UK GDPR
Data protection and your rights
Last updated: September 2026.
This page explains what rights you have over the information this clinic holds about you, what each one actually gets you, and how to use it. The privacy policy covers what we collect and why; this page covers what you can do about it.
Who is responsible
The Armstrong Clinic is the data controller for everything described here. Kim Armstrong, Registered Nurse and Independent Prescriber, handles data protection requests personally — there is no separate department, and requests are not passed to a third party.
kim@thearmstrongclinic.com · +44 (0) 7706 077888
What we hold, and on what basis
- Enquiries and bookings — your name, contact details, what you asked about and the appointment itself. Held on the basis of the steps you asked us to take before entering into a contract, and then the contract itself.
- Clinical records — medical history, questionnaire answers, consultation notes, prescriptions, and any photographs you send or we take. This is special category health data. We hold it under the condition permitting processing for the provision of health care by a regulated health professional bound by a duty of confidentiality.
- Identity documents — where a treatment requires us to confirm who you are (weight management in particular), the photographs you upload of an identity document and of your face. Held to meet our professional obligation to prescribe safely, to an identified patient.
- Payments — what you paid, when, and for what. Card numbers are entered directly into our payment provider’s checkout and never reach this clinic’s systems. Held to meet tax and accounting obligations.
- Website analytics — only if you accept analytics cookies, and only ever on that basis. You can change your mind at any time on the cookie page.
Your rights
Access
A copy of the information we hold about you, including your clinical record.
If you have an account you can download most of it yourself, immediately, from Your data in your account. Anything held outside the account — consultation notes, correspondence — we send on request.
Rectification
Correction of anything factually wrong: a misspelled name, the wrong date of birth, an out-of-date address.
A clinical opinion you disagree with is not corrected by overwriting it. What we do instead is record your disagreement alongside it, so both are visible to anyone reading the record later.
Erasure
Deletion of information we no longer have a reason to hold — an enquiry that never became an appointment, for example.
This right does not extend to clinical records. Professional guidance requires us to retain them for a set period and we are not permitted to delete them on request. Saying so plainly here is better than accepting a request we will have to refuse.
Restriction and objection
You can ask us to stop using your information for a particular purpose while a dispute about it is resolved, and you can object to processing we carry out on the basis of legitimate interests.
Portability
The information you gave us, in a machine-readable file you can hand to another clinician.
The account export is JSON, which is the format this right contemplates.
Withdrawing consent
Where we rely on your consent — marketing, analytics cookies — you can withdraw it at any time, and it takes effect from that point.
Withdrawing consent does not undo processing that was lawful at the time it happened.
Automated decisions
No decision about your care is made by automation. The eligibility flags a questionnaire shows the clinician are a prompt to check something; the decision is always Kim's, and always after speaking to you.
How to make a request
Email kim@thearmstrongclinic.com saying which right you are exercising and what information it concerns. You do not need to use any particular form of words, cite the legislation, or give a reason.
We will acknowledge it, and may ask you to confirm your identity — necessary, because handing a health record to the wrong person is the worst outcome available here. We respond within one month. If a request is genuinely complex we may extend that by up to two further months, and if we do we will tell you why inside the first month. There is no charge.
If we refuse a request, in whole or in part, we will tell you which part, the specific reason, and how to challenge it.
How long we keep things
- Enquiries that do not lead to treatment — up to 24 months.
- Adult clinical records — retained in line with professional guidance for the period required for adult healthcare records, counted from your last contact with the clinic.
- Payment and invoice records — six years, as tax law requires.
- Identity verification photographs — held for the duration of the treatment programme they were taken for.
Where your information goes
Information is held on access-controlled systems, encrypted in transit, with clinical information restricted to the treating clinician. We use processors for hosting and database, payment processing, prescribing and dispensing, email delivery, and — only with your consent — analytics. Each is bound by contract to process your information only on our instructions.
Patients seen at the Marbella clinic have their information processed in Spain as well as the UK. Both are covered by equivalent data protection law, and the transfer is made on that basis.
We do not sell your information, and we do not use it to train anything.
If something goes wrong
If information is lost or disclosed in a way that puts your rights at risk, we will tell you directly, and report it to the Information Commissioner’s Office within 72 hours where the law requires.
Complaints
Raise it with the clinic first — most of what reaches the regulator is a question that could have been answered. If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113. Complaining to the ICO does not affect your care here.
Questions
Something here you would like explained?
If any part of this affects a decision you are making about your care, ask. Kim replies to enquiries personally.
Or call +44 (0) 7706 077888email kim@thearmstrongclinic.com