For Matthew Solan & James Davis at St John & St Elizabeth Hospital and OneWelbeck

For Martin Klinke at London Bridge, Cromwell Hospital, Chiswick Outpatients, New Victoria Hospital & One Welbeck

How we use your information

The London Foot and Ankle Centre Limited (LFAC) collect store and use personal data during our work every day, such as medical records and computerised information.

We take our duty to protect your personal information and confidentiality very seriously and take all reasonable measures to ensure the confidentiality and security of personal data for which we are responsible.

Under the General Data Protection Regulation (Data Protection Act 2018) organisations that process personal data must establish a legal basis for processing that data. LFAC’s lawful basis for processing a patient’s personal data is based on the Contract we have with the patient. We need to process the patient’s data (e.g. name, address, DOB and email address) in order to make a contract with them for consultation and treatment. Full details of this legal basis can be found under Article 6 (1) (b) of GDPR (DPA 2018).  Data Protection Regulations also mandate that a legal basis is identified to process special categories of personal information, such as health care information. LFAC’s legal basis for processing such data is that the processing is necessary for the provision of health care or treatment. Full details of this legal basis can be found under Article 9 (2) (h) of GDPR (DPA 2018)


How do we collect information about you?

We keep records about your health and any treatment.  These records help to ensure that you receive the best possible care.  They may be written down on paper records or held on computer.

We keep records of medico-legal instruction.  These records include not only records on a claimant’s health and treatment but also legal documentation relating to the progression of a claim.  These records may be written down or held on computer.

It is essential that your details are accurate and up to date.  Always check that your personal details are correct when you visit us and please inform us of any changes as soon as possible.


Who do we share personal information with?

Everyone working within LFAC has a legal duty to keep information about you confidential. Similarly, anyone who receives information from us has a legal duty to keep it confidential.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it.


We will not disclose your information to any other third parties except where there is a legitimate interest, we may share information as follows:

  • With medical Professionals engaged by us to carry out services to you.
  • With your GP or medical practitioner – we will contact your GP or medical practitioner following an outpatient consultation and with a discharge summary following any inpatient or day case procedure.
  • With the hospital if you are being treated as an inpatient and require an overnight stay.
  • To submit claims relating to your treatment to your insurer or any other third party covering the cost of any treatment or assessment on your behalf.
  • With the Department of Health or any other statutory body to whom we are required to submit data.
  • With authorised organisations to convert your data into an anonymised statistical form.
  • We will provide information to progress your medico-legal claim in accordance with your solicitor’s instructions and guidance from the Courts.
  • We will, if required, disclose your information in genuine life and death situations and we are legally obliged to share for the purposes of child/adult protection and Serious Criminal Activity.


How your personal information is used to improve the service we provide.

Your information may also be used:

  1. To review the care we provide to ensure it is of the highest standard and quality.
  2. To ensure our service can meet patient needs in the future
  3. To investigate patient queries, complaints and legal claim
  4. To ensure that we receive payment for the care you receive
  5. To prepare statistics on our performance
  6. To help train and educate healthcare professionals.
  7. As part of the LFAC Consultants’ regular appraisal based on the GMC guidelines for Good Medical Practice


Disclosure of Information

You have the right to restrict how and with whom we share the personal information in your records that identifies you.  If you object to us sharing your information we will record this explicitly within your records so that all healthcare professionals and staff involved with your care are aware of your decision. If you choose not to allow us to share your information with other health or social care professionals involved with your care, it may make the provision of treatment or care more difficult or unavailable. You can also change your mind at any time about a disclosure decisionPlease contact the Data Protection Officer at the address below for further information.


If you have any concerns about the way that LFAC is processing your personal information please contact the Data Protection Officer at LFAC in the first instance. If you still have concerns following a review by the Data Protection Officer, you can complain to the Information Commissioners Office (ICO). See full contact details below.


Retention of Records

Your records will be retained in accordance with the Records Management Code of Practice for Health and Social Care 2016, Appendix 3


LFAC marketing channels and communications

Our communications are ‘business to business’ (B2B) and as a result we are processing data on the legal basis of ‘legitimate interest’.

  • Postal communication and marketing – will contain an ‘opt-out’ channel.
  • Email communication and marketing – will contain an ‘opt-out’ channel.
  • All communications must be relevant and proportionate.
  • All communications must contain a clear opportunity to opt-out from future correspondence.
  • All requests to opt-out are honoured.


How you can access your records?

The General Data Protection Regulation (Data Protection Act 2018) gives you the right to access the information we hold about you on our records (subject access requests – SARs), to review it and to request deletion.

Such requests must be made in writing to LFAC Limited.  We will provide information to you within one month of receipt of a written request containing adequate supporting information (such as your full name, address, date of birth, patient number, proof of identification etc.).

LFAC Limited must be able to verify your identity using “reasonable means”.

Please send all requests to the below address along with an indication of what information you are requesting to enable us to locate it in an efficient manner.

This can be extended by a further two months where the request is complex or where here are numerous requests.  If this is the case, we will contact you within one month of the receipt of the request and explain why the extension is necessary.


Data Controller

The Data Controller responsible for keeping your information confidential is:  Helen McNae

London Foot and Ankle Centre Ltd
ICO Registration Number Z2108849
Hospital of St. John & St. Elizabeth
60 Grove End Road,
St. John’s Wood, London
Tele: 0207 078 3800



The General Data Protection Regulation (Data Protection Act 2018) requires organisations that are processing personal information to log a notification with the Information Commissioner to describe the purposes for which they process personal information. These details are publicly available from:

Information Commissioner’s Office
Wycliffe House
Water Lane
Tele: 0303 123 1113

LFAC Limited has appointed a Data Protection Officer (DPO) – Helen McNae.  The role of the DPO is to monitor compliance with the GDPR, train staff and conduct internal audits and to be the first point of contact for supervisory authorities, such as the ICO, and for individuals whose data is processed.

Should you wish to contact the DPO please email: [email protected]  or call 07748 623531

We keep our Privacy Notice under regular review.  This Privacy Notice will be updated in May 2025.