How Smith Medical (Glasgow) handles your personal data.

1. Who we are

Data Controller: Smith Medical (Glasgow) Ltd

Registered office: c/o Sandison Easson & Co, Rex Buildings, Alderley Road, Wilmslow, Cheshire SK9 1HY

Company number: 15648199

Data Protection Lead: Professor Andrew Smith

Contact email: dataprotection@smithpulmonology.com

2. What personal data we collect

We may collect and process personal data including:

• name, date of birth and other identification details;
• address, email address and telephone number;
• medical history, symptoms, diagnoses, treatment information, medications and other health information relevant to your care;
• referral information and correspondence from healthcare professionals;
• appointment and consultation records;
• investigation and test results;
• insurance and authorisation details where applicable;
• payment, invoicing and accounting information;
• communications with us, including emails, contact forms and administrative correspondence;
• limited technical information relating to use of our public website, where optional analytics cookies have been accepted.

Health information is special category personal data under UK GDPR and is handled with additional safeguards.

3. How we collect your data

Personal data may be collected:

• directly from you, for example by telephone, email, website contact form, questionnaire or consultation;
• from referring healthcare professionals;
• from your GP or other clinicians involved in your care;
• from hospitals, diagnostic services and laboratories;
• from Circle Health Group or other booking providers;
• from private medical insurers or other third-party payers;
• from records or correspondence you ask us to review as part of your care.

4. Why we process your data

We process personal data for purposes including:

• providing medical assessment, diagnosis and treatment;
• reviewing referrals and previous medical information;
• arranging and reviewing investigations;
• communicating with you about your care;
• communicating with your GP or other healthcare professionals involved in your care;
• managing appointments and administrative enquiries;
• preparing and sending clinical correspondence;
• administering billing, payments and insurance claims;
• meeting legal, regulatory, professional and insurance obligations;
• maintaining appropriate clinical and business records;
• improving our public website and patient resources where you have agreed to optional analytics cookies.

5. Lawful bases for processing

The lawful basis we rely on depends on the purpose for which the information is being used.

For ordinary personal data, the relevant lawful bases may include:

• Article 6(1)(b) – processing necessary to take steps at your request before entering into a contract, or to provide services under a contract;
• Article 6(1)(c) – processing necessary to comply with legal obligations;
• Article 6(1)(f) – processing necessary for our legitimate interests, where those interests are not overridden by your rights and freedoms;
• Article 6(1)(a) – consent, where we specifically ask for consent for an optional activity.

Where we process health information or other special category personal data for the provision of healthcare, we rely on:

• Article 9(2)(h) – processing necessary for medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.

We do not rely on consent as the primary lawful basis for the provision of medical care. Where consent is used for an optional activity, you may withdraw it at any time without affecting the lawfulness of processing that took place before withdrawal.

6. Who we may share information with

We only share personal data where this is necessary and appropriate. Recipients may include:

• Circle Health Group, including Ross Hall Clinic, where relevant to appointment booking, investigations or delivery of care;
• your GP and other healthcare professionals involved in care;
• laboratories, radiology providers and diagnostic services;
• private medical insurers and third-party payers;
• accountants, payment providers and business administration systems where necessary for invoicing and financial records;
• IT, email, document-storage and website service providers acting on our behalf;
• legal advisers, medical defence organisations, regulators or public authorities where required or appropriate;
• other organisations where disclosure is required by law.

Depending on the circumstances, an organisation receiving your information may act as an independent data controller or as a data processor acting on our instructions.

7. Service providers and digital systems

Smith Medical uses a number of secure digital services to support the operation of the practice. These may include:

• Google Workspace services for business email, documents, forms, spreadsheets and secure administration;
• Xero for accounting and invoicing;
• Vercel and associated web infrastructure for hosting our public website;
• Google Analytics 4 for optional website analytics, where cookie consent has been provided;
• payment providers and other specialist systems used in the administration of the practice.

We assess service providers before use and take reasonable steps to ensure appropriate contractual and technical safeguards are in place.

8. International data transfers

Some technology providers we use are international organisations and may process or store limited personal data outside the United Kingdom.

Where personal data is transferred internationally, we require appropriate safeguards to be in place in accordance with UK data protection law, such as an adequacy regulation or approved contractual safeguards where applicable.

9. Data security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Measures include, where appropriate:

• restricted access to patient information;
• password-protected and encrypted devices;
• secure cloud-based business systems;
• multi-factor authentication where available;
• secure email and document-sharing processes;
• staff access controls and administrative safeguards;
• data breach and business continuity procedures.

No method of electronic communication can be guaranteed to be completely secure. We therefore take proportionate steps to reduce risk and ask patients not to send urgent medical information by ordinary email.

10. Data retention

We retain personal data only for as long as necessary for the purpose for which it was collected and to meet clinical, legal, professional, insurance and financial obligations.

As a general guide:

• adult clinical records are generally retained for at least 8 years after the end of treatment or last contact, subject to applicable professional and legal requirements;
• financial and accounting records are generally retained for at least 6 years where required for tax and accounting purposes;
• correspondence relevant to clinical care is generally retained with the clinical record;
• website analytics data is retained in accordance with our analytics configuration and Cookie Policy.

Certain records may need to be retained for longer where this is required by law, professional guidance, an ongoing complaint, litigation or another legitimate reason.

11. Your data protection rights

Depending on the circumstances and the lawful basis being relied upon, your rights may include:

• the right to be informed about how your data is used;
• the right of access to your personal data;
• the right to request correction of inaccurate data;
• the right to request restriction of processing;
• the right to request erasure of personal data in certain circumstances;
• the right to object to processing in certain circumstances;
• the right to data portability where the legal conditions for this right apply;
• the right to withdraw consent where processing is based on consent.

These rights are not absolute and may be limited where, for example, we are required to retain clinical records or another legal exemption applies.

Requests should be made to dataprotection@smithpulmonology.com.

12. Automated decision-making

Smith Medical does not currently use solely automated decision-making or profiling that produces legal effects or similarly significant effects in relation to patient care.

Automated administrative systems may be used to support tasks such as sending questionnaires, reminders, document generation or routine workflow management. These systems do not replace clinical judgement.

13. Website analytics and cookies

Our public website uses essential technologies needed for website functionality and to remember cookie choices.

With your permission, we use Google Analytics 4 to understand how visitors use the website and to improve our patient information, educational resources and online services.

Google Analytics is not connected to our clinical records, appointment records, pre-consultation questionnaire responses or patient medical information.

Optional analytics technologies are used only in accordance with the choices you make through our cookie banner.

More information is available in our Cookie Policy.

14. Research opportunities

Where you have agreed to hear about future research opportunities, we may use your contact details to let you know about studies that may be relevant to your condition.

Agreeing to receive information about research is entirely optional and does not affect your clinical care. You may ask us to stop contacting you about research opportunities at any time.

15. Complaints and concerns about your data

If you have concerns about how your personal data has been handled, please contact our Data Protection Lead in the first instance:

Professor Andrew Smith
dataprotection@smithpulmonology.com

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

Information about raising a concern is available at ico.org.uk.

16. Changes to this Privacy Notice

We may update this Privacy Notice when our services, systems, suppliers or legal obligations change. The most recent version will always be published on this website.

Last Updated

August 2026