Reviews Book an appointment
Legal

Privacy Policy

How Rheumatology Consultancy Limited collects, uses and protects your personal information

Last updated: 19 June 2026.
This privacy policy is provided in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Rheumatology Consultancy Limited ("we", "us", "the practice") is the data controller for the personal information described in this policy. Our registered office is C/O Sandison Easson & Co, Rex Buildings, Alderley Road, Wilmslow, Cheshire, SK9 1HY. The practice is registered with the UK Information Commissioner's Office (ICO) under registration reference ZC080014. You can verify this on the ICO's public register at ico.org.uk.

Clinical care is provided by Dr Liubov Borukhson, Consultant Rheumatologist (GMC 7021928), practising through Rheumatology Consultancy Limited.

2. The information we collect

To provide medical care and run the practice, we may collect and hold:

  • Identification and contact details: name, date of birth, address, telephone number, email address.
  • Health and clinical information: medical history, symptoms, examination findings, ultrasound and imaging results, blood tests and other investigations, diagnoses, treatments, medications, allergies, and correspondence with your GP and other clinicians.
  • Insurance and payment information: insurer, membership/policy number, pre-authorisation codes, billing details. We do not store card or payment details ourselves; payments are handled securely by our designated payment providers.
  • Communications: emails, letters, telephone notes, secure messages, and enquiries you send through this website or via WhatsApp. If you contact us via WhatsApp, your message is also subject to WhatsApp's own privacy terms; please do not send sensitive clinical information by WhatsApp; use it only for general and appointment enquiries.
  • Website and technical data: if you use this website, limited technical information such as IP address, browser type and pages visited may be processed by our hosting provider for security and reliability, and, where you consent, by our analytics providers as described in section 9. The site uses Google Tag Manager to load Google Analytics and Microsoft Clarity in "consent mode": until you make a cookie choice, Google receives only limited, cookieless technical signals (such as that a page was viewed) that are not used to identify you, and Microsoft Clarity does not run at all. Optional analytics cookies are only set, and Clarity only operates, if you consent through the cookie banner (see section 9). We do not use advertising cookies.

Health information is "special category" data under UK GDPR and is treated with particular care.

As well as information you give us directly, we may receive information about you from other sources, for example a referral letter and medical history from your GP or another clinician, results from laboratories or imaging providers, and authorisation details from your insurer. We use this information for the same purposes set out in this policy.

3. How we use your information, and our lawful basis

We use your personal data to:

  • Provide consultations, diagnosis and treatment, including arranging and interpreting investigations and procedures.
  • Communicate with your GP, other treating clinicians and, where applicable, NHS services, for example where a treatment such as infusion therapy is better delivered in an NHS setting.
  • Liaise with your insurer for pre-authorisation, claims and billing where you use private medical insurance.
  • Manage appointments, send appointment confirmations and reminders, and respond to your enquiries.
  • Maintain accurate medical records in accordance with GMC and professional standards.
  • Meet our legal, regulatory and accounting obligations.

Our lawful bases under UK GDPR are:

  • Article 9(2)(h): the provision of health care, treatment and management of health-care systems, by a regulated health professional bound by a duty of confidentiality (this is the primary basis for handling your health information).
  • Article 6(1)(b): performance of a contract with you, for fees, payments and appointment administration.
  • Article 6(1)(c): compliance with our legal obligations (for example, tax, accounting and clinical record-keeping requirements).
  • Article 6(1)(f): our legitimate interests, such as practice administration, IT security and quality improvement, where these are not overridden by your rights.
  • Article 6(1)(a) / 9(2)(a): your explicit consent, where required (for example, sharing information with a third party not otherwise covered).

4. Who we share your information with

We share information only where necessary and with appropriate safeguards. This may include:

  • Your GP and other treating clinicians: for continuity of care and in line with GMC guidance.
  • Your private medical insurer: where you are using insurance, for pre-authorisation and claims.
  • NHS services: where elements of your care, such as infusion therapy, are delivered in an NHS setting, and you have agreed to a transfer of care.
  • Laboratories and imaging providers: where investigations are arranged on your behalf.
  • Regulators and professional bodies: such as the GMC, the CQC where applicable, or the ICO, where we are required by law or professional duty.
  • Our service providers (processors): including secure clinical record systems, IT and email providers, accountants, payment processors, and our website hosting and form provider. Each is bound by a written agreement to protect your information.
  • Doctify: our website displays patient reviews via Doctify's verified review service. Doctify processes reviews you choose to submit to them in line with their own privacy notice. We do not share your medical information with Doctify.

We do not sell your personal information, and we do not share it for marketing.

5. International transfers

Your information is stored within the United Kingdom or the European Economic Area wherever possible. Where any of our service providers process data outside the UK/EEA, we ensure that an adequate level of protection is in place, for example via UK adequacy decisions or the International Data Transfer Agreement / Addendum.

6. How long we keep your information

We retain clinical records in line with professional and regulatory guidance for private medical practice in the UK. As a general rule, adult medical records are kept for a minimum of eight years from the end of treatment; records for certain specific conditions are kept for longer in accordance with current NHS and professional retention schedules. Financial records are kept for at least six years in line with HMRC requirements. After the relevant retention period, records are securely destroyed.

7. How we protect your information

We use appropriate technical and organisational measures to keep your information secure, including encryption in transit, access controls on a need-to-know basis, secure clinical systems, password and device security, and ongoing staff awareness of confidentiality obligations.

8. Your rights

Under UK GDPR you have the right to:

  • Be informed about how we use your data (this policy).
  • Request a copy of the personal data we hold about you (subject access).
  • Have inaccurate data corrected.
  • Request erasure of your data, where applicable (this right is limited for medical records we are required to retain).
  • Object to, or restrict, certain types of processing.
  • Withdraw consent at any time, where processing is based on consent.
  • Data portability, where applicable.
  • Not be subject to decisions based solely on automated processing; we do not make any such decisions.

To exercise any of these rights, please contact us using the details below. We will normally respond within one calendar month.

9. Cookies and the website

When you visit our website, a banner lets you choose whether optional analytics cookies are used. The website itself sets no cookies of its own before you choose; your choice is remembered in your browser's local storage (under the name "rcl-cookie-consent"), not in a cookie.

  • Strictly necessary: the site, the enquiry form and the storage of your cookie choice are required for the website to work and are always on.
  • Analytics (optional, with your consent): we use Google Analytics, loaded through Google Tag Manager, to understand how visitors use the site so that we can improve it. This runs in Google's "consent mode": until you accept, no analytics cookies are set and Google receives only limited, cookieless signals (such as that a page was viewed) which are not used to identify you. If you accept, analytics cookies are set; if you decline, they are not. With your consent, we also use Microsoft Clarity, a session-analytics tool from Microsoft, again loaded through Google Tag Manager. Clarity shows us how pages are used through aggregated heatmaps and anonymised session replays (for example, where visitors click or how far they scroll), so that we can improve the site's usability. It is configured to mask the text you type, so anything you enter into a form is not captured, and it runs only after you consent. Microsoft acts as our analytics provider for this data; international transfers are addressed in section 5. We do not use advertising or marketing cookies.
  • Performance monitoring (no cookies): separately from the optional analytics above, our website hosting provider (Netlify) measures how quickly pages load and respond for real visitors, so that we can keep the site fast and stable. This uses a small script that sets no cookies and collects only aggregated technical measurements (such as loading speed, responsiveness and visual stability); it does not identify you or track you across other websites. Because it sets no cookies, it runs without needing the consent choice above.
  • Embedded third-party content: some pages load content directly from other providers in order to function: the Doctify review widgets (on our home and reviews pages), the Google map on our contact page, and our website hosting and form provider (Netlify), which processes enquiry-form submissions. When you view those pages, these providers receive standard technical request data and may set their own cookies, under their own privacy notices.

You can change your choice at any time by clicking the "Cookie preferences" link in the footer of the website. Withdrawing consent stops analytics cookies from that point on; any cookies already set can be removed through your browser settings.

10. Children

The practice provides care to adults only and does not treat patients under the age of 18. If we ever hold information about a person under 18, for example within a family history given by a patient, it is handled in accordance with this policy, and parents or those with parental responsibility may exercise rights on that person's behalf, in line with current law and professional guidance.

11. Changes to this policy

We may update this privacy policy from time to time, for example if we change how we work or if the law changes. The "Last updated" date at the top of this page shows when the current version took effect.

12. How to contact us, and your right to complain

For any question about your information, or to exercise your rights:

Data Protection Officer (DPO): Dr Vyacheslav Borukhson
Rheumatology Consultancy Limited (registered office)
C/O Sandison Easson & Co, Rex Buildings, Alderley Road, Wilmslow, Cheshire, SK9 1HY
Telephone: +44 (0) 20 8152 3999
Email: compliance@rcl.london

If you have any concern about how we handle your information, please contact our Data Protection Officer (above) in the first instance, and we will do our best to put things right. If you remain unsatisfied, you have the right to complain to the UK Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Web: ico.org.uk