Clinical privacy policy

This Clinical Privacy Notice explains how Clearly Hearing Ltd collects, uses and protects your health and audiological information when you receive clinical care from us. It should be read alongside our main Privacy Policy.

Your health information is special category data under UK GDPR Article 9. We treat it with the highest standard of care and confidentiality.

1. What health information we collect

To provide safe and effective clinical care, we may collect:

Personal details: name, date of birth, address, contact information, NHS number where applicable.
Medical and audiological history: previous diagnoses, medications, surgical history, hearing history, tinnitus, balance symptoms.
Clinical assessment data: audiograms, tympanograms, speech test results, APD assessment results, vestibular assessment findings.
Referral and correspondence: letters from GPs, ENT consultants, speech and language therapists, schools or other healthcare providers.
Hearing aid fitting data: device settings, programming data, fitting verification results (REM).
Clinical notes: records of each appointment including findings, advice given and agreed care plans.
Consent records: records of consent given for treatment, sharing of information, or specific procedures.

2. Why we collect and use your health information

We use your health information to:

Carry out audiological assessments and provide clinical diagnoses.
Fit, programme and service hearing aids and other assistive devices.
Provide tinnitus therapy, APD intervention, vestibular rehabilitation and other specialist services.
Communicate with other healthcare professionals involved in your care, with your knowledge.
Meet our obligations as HCPC-registered practitioners, including maintaining accurate clinical records.
Ensure your safety during procedures such as ear wax removal.

3. Legal basis for processing health data

We process your health data under UK GDPR Article 9(2)(h): processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.

In some circumstances we may also process health data on the basis of your explicit consent, particularly where sharing information with third parties outside your direct care team.

4. Who we may share your information with

We will not share your health information without your knowledge except where required by law. We may share it with:

Your GP or referring clinician: to inform them of assessment outcomes or treatment plans, where clinically appropriate.
ENT consultants or specialist physicians: where a referral or joint management is required.
Speech and language therapists and educational settings: particularly for paediatric patients where multidisciplinary working is in your or your child’s best interests.
Hearing aid manufacturers: to process device orders, warranties and manufacturer repairs. Only the minimum necessary data is shared.
Legal or regulatory bodies: including the HCPC or other regulators, where required by law or in response to a formal legal request.

We will always seek to inform you before sharing your information, except in emergencies or where legally required.

5. How long we keep your clinical records

We retain clinical records in line with the HCPC Standards of Conduct, Performance and Ethics and NHS records management guidance:

Adult clinical records: minimum 8 years from the date of last treatment.
Children’s clinical records: until the patient’s 25th birthday, or until their 26th birthday if treatment was ongoing after age 17.
In some cases, for example where records are relevant to a legal matter, we may retain records for longer.

After the retention period, records are securely and permanently deleted or destroyed.

6. Security of your health information

We take the security of your health information seriously. Measures we use include:

Secure, password-protected clinical record systems.
Restricted access — only clinicians involved in your care can access your records.
Encrypted communications where health data is transmitted electronically.
Physical security at all clinic locations.

In the event of a data breach affecting your health information, we will notify you and the Information Commissioner’s Office (ICO) in accordance with UK GDPR requirements.

7. Your rights regarding your health information

You have the right to:

Access your clinical records (subject access request).
Request correction of inaccurate information.
Request restriction of processing in certain circumstances.
Object to processing based on legitimate interests.
Request erasure — noting that we may be unable to delete clinical records during the legally required retention period.

To make a request, contact us at hello@clearlyhearing.co.uk or write to Inside OruSpace, 20-22 Lordship Lane, London, SE22 8HN. We will respond within one calendar month.

8. Telehealth and remote consultations

Where clinical services are delivered remotely (by video or telephone), your health information is handled with the same standards of confidentiality as in-person care. You are responsible for ensuring you are in a private environment during remote sessions.

9. Paediatric patients

For patients under the age of 18, clinical information is shared with a parent or guardian in the normal course of care. Where a young person has the capacity to make their own decisions (Gillick competence), their right to confidentiality is respected. We will discuss information sharing with both the young person and their parent or guardian at the start of care.

10. Changes to this notice

We may update this Clinical Privacy Notice as our practices or legal obligations change. The most recent version is always available on our website. Significant changes will be communicated to active patients.

11. Questions and complaints

If you have questions about how we handle your health information, please contact us at hello@clearlyhearing.co.uk or 020 7458 4525. If you are not satisfied with our response, you may complain to the Information Commissioner’s Office at www.ico.org.uk.