your record, kept for the period at section 9, protected by the measures at section 8, and included in any request you make for a copy of your information.

Our own staff do not send anything containing your identifiable or health information by ordinary email. They use the portal or Egress.

4. Why we use your information, and our legal bases

Information about your health is special category data, which needs a condition under Article 9 of the UK GDPR as well as a lawful basis under Article 6. Both are set out below.

5. AI-assisted documentation, and the technology we use

To let our clinicians focus on you rather than on typing, we may use Heidi, an AI-powered medical scribe, to transcribe the consultation and draft the clinical note. Your clinician will tell you if the scribe is being used and you may decline, with no effect on your care. Please note that Heidi use is routine practice for our medical doctors and independent and supplementary prescribers unless you decline, with other staff applying for use on a case-by-case basis.

• Every AI-drafted note is reviewed and approved by your clinician before it becomes part of your record.
• Audio recordings are not kept in your record and are automatically deleted after a short, configured period. Only the clinician-approved note is retained.
• Heidi Health Ltd processes this data on our behalf under a written agreement, with data hosted in the UK. Heidi is registered with the MHRA as a Class I medical device for documentation assistance.
• No AI tool makes any decision about your diagnosis or your treatment, and we make no decisions about you by automated means alone.

6. Security cameras at our premises

We operate security cameras at the clinic for the security of the premises and the people in them. Cameras inside the building record outside working hours only. A camera at the entrance records when someone comes to the door, both during and outside working hours.

The system records sound as well as pictures when it detects motion or an event to support security at the premises. Recordings are kept for 30 days unless they are needed for an investigation, and are used only for the purpose above. Signs notifying you of SimpliSafe security system use are displayed at the entrance.

No camera overlooks a consulting room, a treatment area, or any screen showing patient information. If you would like to see footage of yourself, or would prefer to be admitted without using the entrance camera, please ask any member of the team.

7. Who we share it with, and the suppliers we use

Within the clinic, information is shared between staff only as necessary for safe and effective care. Externally, we share with your explicit agreement, or where required by law or by an overriding public interest such as safeguarding. We never sell or trade your personal data, and we do not allow our suppliers to use it for their own purposes.

We use carefully selected suppliers under written contracts. They act on our instructions and are bound to keep your information secure. The main ones are:

Historic records from our former systems (Cliniko, Swandoola and Living Matrix) have been retrieved and are stored securely on encrypted drives.

8. How we protect it

We take a privacy by design approach: two-factor authentication on all clinical systems, encryption in transit and at rest, role-based access limited to authorised staff, encrypted devices, secure disposal of confidential waste, and contractual security obligations on all our suppliers. Access to clinical records is logged and audited.

9. How long we keep it

Because we work in cancer care, most of our clinical records are held for considerably longer than a general medical record.

• Cancer and oncology records: a minimum of 30 years from the date of diagnosis, or from when you first came to the clinic, whichever is the later. Where a patient dies, the record is held until the later of that period and 8 years after death. This follows the national Records Management Code of Practice, which sets 30 years for this record type, because information about a diagnosis and its treatment can remain clinically important decades later.
• Other adult health records: generally 8 years after your care with us concludes.
• Children and young people's records: until their 25th birthday, or 26th if they were 17 when care concluded. Where the record relates to cancer, the 30 year period above applies if it is longer.
• Programme and enquiry records: kept only while they serve a purpose and then deleted.
• Security camera recordings: 30 days unless needed for an investigation.
• Financial records: 6 years plus the current year. Complaints files: 10 years.

Full details are in our Records Management and Retention Policy, available on request.

10. Sending information outside the UK

Some of our suppliers, and some specialist testing laboratories, process information outside the United Kingdom.

Our rule is that this only happens where the transfer is covered by a UK adequacy decision, by the International Data Transfer Agreement, or by the UK Addendum to the standard contractual clauses, and where our Medical and Company Director has approved it following an assessment of the risk.

If you would like to know which safeguard applies to a particular supplier or laboratory, ask us at dataprotection@synthesisclinic.co.uk, and we will tell you and provide a copy where we are able to.

Several of the suppliers listed at section 7, including Google and Contentsquare, process information in the United States. These transfers are made under the UK Extension to the EU-US Data Privacy Framework where the supplier is certified, and otherwise under the International Data Transfer Agreement or the UK Addendum.

11. Children and young people

We see children and young people for consultations. Where you are under 18, this notice applies to you too, and we will explain how we use your information in a way that makes sense for your age.

• A parent, or someone else with parental responsibility, usually makes decisions about your information while you are younger.
• As you get older, if you understand what is involved, you can make those decisions yourself. Our clinicians assess that for each decision.
• You can ask to see what we hold about you, ask us to correct it, and ask us questions about it, in the same way an adult can.
• If you would like to talk to us about your information without a parent present, tell any member of the team.

12. Research

We carry out research, which is approved by our Medical and Company Director and by our internal Research Ethics Committee before it begins.

• Taking part in research is always optional and is never a condition of your care. If you decide not to take part, or change your mind later, it makes no difference to how you are treated here.
• Where a study needs information that identifies you, we ask for your consent separately, using information written for that study. This notice is not that consent.
• Where a study uses information with your identifying details removed, that anonymised information is no longer personal data. We still ask your preference on the Data Consent Form.
• Once anonymised information has been published, or deposited in a public repository because a journal requires it, it cannot be withdrawn. We tell you this before you agree.

13. Your rights

• Access: ask for a copy of the personal data we hold about you, free of charge and normally within one month.
• Rectification: ask us to correct anything inaccurate.
• Erasure: ask us to delete your data, subject to our legal duty to keep health records for the periods at section 9.
• Restriction and objection: limit or object to certain uses, including AI-assisted documentation and marketing.
• Portability: receive your data in an electronic format.
• Withdraw consent at any time where our processing is based on consent.
• Rights in relation to automated decision-making. We do not make any decision about you by automated means alone.

To exercise any right, contact our Data Protection Lead at dataprotection@synthesisclinic.co.uk, or telephone 01628 964330. You do not need to use any particular form of words, and you can ask us verbally.

14. Complaining about how we handle your information

If you are unhappy with how we have handled your personal data, you can complain to us and we will take it seriously.

• Complain in any way that suits you: by email to dataprotection@synthesisclinic.co.uk cc practicemanager@synthesisclinic.co.uk, by telephone on 01628 964330, in writing to the clinic, in person to any member of staff, or through our website.
• A complaint form is available if you would find it helpful, but you do not have to use it.
• We will acknowledge your complaint within 30 days, and normally within 5 working days.
• We will look into it and write to you with the outcome without undue delay.
• You can also complain to the Information Commissioner's Office at any time, whether or not you have raised the matter with us first. Contact the ICO on 0303 123 1113 or at ico.org.uk.

Complaints about your care, rather than about your information, follow our separate complaints procedure. Details are on our website and in our Complaints Policy.

15. Changes to this notice

We review this notice at least annually and whenever our systems or services change. The latest version is always available on our website, on the patient portal, and from reception.