Legal

Privacy Policy

Last updated: January 2025 · Mr Sanjay Rajpal — Consultant Urological Surgeon · GMC 6106646

This Privacy Policy explains how the private practice of Mr Sanjay Rajpal (“we”, “us”, “the practice”) collects, uses and protects personal information provided by visitors to this website and patients of the practice. We are committed to safeguarding your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Mr Sanjay Rajpal is a Consultant Urological Surgeon registered with the General Medical Council (GMC 6106646), in private practice at The Yorkshire Clinic, Bingley and Spire Leeds Hospital, Roundhay. For the purposes of UK GDPR, the practice is the Data Controller of personal data you provide.

2. What information we collect

• Identity & contact data — name, date of birth, address, telephone, email.
• Health data — referral letters, medical history, consultation notes, investigations, imaging and operative records.
• Insurance & financial data — insurer name, policy/authorisation number, fee arrangements.
• Website data — IP address, browser type, pages visited (where analytics is enabled).

3. How we use your information

We use your personal data to:

• Provide direct clinical care, diagnosis and treatment.
• Communicate with your GP, referring clinician and other healthcare professionals.
• Process invoicing and liaise with your private medical insurer.
• Comply with statutory and regulatory obligations (e.g. medical records retention, MHRA, CQC).
• Respond to enquiries submitted via this website.

4. Lawful basis

We process special category (health) data under Article 9(2)(h) UK GDPR — provision of medical diagnosis and care. Other personal data is processed under Article 6(1)(b) (contract) and 6(1)(c) (legal obligation).

5. Sharing your information

We may share your information with:

• Your GP and other treating clinicians, with your consent.
• The hospital where you are seen (The Yorkshire Clinic / Spire Leeds) for clinical and administrative purposes.
• Your private medical insurer for the purposes of authorisation and billing.
• Regulatory and statutory bodies where required by law (GMC, CQC, MHRA, courts).
• Our secretarial and IT service providers under written confidentiality agreements.

We do not sell your personal information and we do not use it for direct marketing.

6. Data retention

Medical records are retained in line with NHS / IGA guidance — generally for a minimum of 8 years after the last episode of care, and longer in specific circumstances (paediatric records, mental-health records, certain procedures). Financial records are retained for 7 years for HMRC purposes.

7. Security

We use encrypted email, password-protected systems and access controls to safeguard your information. Paper records are held in locked storage with restricted access.

8. Your rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you (Subject Access Request).
• Request correction of inaccurate data.
• Request erasure or restriction (subject to clinical retention requirements).
• Object to processing in certain circumstances.
• Data portability for non-clinical records.
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

9. Cookies and analytics

This website does not set any tracking, advertising or third-party marketing cookies. We use Plausible Analytics, a privacy-friendly EU-based analytics service that does not use cookies, does not track individuals across sessions, does not collect personal data, and does not require a GDPR consent banner under most interpretations of the GDPR / PECR. We still ask for your consent before loading it as a courtesy. The data collected is aggregate and anonymous: pages viewed, referrer, country, device type, browser. You can decline at any time using the banner; if you do, no analytics script is loaded at all.

A small piece of information is stored in your browser's local storage (the key srurology_consent_v1) to remember your choice. You can clear this any time from your browser settings.

9a. Server logs and security

Our hosting provider keeps standard server logs (IP address, request URL, timestamp, response status) for a short period for security, abuse prevention and debugging purposes. These are not used for marketing or profiling.

10. Contact

To exercise any of your rights or ask a question about this policy, please contact: