Last updated: October 2026
Privacy Policy
Hillcrest Neuro Clinic ('we', 'us', 'our') is committed to protecting your personal data. This policy explains how we collect, use, store, and share information about you when you use our website or services, and sets out your rights under UK data protection law.
1. Who we are
Hillcrest Neuro Clinic is a private healthcare provider registered in England and Wales. Our registered address is 71–75 Shelton Street, London, WC2H 9JQ. We are the data controller for the personal data we collect about you. If you have any questions about this policy or how we handle your data, please contact us at [email protected].
2. What data we collect
We may collect and process the following categories of personal data: identity data (name, date of birth); contact data (email address, telephone number, postal address); health data (clinical history, assessment results, diagnoses, medication); financial data (payment information, invoices); technical data (IP address, browser type, pages visited); and communications data (enquiries, messages, and correspondence with us). Health data is special category data under UK GDPR and is handled with additional safeguards.
3. How we collect your data
We collect data directly from you when you: complete our online booking or contact form; correspond with us by email, telephone, or post; attend an assessment or clinical appointment; or use our website. We may also receive data from referrers such as GPs, schools, or employers where you have consented to this.
4. How we use your data
We use your personal data to: provide and manage your clinical assessment and treatment; respond to your enquiries and booking requests; process payments and maintain financial records; comply with our legal and regulatory obligations (including CQC registration); improve our services and website; and communicate with you about your care. We process health data on the basis of providing healthcare services and, where required, with your explicit consent.
5. Legal basis for processing
We rely on the following legal bases: performance of a contract (to provide the services you have requested); legal obligation (to comply with healthcare regulations and CQC requirements); legitimate interests (to operate and improve our business, where your interests do not override ours); and explicit consent (for special category health data and for marketing communications, where applicable). You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
6. Sharing your data
We do not sell your personal data. We may share your data with: clinical staff involved in your care; third-party service providers who process data on our behalf (such as IT systems, payment processors, and secure messaging platforms) under strict data processing agreements; regulatory bodies such as the CQC where required by law; and other healthcare providers where clinically necessary and with your consent. All third parties are required to keep your data secure and to use it only for the purposes we specify.
7. Cookies
Our website uses cookies to improve your experience. Essential cookies are necessary for the site to function and cannot be disabled. Analytics cookies help us understand how visitors use the site — these are only set with your consent. You can manage your cookie preferences at any time using the cookie banner on our website. For more detail on the cookies we use, please contact us.
8. Data retention
We retain clinical records for a minimum of eight years from the date of last treatment, or until age 25 for records relating to children, in line with NHS and professional guidance. Financial records are kept for six years. Website enquiry data is retained for two years. After these periods, data is securely deleted or anonymised.
9. Your rights
Under UK GDPR you have the right to: access the personal data we hold about you; correct inaccurate data; request erasure of your data (subject to legal and clinical obligations); restrict or object to processing; data portability; and withdraw consent at any time. To exercise any of these rights, please contact us at [email protected]. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
10. Data security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data storage, access controls, and staff training. In the event of a data breach that is likely to affect your rights and freedoms, we will notify you and the ICO as required by law.
11. Changes to this policy
We may update this Privacy Policy from time to time. The current version will always be available on this page, with the date it was last updated shown at the top. We encourage you to review this policy periodically.
12. Contact us
If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact: Hillcrest Neuro Clinic, 71–75 Shelton Street, London, WC2H 9JQ. Email: [email protected]. Telephone: 07508 111 180 22.