Privacy Notice

This notice explains what personal information Arthrospective collects when you enquire, book or attend an assessment, why we hold it, who we share it with, and the control you keep over it. We take your privacy seriously, and we are especially careful with health information, which the law treats as sensitive.

1. Who we are

Arthrospective is an independent knee injection suitability assessment and rehabilitation practice. Arthrospective is a trading name of Stellarix Ltd, registered in England and Wales, company number 06620950, registered office 20-22 Wenlock Road, London N1 7GU. [ Confirm that Arthrospective is registered as a trading name of Stellarix Ltd. ]

For the information described here, Stellarix Ltd is the data controller. We are registered with the Information Commissioner's Office (ICO), registration number ZB981994.

Questions about your data, or any of the rights below, can be sent to privacy@arthrospective.com.

2. The information we collect

Depending on how you interact with us, we may collect:

• Contact and identity details: your name, email address, telephone number, and home address or postcode where a home visit is arranged.
• Health information: your knee and joint history, symptoms, relevant medical background, and any imaging or scan reports you choose to share with us before or during your assessment.
• Assessment records: the notes we make during your assessment and the written recommendation we produce for you.
• Booking and payment information: your appointment details and confirmation that payment has been made. Card payments are handled by our booking or payment provider; we do not store your full card details.
• Correspondence: the content of emails or messages you send us.
• Website information: basic technical data needed to make the site work securely. See section 9 on cookies.

Health information is a special category of personal data under UK data protection law, and we apply extra care and stricter conditions to it, as set out below.

3. How we collect it

We collect information directly from you: through our enquiry and booking process, through our practice management system (Cliniko), from documents and scan reports you send us, and during your assessment by video or in person.

4. Why we use your information, and our lawful bases

Under UK GDPR we must have a lawful basis for using your information. We rely on the following:

• To provide the assessment you have booked and give you your written recommendation, our basis is the performance of our contract with you (Article 6(1)(b)).
• To run and protect the practice, including booking administration, record keeping and security, our basis is our legitimate interests in operating a professional service (Article 6(1)(f)).
• To meet our legal and regulatory obligations, for example tax records and professional standards, our basis is legal obligation (Article 6(1)(c)).

For your health information, we additionally rely on the provision of health care by a health professional bound by a duty of confidentiality (Article 9(2)(h) UK GDPR, together with the associated condition in Schedule 1 of the Data Protection Act 2018). Where you actively choose to send us information such as scan reports, or ask us to share your summary with your GP or another provider, we may also rely on your explicit consent (Article 9(2)(a)), which you can withdraw at any time.

5. Who we share it with

We do not sell your information, and we do not accept referral fees, so we have no commercial reason to pass your details to any treatment provider. We share information only where it is necessary to deliver our service or where the law requires it:

• Cliniko, our practice management and online booking system (provided by Red Guava Pty Ltd), which stores your booking and clinical records on our behalf as a data processor. [ Confirm your Cliniko data hosting region. ]
• Our email and, where used, payment providers, acting as processors under contract.
• Your GP or another clinician of your choice, but only with your agreement, for example if you ask us to send your written summary.
• Regulators, professional bodies or authorities, where we are legally obliged to disclose information.

Where any provider stores data outside the UK, we ensure appropriate safeguards are in place, such as UK adequacy or the UK International Data Transfer Agreement. [ Confirm with your providers. ]

6. How long we keep it

We keep your clinical records for as long as necessary to provide and stand behind our advice, and to meet our professional and legal obligations. For adults this is typically at least eight years after your last contact with us, in line with recognised health records guidance, unless we are required to keep them for longer. Enquiry information that does not lead to a booking is kept for a shorter period and then deleted. [ Confirm the exact retention period your indemnity provider requires. ]

7. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete information, where there is no lawful reason for us to keep it;
• ask us to restrict or object to how we use your information;
• ask for your information to be transferred to another provider, where that applies;
• withdraw any consent you have given, at any time.

To exercise any of these, contact us at privacy@arthrospective.com. Some rights are qualified where we have a legal duty to retain clinical records, and we will explain if that applies to your request.

8. How we protect your information

We use appropriate organisational and technical measures to keep your information secure, including reputable systems for our records and booking, restricted access, and secure handling of documents you send us. No system can be guaranteed completely secure, but we take our responsibility here seriously and keep our measures under review.

9. Cookies

Our website uses essential cookies needed to make it work properly. Our online booking, provided through Cliniko, may set its own cookies when you book. We do not use advertising cookies. If we introduce analytics in future, we will update this notice and seek your consent where required.

10. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed, and the current version always applies.

11. How to complain

If you have a concern about how we handle your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113.

Arthrospective is an independent assessment and rehabilitation service. It is not a substitute for care from your GP or a treating clinician, and it is not an emergency service.