Last updated: 15 June 2026

ICO Registration No: ZA391081

 

1. Who We Are

London Allergy Clinic (“LAC”, “we”, “us”, “our”) is a private allergy clinic established in 1982, with locations in Marylebone, Fitzrovia, and High Barnet. We provide specialist allergy diagnostic, and desensitisation services for adults and children.

 

The Data Controller for London Allergy Clinic is:

 

Lila Aghaki-Allen

London Allergy Clinic

Website: www.londonallergyclinic.com

Email: enquiries@londonallergyclinic.com

 

2. Purpose of This Policy

This policy explains what personal information we collect about you, how we use it, who we may share it with, how long we keep it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are committed to handling your personal data with care, discretion, and in accordance with all applicable data protection law.

 

3. What Personal Data We Collect

3.1 Patients and parents / legal guardians

We may collect the following categories of information:

• Full name, date of birth, and contact details (address, telephone number, email address)

• Medical and clinical history, including symptoms, diagnoses, test results, and treatment records

• Information provided by your referring doctor or GP

• Results of any medical investigations or allergy tests carried out at LAC

• Correspondence and communications relating to your care

• Payment and billing information (processed via Square, Stripe, or Wix Payments)

• Records of appointments and attendance

 

3.2 Website visitors

When you visit www.londonallergyclinic.com, we may collect:

• Usage data via cookies and tracking tools (see Section 9: Cookies)

• Any information you submit via our online contact or booking forms

 

4. How We Use Your Personal Data

We use your personal data for the following purposes:

• Providing clinical care, diagnosis, and treatment

• Communicating with you about your appointments, test results, and care plan

• Sharing relevant clinical information with your referring doctor or GP, with your knowledge

• Processing payments for services provided

• Maintaining clinical records as required by our professional and regulatory obligations

• Complying with clinical audit requirements as part of our CQC registration

• Responding to enquiries made via our website, email, telephone, or WhatsApp

• Improving our services

 

5. Our Lawful Basis for Processing

Under UK GDPR, we are required to identify a lawful basis for processing your personal data. For clinical records and health data (which is classified as “special category data”), we rely on the following:

 

• Legal basis: Article 6(1)(b) – processing is necessary for the performance of a contract (i.e. providing your healthcare)

• Health data: Article 9(2)(h) – processing of special category health data is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment

 

For website analytics and marketing cookies, we rely on your consent (Article 6(1)(a)), which you may withdraw at any time.

 

6. Who We Share Your Data With

We will not share your personal data with any person or organisation outside of London Allergy Clinic except in the following circumstances:

 

• Your referring doctor or GP – to support continuity of your clinical care

• Medical laboratories – for the processing of allergy tests and investigations

• The premises at which your appointment takes place – your name may appear on a clinic attendance list for CQC compliance and fire safety purposes only

• Payment processors (Square, Stripe, Wix Payments) – solely for the processing of payments; these providers are bound by their own data protection obligations

• Our accountants – where strictly necessary for financial and legal compliance; only the minimum information required is shared

• CQC-required clinical audit – where required as part of our registration with the Care Quality Commission

• Legal or regulatory authorities – where we are required to do so by law

 

We will never sell, rent, or otherwise disclose your personal data to third parties for commercial purposes.

 

7. How We Store and Protect Your Data

All patient records are held electronically. We use the following systems to store and process your data:

• Microsoft OneDrive – for secure digital storage of patient files

• Microsoft Outlook – for clinical and administrative correspondence

• Microsoft Forms – for patient intake and questionnaire data

• WhatsApp Business – for appointment communication and enquiries

 

Access to patient records is restricted to your treating clinician and a small number of authorised administrative staff. All staff with access to patient data are aware of their confidentiality obligations.

Whilst we take all reasonable precautions to protect your data, no electronic system can be guaranteed as entirely secure. If you have concerns about the security of your information, please contact us at enquiries@londonallergyclinic.com.

 

8. How Long We Keep Your Data

We retain patient records in accordance with NHS and professional guidance:

 

• Adult patient records: a minimum of 10 years from the date of last contact with the clinic

• Children’s records: until the patient’s 25th birthday (or 26th birthday if they were aged 17 at the end of treatment), in line with standard medical guidance

 

These retention periods reflect the potential for clinical negligence claims under the Limitation Act 1980, and our professional and regulatory obligations.

After the applicable retention period, records will be securely and permanently deleted.

 

9. Cookies and Website Tracking

Our website (www.londonallergyclinic.com) uses cookies – small text files stored on your device – to help the site function and to understand how visitors use it.

 

Based on a scan of our website, the following cookies and tracking technologies are currently in use:

 

• Wix CMS – essential cookies required for the website to operate correctly. These are always active and do not require consent.

• Google Analytics – analytics cookies that help us understand how visitors interact with our website (pages visited, time spent, and similar usage data).

• Google Ads / Google Tag Services – advertising cookies that measure the effectiveness of our Google Ads campaigns, including conversion tracking when you complete a form after clicking an advert.

• Google Remarketing (DoubleClick) – advertising cookies that may show LAC adverts to previous visitors as they browse other websites. This only activates with your consent.

• Elfsight – a functional widget used to provide features on our website such as a WhatsApp contact button.

 

Non-essential cookies (analytics, advertising, and remarketing) will only be set with your consent. You can manage or withdraw your cookie preferences at any time using the cookie consent banner displayed when you visit our website.

Please note: the “Do Not Sell My Personal Information” option shown on our cookie settings page relates to US privacy law (CCPA) and is not directly applicable to UK residents. UK residents’ rights are governed by UK GDPR, as described in this policy.

 

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

 

• The right to be informed – to know how your data is used (which this policy provides)

• The right of access – to request a copy of the personal data we hold about you

• The right to rectification – to ask us to correct inaccurate data

• The right to erasure – to request deletion of your data, subject to our legal and clinical retention obligations

• The right to restrict processing – to ask us to limit how we use your data in certain circumstances

• The right to data portability – to receive your data in a structured, commonly used format

• The right to object – to object to certain types of processing, including direct marketing

• Rights in relation to automated decision-making – we do not make any automated decisions about your care

 

To exercise any of these rights, please contact us at enquiries@londonallergyclinic.com. We will respond within one calendar month, as required by UK GDPR.

 

11. Children’s Data

We provide specialist allergy and eczema services for children. Where a patient is under 16, we will obtain consent for processing from a parent or legal guardian. Parents and legal guardians may exercise the rights described in Section 10 on behalf of their child.

We do not knowingly collect data from children via our website for marketing purposes.

 

12. Complaints

If you have a concern about how we handle your personal data, we ask that you contact us in the first instance at manager@londonallergyclinic.com so that we can address the matter promptly.

 

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

 

• Website: www.ico.org.uk

• Telephone: 0303 123 1113

• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

 

13. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will always be available on our website. Where changes are material, we will notify patients directly where possible.

 

London Allergy Clinic • londonallergyclinic.com • enquiries@londonallergyclinic.com