This notice explains how Mr Arvind Mohan collects, uses, stores and shares personal information in connection with Mohan Plastic Surgery.
Who is responsible for your information?
The data controller is Mr Arvind Mohan, ICO registration number ZB322132. Mohan Plastic Surgery is a trading name of Elarna Limited. Privacy enquiries and requests may be sent to info@mohanplasticsurgery.co.uk.
Information we may collect
We may process identity and contact details, appointment and payment information, correspondence, clinical history, consultation notes, treatment records, clinical photographs and other health information that you provide or that is created during your care. We may also receive limited technical and preference information when you use this website.
Why we use it
Information is used to respond to enquiries, assess and provide care, arrange appointments and treatment, maintain clinical and financial records, take payment, communicate with you, manage complaints, meet legal and professional obligations, protect patient safety and improve the service.
Lawful basis
Depending on the circumstances, processing is necessary for taking steps at your request before entering a contract, performing a contract, complying with legal obligations, protecting vital interests, and pursuing legitimate interests in running a safe private practice. Health information is special-category data and is processed where necessary for medical diagnosis, provision or management of health care by a professional subject to confidentiality obligations. Where consent is the appropriate basis, it may be withdrawn, without affecting earlier lawful processing.
Who information may be shared with
Where necessary and proportionate, information may be shared with Carebit, the hospitals and clinical teams involved in your care, other treating clinicians, Gmail/Google as an email service, Stripe for payment processing, Doctify where you choose to interact with its independent review service, professional advisers, insurers, regulators and public authorities where legally required. These organisations may act as processors or as independent controllers for their own services.
Carebit and clinical records
Formal clinical records are maintained within Carebit. Clinically relevant correspondence and photographs received through other channels may be transferred to the Carebit record.
Clinical photographs and WhatsApp
Patients may choose to send clinical photographs by WhatsApp when requested or agreed with the practice. WhatsApp should not be used for emergencies. Relevant images will be transferred to the clinical record and removed from the WhatsApp conversation and receiving device after transfer, subject to any legal or clinical reason requiring otherwise. Please send only information that is necessary and do not include another person in an image without their permission.
How long information is kept
- Enquiries that do not progress to care: normally 12 months.
- Adult clinical records: normally eight years after treatment concludes.
- Children’s clinical records: normally until the 25th birthday, or the 26th birthday where treatment concluded at age 17.
- Financial records: normally six years.
Information may be retained longer where necessary for ongoing care, a complaint, a legal claim, safeguarding, regulatory requirements or another justified professional reason.
International processing and security
Some suppliers may process information outside the UK. Where this occurs, appropriate legal safeguards are required. Reasonable technical and organisational safeguards are used, but no internet or messaging service can be guaranteed completely secure.
Your rights
Subject to applicable law, you may request access, correction, erasure, restriction, portability or object to certain processing. You may withdraw consent where processing relies on consent. Clinical records cannot always be erased where retention remains legally or professionally necessary.
Concerns and complaints
Please contact info@mohanplasticsurgery.co.uk first. Data-protection complaints will be acknowledged within 30 days and addressed without undue delay. You may also complain to the Information Commissioner’s Office at ico.org.uk.