Privacy Policy

This Privacy Policy explains how Kinvara Private Hospital collects, uses and protects your personal information when you use our website, complete our online forms, talk to our online assistant, or contact us by email, telephone or social media. It also explains your rights and how to use them.

Kinvara Private Hospital Ltd (company number 11248045), 2 Clifton Lane, Rotherham, South Yorkshire, S65 2AJ, is the controller of your personal information. We are registered with the Information Commissioner's Office (ICO) under registration number ZA371083.

Our Data Protection Officer is Mr Vasudev Karri. You can contact him by email at enquiries@kinvarahospital.co.uk, marked "For the attention of the Data Protection Officer", by post at the address above, or by telephone on 01709 464200.

The Consultants who treat you are independent practitioners. When they make clinical decisions about your care they are also responsible for the information they hold about you, and they will tell you how they use it.

Information you give us

• (a) your name, date of birth, address, email address and telephone number;
• (b) health information you give us in our online forms, including the new patient registration form, GP consultation form, lipoedema consultation form and screening tool, pre- and post-operative questionnaires, consent forms and the body dysmorphic disorder screening questionnaire;
• (c) information in a complaint, feedback questionnaire or subject access request;
• (d) messages you send to our online assistant, to us through Facebook Messenger, or by email;
• (e) information you give us when you apply for a job.

Information collected when you use our website

• (a) how you use the website (pages visited, how long you stay, the page you came from, your browser and device type and approximate location), collected by Google Analytics only if you accept analytics cookies;
• (b) anonymous page-view statistics from our hosting provider (Vercel Analytics), which does not use cookies or identify you;
• (c) information used by Google reCAPTCHA to check that a form is being completed by a person and not an automated program;
• (d) a scrambled (hashed) version of your internet address when you use our online assistant, so that we can prevent misuse without storing the address itself.

Telephone calls

We may record telephone calls for training and quality purposes. Recording is paused while you give us card details.

We only use your information where the law allows:

• (a) to arrange your appointment, treatment and follow-up, and to take payment: because it is necessary for our contract with you, or to take steps at your request before entering one;
• (b) to provide your healthcare: health information is a special category of information, and we use it because it is necessary for the provision of health care (UK GDPR Article 9(2)(h)), under the duty of confidentiality that applies to health professionals;
• (c) to meet our legal and regulatory duties, for example keeping medical records, responding to the Care Quality Commission and handling complaints: because we have a legal obligation;
• (d) to answer enquiries, run our online assistant, keep our website secure and improve our services: because we have a legitimate interest in doing so, which we balance against your rights;
• (e) to use analytics cookies and to send you marketing emails: only with your consent, which you can withdraw at any time;
• (f) to consider a job application: to take steps at your request before entering a contract of employment.

We do not make decisions about you based solely on automated processing.

Our online assistant answers general questions about our treatments, prices and services using information published on our website. It does not give medical advice and it cannot see your medical records. Please do not include personal health details in your messages.

Your messages are stored so that we can check the quality of answers and improve the service. They are processed for us by Anthropic, which generates the answers, and OpenAI, which helps find the right website content. The same assistant answers messages sent to us through Facebook Messenger, which are also subject to Meta's privacy policy.

A cookie is a small text file stored by your browser.

• (a) Necessary cookies: we store your cookie choices so that we do not ask you again. These do not need your consent.
• (b) Analytics cookies: Google Analytics is loaded only if you accept analytics cookies. If you reject them, it is not loaded.
• (c) Security: Google reCAPTCHA is used on our forms to protect against spam and abuse.
• (d) Embedded content: our videos are not loaded until you press play. When you play a video or view an embedded map, the provider (Vimeo, YouTube or Google) may set its own cookies.

You can change your cookie choices at any time by clearing cookies for our website, after which we will ask you again. You can also block cookies in your browser settings.

We share your information only where necessary:

• (a) with the Consultants and clinical staff involved in your care;
• (b) with your GP, with your consent;
• (c) with your insurer, where your treatment is insured;
• (d) with regulators and other bodies where the law requires, such as the Care Quality Commission;
• (e) with organisations that provide services to us and process information on our behalf under contract: Vercel (website hosting), Convex (website database), Resend (email delivery), Google (analytics and reCAPTCHA), Anthropic and OpenAI (online assistant), and Meta (Facebook Messenger);
• (f) where needed to establish, exercise or defend legal claims, or with a buyer of our business.

We do not sell your information.

Some of our service providers store or process information outside the UK, including in the United States. Where this happens, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified companies) or the International Data Transfer Addendum approved by the ICO.

• (a) Medical records, including forms that become part of your medical record: at least eight years from your last treatment or contact, in line with the Records Management Code of Practice.
• (b) Enquiries that do not lead to treatment: two years.
• (c) Online assistant conversations: twelve months.
• (d) Unsuccessful job applications: six months.

After these periods your information is securely deleted.

You have the right to:

• (a) ask for a copy of your personal information (a subject access request), free of charge. We respond within one month, which may be extended by two further months for complex requests, in which case we will tell you. You can use the form on our Subject Access Request page;
• (b) ask us to correct information that is inaccurate or incomplete;
• (c) ask us to delete your information where there is no longer a reason to keep it (medical records must be kept for the minimum period);
• (d) ask us to restrict how we use your information;
• (e) object to our use of your information where we rely on legitimate interests, and at any time to direct marketing;
• (f) ask for information you gave us to be transferred to you or another organisation, where we use it with your consent or under a contract and by automated means;
• (g) withdraw your consent at any time, where we rely on consent.

We only send marketing emails if you have agreed to receive them. Every marketing email includes a way to unsubscribe, or you can email enquiries@kinvarahospital.co.uk at any time.

We use appropriate technical and organisational measures to protect your information, including encryption in transit and restricted access. No transmission over the internet is completely secure.

If you are unhappy with how we have handled your personal information, please contact our Data Protection Officer first, by any means. We will acknowledge your complaint within three working days and send you a written outcome within twenty working days.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.

We will publish any changes on this page and update the date below.

If you have any questions about this privacy policy or our treatment of your personal data, please write to us by email or by post:

This Privacy Policy was last updated on 26 September 2026.