Privacy Policy

1. Who we are and how to contact us

Centre for Surgery is a trading name of M Sarwar Limited, a company registered in England and Wales (company number 12148209), whose registered office is at 95-97 Baker Street, London, England, W1U 6RN. We run a private hospital, regulated by the Care Quality Commission, at the same address.

M Sarwar Limited is the controller of the personal information described in this policy. That means we decide how and why it is used, and we are responsible for looking after it. We are registered with the Information Commissioner’s Office (ICO), registration number ZA752514.

This policy explains how we collect, use, share and protect personal information when you use our website, contact us, or come to us for a consultation, surgery or aftercare, and the rights you have. It follows the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025. Our website terms and conditions and complaints policy sit alongside it.

2. Who this policy covers

This policy applies to you if you:

• visit our website or use the forms on it;
• contact us by phone, email, letter, social media or a messaging app;
• come to us for a consultation, surgery, aftercare or any other treatment;
• are a patient’s next of kin, the responsible adult who takes them home, or someone acting on their behalf;
• give us feedback, write a review or make a complaint.

Other organisations’ websites, including those we link to, social media platforms and our finance partner, Chrysalis Finance, have their own privacy policies, which apply when you use them.

3. The information we collect

When you visit our website

• What you type into our forms: usually your name, email address, phone number, the treatment you are interested in and your message.
• Technical information, such as your IP address, browser and device type, and how you use our pages, collected through cookies and similar technologies. Section 10 explains our cookies and your choices.

When you contact us

• Your contact details, the treatment you are asking about and anything you choose to tell us, including information about your health.
• Notes of our phone calls, and copies of emails, letters and messages you send us, including through social media and messaging apps.

When you become a patient

• Your name, date of birth, sex, address, phone numbers and email address.
• Your GP’s details, your next of kin or emergency contact, and the responsible adult who will take you home after surgery.
• Your medical history, medicines, allergies, examination findings such as your blood pressure and BMI, test results and the notes made by our clinical team.
• Consent forms, operation notes, anaesthetic records, discharge and aftercare information, and details of any complications.
• Clinical photographs and, for some procedures, scans or other images used to plan your surgery.
• Details of implants or medical devices used in your surgery, such as the manufacturer, type and serial number.
• Payment information, such as fees charged and payments made, and whether you asked about finance.
• Your feedback, survey answers, reviews and complaints.

Some of this is special category information, which the law protects more strongly: above all, information about your health. Depending on your procedure, it can also include information about your sex life, sexual orientation or gender identity (for example, before intimate or gender-affirming surgery), or your ethnic origin where it is relevant to your care, such as your skin type or eyelid anatomy.

4. Where we get your information

Most of the information we hold comes from you. We also receive information from:

• your GP or other doctors, when you ask them to share it or agree that we can ask them;
• your next of kin or the responsible adult looking after you, for example if they call us about your recovery;
• Chrysalis Finance, which tells us whether a finance application you made was accepted;
• cookies and similar technologies on our website (section 10);
• social media platforms and review sites, when you message us or review us there.

Messages and comments on Instagram and Facebook

If you message us or comment on our posts on Instagram or Facebook, we receive your profile name, username and the content of your message or comment through Meta’s business tools. We use this only to reply to you and to deal with your enquiry. If you go on to book a consultation, the details you share become part of your patient record.

Our team reads and answers these messages using Meta Business Suite and our own secure messaging tools, provided by the service providers described in section 8. A copy of the message text is kept in those tools for up to 30 days as a record of what was sent, then deleted automatically. We do not sell this information or use it for advertising.

How to ask us to delete your data. Email contact@centreforsurgery.com with “Delete my social media data” in the subject line and your Instagram or Facebook username. We will delete the messages we hold and confirm within one month. Anything that has become part of a clinical record is kept for the periods in section 11. You can also delete your side of a conversation in the Instagram or Facebook app at any time.

5. How we use your information, and the law that allows it

We only use personal information when the law allows it. For each purpose there is a lawful basis under Article 6 of the UK GDPR and, for health and other special category information, a condition under Article 9, together with Schedule 1 of the Data Protection Act 2018 where it applies.

Legitimate interests. Where we rely on our legitimate interests, they are running a safe, well-organised hospital, answering the people who contact us, improving our care, promoting our own services, and protecting our patients, staff and business. We only rely on them where they are not outweighed by your interests and rights, and you can object at any time (section 13).

Confidentiality. Your health information is used by, or under the responsibility of, health professionals who owe you a duty of confidentiality. Our administrative staff and the companies that support us are bound by confidentiality too.

Do you have to give us your information? You do not have to give us information to browse our website. To assess you and operate safely, we need an accurate medical history and the contact details of the responsible adult who will take you home. If you prefer not to give us information we need, we may not be able to treat you.

Automated decisions. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

6. Marketing

If you enquire about a treatment through our website, we may send you occasional emails with treatment guides, patient stories and news about our own services, unless you tick the box on the enquiry form to say you would rather not receive them. The law allows this for people who have asked us about our services (the “soft opt-in” under the Privacy and Electronic Communications Regulations). We do not use the procedure you asked about to decide which marketing emails you receive. For any other marketing we only contact you with your consent.

You can unsubscribe at any time using the link in any marketing email, or by emailing contact@centreforsurgery.com. We then keep a short record of your email address so that we do not contact you again. We never sell your personal information.

If you give us your mobile number on an enquiry form, we may also send you occasional text messages (SMS) with news, treatment and product information about our own services, under the same “soft opt-in”, unless you tick the SMS box on the form to say you would rather not receive them. We send no more than four marketing texts a month, and we never include details of your treatment or health in them. Every marketing text tells you how to stop. You can stop marketing texts at any time by replying STOP to any message, or by emailing contact@centreforsurgery.com. We use Mailchimp (part of Intuit) to send our messages on our behalf (section 8). We do not sell your mobile number or share it with anyone else for their own marketing. Messages about your enquiry or appointment are separate from marketing messages and are not affected if you opt out of marketing.

7. Clinical photographs

Photographs taken before, during and after your treatment are part of your clinical record and are used for your care. We only use them in our before-and-after gallery, on social media or in other marketing if you have given separate, written consent for that use, and you can refuse without it affecting your care.

You can withdraw your consent at any time by contacting our Data Protection Officer. We will then remove your photographs from our website and social media channels as soon as reasonably possible, and stop using them in new material. We cannot recall material already printed or shared by other people before you withdrew consent.

8. Who we share your information with

We share only what is needed, with people and organisations that have a duty to keep it confidential or a contract with us that requires it. Depending on your care, they include:

• The clinicians caring for you, including your surgeon, anaesthetist and our nursing team. Some consultants who work at our hospital under practising privileges may also keep their own records of your care, for which they are responsible; your consultant can tell you if this applies.
• Your GP, to whom we send a summary of your treatment unless you ask us not to.
• Other healthcare providers, such as an NHS hospital or ambulance service if you need urgent care, pathology laboratories that examine tissue removed during surgery, and pharmacies supplying your medicines.
• Specialist companies that make surgical plans and guides, if your facial bone surgery uses 3D planning or patient-specific cutting guides.
• Implant manufacturers or their UK distributors, for product traceability and warranty claims.
• The Breast and Cosmetic Implant Registry, run by NHS England. If you have breast implant surgery, we send details of your operation and implants to the registry, with your consent, so that you can be traced if a safety concern about an implant arises.
• Regulators and public bodies, such as the Care Quality Commission, the General Medical Council, the Nursing and Midwifery Council and the Medicines and Healthcare products Regulatory Agency, where the law requires or allows it.
• Service providers acting on our instructions, such as our clinical records, IT, hosting, email, telephone, video consultation and payment providers, the tools we use to manage messages sent to us through social media, and our email and text message marketing provider (Mailchimp, part of Intuit). They may only use your information to provide their service to us.
• Chrysalis Finance and any lender it introduces you to, if you ask to apply for finance. They then become controllers of your information in their own right, under their own privacy policies.
• Google and other advertising and analytics providers, through the cookies you accept on our website (section 10).
• Our insurers, medical indemnity providers, auditors and professional advisers, such as our lawyers and accountants.
• Debt collection agencies, if fees owed to us remain unpaid.
• The police, courts and other authorities, where the law requires it or allows it, for example to prevent or detect crime or to protect someone at risk of harm.
• A buyer of, or investor in, our business. If we sell or merge our business or bring in investment, we may share information with the buyer or investor and their advisers, made anonymous wherever possible. Your clinical records would pass to a new owner only if it took over your care, and it would have to protect them in line with this policy.

9. Information sent outside the UK

Some of our service providers store or access information outside the UK, for example in the European Economic Area or the United States. When that happens, we make sure your information is protected by one of the safeguards UK law requires: UK adequacy regulations (including the UK–US “data bridge” for certified US companies), or the ICO’s International Data Transfer Agreement or Addendum. Contact our Data Protection Officer for more details.

10. Cookies and similar technologies

Our website uses cookies and similar technologies. Cookies that are strictly necessary for the website to work, or to keep it secure, are always on. We only use analytics and advertising cookies, such as those from Google, if you accept them in our cookie banner. You can change your choice at any time using the Cookie preferences link, and our cookie policy lists the cookies we use.

If you accept advertising cookies, advertising platforms such as Google can learn which pages of our website you have visited, which may suggest an interest in a particular treatment, and use this to show you our adverts. If you would rather they did not, leave advertising cookies switched off, or switch them off at any time.

Our forms are protected by Google reCAPTCHA, which checks that a real person is using them. It collects information about your device and how you use the page, such as your IP address and browser details, and Google provides the service to us. We use it because keeping our forms free of spam and abuse is in our legitimate interests.

11. How long we keep your information

We keep information only for as long as we need it. For clinical records we follow the NHS Records Management Code of Practice, which sets the standard for health records in England.

When we no longer need information, we delete or destroy it securely, or make it anonymous so that it can no longer identify you.

12. How we keep your information safe

We use technical and organisational measures appropriate to the sensitivity of health information, including access controls, confidentiality agreements and staff training. Only people who need your information to do their jobs can see it. We report personal data breaches to the ICO where the law requires, and we tell you directly if a breach is likely to result in a high risk to you.

Email and messaging apps are not always secure. Please think carefully before sending detailed health information or photographs by email or social media, and use the contact methods we give you. We may ask you to confirm your identity before discussing your care.

13. Your rights

You have the right to:

• access your information: ask for a copy of the information we hold about you (a subject access request);
• rectification: ask us to correct information that is inaccurate or incomplete;
• erasure: ask us to delete information where there is no good reason for us to keep it;
• restriction: ask us to pause using your information in certain circumstances;
• object to our use of your information where we rely on our legitimate interests, and to direct marketing at any time;
• data portability: ask for information you gave us in a structured, commonly used format, or for it to be sent to another organisation;
• withdraw consent at any time, where we rely on your consent, for example for marketing or the use of your photographs. This does not affect anything we did before you withdrew it.

To use any of these rights, contact our Data Protection Officer (section 1). There is usually no charge. We may ask you to confirm your identity, and we will respond within one month, or within three months if your request is complex, in which case we will tell you why within the first month. For subject access requests we carry out a reasonable and proportionate search for your information.

Some rights are limited by law. In particular, we must keep clinical records for the periods in section 11, so we cannot delete your clinical record on request, but we can add your comments to it if you think it is wrong.

14. Children

Our website and services are intended for adults. If a patient under 18 is ever treated, a parent or guardian is involved in their care and the retention periods in section 11 apply.

15. NHS care and the national data opt-out

We do not currently provide NHS-funded care. The national data opt-out applies to NHS-funded care, so it does not currently apply to the information we hold. If that changes, we will update this policy and apply the opt-out where it is required.

16. Complaints about how we use your information

If you are unhappy with how we have handled your personal information, please tell us first, so that we can put it right. Email contact@centreforsurgery.com with “Data protection complaint” in the subject line, or write to our Data Protection Officer. We will acknowledge your complaint within 30 days, look into it without undue delay and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk/make-a-complaint ↗ or on 0303 123 1113. Concerns about your care or treatment are handled under our complaints policy.

17. Changes to this policy

We update this policy when our practices or the law change. The date at the top of this page shows when it last changed. If we make a change that significantly affects how we use information we already hold about you, we will tell you directly.