Privacy policy

How your personal and health information is collected, used and protected under UK GDPR and the Data Protection Act 2018.

Draft for design review

Structure and headings only. Final legal wording is confirmed at development against current ICO and GMC guidance.

1. Who we are

This website is operated by the private practice of Dr Ayyaz Sultan, Consultant Cardiologist (GMC 6049394). The practice is the data controller for information collected through this site. Registered details and ICO registration number to be confirmed.

2. Information we collect

We collect only what we need to respond to you and to provide care.

3. How we use your information

Your information is used to respond to enquiries, arrange appointments, provide clinical care and meet our legal and regulatory duties. Health data is processed for the provision of healthcare under Article 9(2)(h) UK GDPR.

4. Sharing your information

With your knowledge, we share relevant information with the hospital or clinic where you are seen, your GP, your insurer and diagnostic providers. We never sell your data.

5. How long we keep it

Medical records are kept in line with NHS and GMC records-management guidance. Website enquiries that do not lead to an appointment are deleted after 12 months.

6. Your rights

You have the right to access, correct, restrict or erase your data, to object to processing and to data portability. To exercise these rights, contact the practice. You may also complain to the Information Commissioner’s Office (ico.org.uk).

7. Security

Forms are encrypted in transit, access is restricted to the practice team, and our suppliers are bound by data-processing agreements.

8. Contact

Questions about this policy: secretary@drayyazsultan.co.uk or 0161 515 8155.