1. Who We Are
Mediwell Clinic is operated by Mediwell Healthcare UK Ltd, a company registered in England and Wales (Company Number: 11111541).
Registered Address:
1C Lansdowne Road
London
N17 0LL
Email: info@mediwellclinic.co.uk
Mediwell Healthcare UK Ltd is the Data Controller responsible for the personal information we collect and process. ICO Registration Number: ZA837541
We are committed to protecting your privacy and handling your personal information in accordance with:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Common Law Duty of Confidentiality
- Human Rights Act 1998
- Applicable Health and Social Care Legislation
This Privacy Notice applies to all services provided by Mediwell Clinic, including:
- In-clinic healthcare services
- Telephone consultations
- Video consultations
- Website services
- Online appointment booking systems
- Patient portals
- Mobile applications
- Email and SMS communications
- Clinical management systems
- Approved consultation recording, dictation, transcription, and AI-assisted documentation systems
2. Information We Collect
To provide safe and effective healthcare services, we may collect and process:
Personal Information
- Name
- Date of birth
- Address
- Email address
- Telephone number
- Emergency contact details
Healthcare Information
- Medical and dental history
- Consultation records
- Clinical notes
- Diagnoses and treatment plans
- Prescriptions
- Test results and reports
- Referral information
- Images, photographs, scans, and clinical recordings where appropriate
Technical Information
When using our website, patient portal, or online services, we may collect:
- IP address
- Device information
- Browser type
- Login activity
- Website usage information
- Security and audit logs
3. How We Use Your Information
We use your information to:
- Provide healthcare services and treatment
- Maintain accurate clinical records
- Arrange referrals and coordinate care
- Manage appointments and communications
- Contact you regarding your care
- Process payments and administer services
- Improve patient safety and service quality
- Meet legal, regulatory, professional, and safeguarding obligations
- Prevent fraud and protect our systems and services
4. Consultation Recording, Dictation and AI-Assisted Documentation
To support accurate clinical record keeping, continuity of care, patient safety, and service quality, Mediwell Clinic may use approved consultation recording, dictation, transcription, and AI-assisted clinical documentation systems.
Where these systems are used:
- Patients will be informed before recording or transcription takes place.
- Recordings and transcriptions are processed securely by approved service providers acting under appropriate contractual and data protection arrangements.
- Audio recordings are retained only for as long as necessary to complete transcription and clinical documentation and are then securely deleted in accordance with our retention policies and provider agreements.
- The final clinical record forms part of the patient’s medical record.
- Recordings and transcripts are used solely for healthcare, clinical documentation, quality assurance, and patient safety purposes.
- Information is never used for marketing purposes.
- Patients may decline consultation recording where appropriate without affecting the care they receive.
Clinicians remain responsible for reviewing and verifying all clinical records generated using dictation or AI-assisted systems. AI-assisted systems do not make clinical decisions or replace professional judgement. Clinicians remain responsible for reviewing, verifying and approving all clinical records.
5. Sharing Your Information
We may share information where necessary for your care or where required by law.
Recipients may include:
- NHS Trusts
- Specialist services
- Independent healthcare professionals
- Private healthcare providers
- Ambulance services
- Social care services
- Local authorities
- Education services where appropriate
- Police and law enforcement agencies where legally required
- Regulatory bodies
- Approved IT providers and data processors
- Approved transcription and clinical documentation providers
We will only share the minimum information necessary and only where there is a lawful basis to do so.
We do not sell your personal information.
All third parties processing information on our behalf are required to keep it secure and act only in accordance with our instructions and applicable data protection laws.
6. Legal Basis for Processing
We process personal information in accordance with UK GDPR and the Data Protection Act 2018.
Our lawful bases include:
- Article 6(1)(b) – Performance of a contract for healthcare services
- Article 6(1)(c) – Compliance with legal obligations
- Article 6(1)(f) – Legitimate interests in operating and improving our services
For special category health data:
- Article 9(2)(h) – Preventive medicine, medical diagnosis, healthcare provision, and treatment
- Article 9(2)(i) – Public interest in public health where applicable
7. International Transfers
Mediwell Clinic does not routinely transfer personal data outside the United Kingdom. If personal data is transferred outside the United Kingdom, appropriate safeguards will be implemented in accordance with the UK GDPR, including the use of approved transfer mechanisms where required.
8. Data Retention
We retain healthcare records and related information in accordance with:
- NHS Records Management Code of Practice
- Applicable legal, regulatory and professional retention requirements.
- Legal and regulatory obligations
Information is securely deleted, anonymised, or destroyed when it is no longer required.
9. Security of Your Information
We implement appropriate technical and organisational measures to protect personal information, including:
- Secure clinical systems
- Role-based access controls
- Staff training and confidentiality obligations
- Encryption and cybersecurity safeguards
- Secure backups and monitoring systems
- Information governance policies and procedures
10. Website and Cookie Use
Our website, patient portal, and online services may use cookies and similar technologies to improve functionality, security, performance, and user experience.
Non-essential cookies are only used with your consent where required by law.
Further information is available in our Cookie Policy.
11. Data Protection and Governance
Mediwell Clinic maintains an ongoing programme of information governance and data protection compliance.
This includes:
- Staff training
- Information governance procedures
- Data Protection Impact Assessments (DPIAs) where required
- Cybersecurity reviews
- Third-party supplier due diligence
- Regular review of AI-assisted technologies and clinical systems
12. Your Rights
Subject to applicable law, you have the right to:
- Request a copy of your personal information (Subject Access Request)
- Request correction of inaccurate information
- Request restriction of processing in certain circumstances
- Object to processing in certain circumstances
- Request deletion where legally applicable
- Withdraw consent where consent is relied upon
- Request data portability where applicable
To exercise your rights, please contact:
13. Complaints
If you have concerns about how we use your personal information, please contact us first.
If you remain dissatisfied after contacting us, you have the right to complain to the Information Commissioner’s Office (ICO):
Website: https://ico.org.uk
14. Contact Details
Data Protection Officer
Practice Manager
Mediwell Clinic
1C Lansdowne Road
London
N17 0LL
Email: info@mediwellclinic.co.uk
15. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our services, legal requirements, or technology.
The latest version will always be available through our website, patient portal, mobile applications, and on request from the clinic.