Privacy Policy | Rheumatology Consultancy, London

Last updated: 6 November 2026.
This policy is written under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as they stand today.

1. Who we are

Rheumatology Consultancy Limited ("we", "us", "the practice") is the data controller for the personal information this policy describes. We are a company registered in England and Wales, number 16958700, and our registered office is C/O Sandison Easson & Co, Rex Buildings, Alderley Road, Wilmslow, Cheshire, SK9 1HY. We are registered with the Information Commission, the United Kingdom's data protection regulator, known as the ICO, under reference ZC080014, which you can check on its public register at ico.org.uk.

Your care is given by Dr Liubov Borukhson, Consultant Rheumatologist (GMC 7021928), who practises through the company. She sees you at the private facilities run by Imperial College Healthcare Private Care at three London hospitals, or by video or telephone for a follow-up. When you attend, the hospital registers you as its patient for the visit and holds its own record of your attendance and of anything it provides, such as blood tests and imaging; for that information the hospital is a separate data controller, under its own privacy notice.

Our Data Protection Officer is Dr Vyacheslav Borukhson; his details are in section 12.

2. The information we hold

To give you medical care and run the practice, we hold:

Who you are and how to reach you: your name, date of birth, address, telephone number and email address.
Your health: your medical history and symptoms, examination findings, ultrasound findings and imaging results, blood tests and other investigations, diagnoses, treatments, medications, allergies, and correspondence with your GP and other clinicians.
Insurance and payment: your insurer, membership or policy number and pre-authorisation numbers, or your sponsor's letter of guarantee, and our invoices and receipts. We do not see or store card details: card payments are taken by Square, and bank transfers are handled by our bank.
What you tell us: emails, letters, notes of telephone calls, messages sent through the enquiry form on this website or by WhatsApp, and any complaint you make. WhatsApp is for appointment and administrative enquiries; a message sent through it is also subject to WhatsApp's own privacy policy, which may take your message outside the United Kingdom, so please do not send clinical information that way.
Website and technical data: if you use this website, limited technical information, such as your IP address, your browser's type and the pages you visit, is processed by our hosting provider for security and reliability and for the visit counts and speed measurement described in section 9, and by the measurement tools described there, Google Analytics and Microsoft Clarity, which run by default and can be turned off in that section for the browser you are using. We set no advertising cookies of our own; section 9 says what Microsoft's own domains may set.

Information about your health is special category data under the UK GDPR, and we treat it with particular care.

You do not have to give us any of this. Without your contact details and your health information we cannot book or care for you, and without your insurance details we cannot invoice your insurer.

As well as what you give us, we receive information about you from others: the referral and medical history from your GP or another clinician, results from laboratories and imaging providers, authorisation details from your insurer, and the hospital's registration details for your visit. We use it for the same purposes, set out below, and this policy is the information we owe you about it.

3. Why we use it, and the law that lets us

We use your information to:

give you consultations, make a diagnosis and treat you, including arranging and interpreting investigations and procedures;
write to your GP and other treating clinicians, and to NHS services where part of your care, such as an infusion, is better given in an NHS setting;
deal with your insurer or sponsor over pre-authorisation, invoices and claims;
arrange appointments, confirm and remind you of them, and answer your enquiries;
keep accurate medical records, as the GMC and professional standards require;
meet our legal, regulatory and accounting duties;
run, secure and improve this website, including measuring how it is used (section 9);
handle any complaint or claim.

Our lawful bases under the UK GDPR are:

Article 9(2)(h), with the Data Protection Act 2018, Schedule 1, paragraph 2: medical diagnosis, the provision of health care and treatment, and the management of our health care service, under the responsibility of a doctor bound by professional secrecy. With Article 6(1)(b), this is the basis for everything we do with information about your health in order to care for you.
Article 9(2)(j), with the Data Protection Act 2018, Schedule 1, paragraph 4: statistical purposes in the public interest, for the counted steps of our symptom check, which can say something about health. Section 9 explains.
Article 9(2)(f): where information about your health is needed to deal with a legal claim, or a complaint that may become one.
Article 6(1)(b): the performance of our contract with you, for the consultations, investigations and treatment we provide under it, and for appointments, fees and payments.
Article 6(1)(c): compliance with our legal obligations, such as tax, accounting and record-keeping.
Article 6(1)(f): our legitimate interests in running the practice, keeping our systems secure, improving the care and the information we give, measuring how this website is used, and recovering fees that are owed, in each case where your rights do not override them; you may object to any processing on this basis (section 8).
Article 6(1)(a) and Article 9(2)(a): your explicit consent, where nothing else covers a use, for example sharing information with someone else at your request.

4. Who we share it with

We share information only where it is needed and with proper safeguards:

The hospital where you are seen, through Imperial College Healthcare Private Care, which registers you, carries out the tests and the imaging it provides, dispenses from its pharmacy, and invoices its own charges.
Your GP and the other clinicians treating you, for continuity of care and in line with GMC guidance: a letter after each appointment goes to your GP as part of your care, unless you tell us you object, and you receive a copy.
NHS services, where part of your care is transferred to the NHS with your agreement.
Your insurer or sponsor, where you use insurance or a sponsor pays, for pre-authorisation, invoices and claims.
Laboratories and imaging providers, where investigations are arranged for you.
A pharmacy you choose, Pharmacierge for home delivery among them, for a prescription.
Our service providers, who act on our instructions under written agreements: our clinical record and office systems; our email provider; Microsoft, for video consultations on Teams; Netlify, which hosts this website and receives the enquiries sent through its form; and our accountants.
Square (Squareup Europe Ltd, part of Block, Inc.), which takes card payments for us: it processes the payment on our behalf, and Square also holds the card and transaction details under its own privacy notice for shoppers, Square's privacy notice; we do not see or store card details (section 2), and section 5 says where Square processes them.
Regulators and professional bodies, such as the GMC, the Care Quality Commission and the Information Commission, where the law or a professional duty requires; and, if you complain about care given at the hospital, the hospital's complaints team and the Independent Sector Complaints Adjudication Service.
Dr Borukhson's medical defence organisation and our legal advisers, where a complaint or a claim requires it.
The hospital's billing team, a debt collection agency or the court, where an invoice remains unpaid after a reminder.
Doctify, whose verified review service displays patient reviews on this website: a review you choose to leave is given to Doctify under its own privacy notice, and we give Doctify nothing about your care.

We do not sell your information, we do not share it for marketing, and we send you no marketing.

5. Where it is kept

Your clinical and administrative records are kept in the United Kingdom. Our Microsoft 365 systems, Teams among them, hold their data in the United Kingdom or in Microsoft's Europe, Middle East and Africa region. Some of the providers named in this policy take data outside the United Kingdom: Google (Google Analytics, Google Tag Manager and the map on our contact page) processes it in its data centres in the United States and Europe, and may use any country where it or its subprocessors have facilities; Netlify (our hosting and the enquiry form, with the spam filter Akismet) processes it in the United States; Microsoft holds Clarity's data in its Azure cloud and may pass it to Microsoft Corporation in the United States; Square may process payment data in the United States and other countries; and a WhatsApp message travels through WhatsApp's servers under its own policy. Google LLC, Netlify, Inc. and Microsoft are certified under the UK Extension to the EU-US Data Privacy Framework, so their transfers to the United States are approved by regulations under Article 45A of the UK GDPR, the Data Protection (Adequacy) (United States of America) Regulations 2023; transfers to the European Economic Area are approved by regulations under Article 45A as well (the Data Protection Act 2018, Schedule 21); where a transfer is not covered by them, as with Square, we rely on the safeguards of Article 46, the International Data Transfer Agreement or its Addendum in our contract with the provider. You can ask our Data Protection Officer for a copy of the safeguard that applies.

6. How long we keep it

Clinical records: for at least eight years from the end of your treatment, the period the NHS Records Management Code of Practice sets for adult health records, which we follow as a private provider; where your condition is long-term or may recur, as most rheumatic conditions are, for 20 years, or ten years after death; and longer where a complaint or a claim requires it.
Complaints and claims: for ten years.
Requests to see your information, and the correspondence about them: for three years, or six years from the end of the financial year where you appealed.
Financial records: for six years from the end of the financial year they belong to, as HMRC requires, and longer if HMRC opens an enquiry.
Enquiries that do not lead to an appointment: for no longer than twelve months, including the copies Netlify holds.
Measurement data: for the periods section 9 gives.

When a period ends, the records are reviewed and, unless a reason to keep them remains, securely destroyed.

7. How we protect it

We use appropriate technical and organisational measures: encryption in transit on this website and in our systems, access limited to those who need it, secure clinical systems, password and device security, and a duty of confidentiality on everyone who works with us. Ordinary email is not encrypted end to end; if you would rather receive letters or results another way, tell us.

8. Your rights

Under the UK GDPR you have the right:

to be told how we use your information, which this policy does;
to a copy of the information we hold about you, the first copy free of charge: we answer within one month of your request or, if we need to check who you are, of receiving what we ask for, after a reasonable and proportionate search of our records; for a request that is complex, or where you have made several, we may take two further months, and we tell you within the first month if so and why; time spent waiting for a clarification we reasonably need does not count;
to have inaccurate information corrected;
to have information erased, where that applies; it does not apply to medical records we must keep;
to restrict what we do with it, in some circumstances;
to receive the information you gave us in a portable form, where that applies;
to withdraw consent at any time, where consent is our basis;
not to have a significant decision about you made solely by automated means on the strength of information about your health, save with your explicit consent, and, for any other such decision, to be told of it, to put your case, to have a person look at it and to contest it. We make no such decisions; our symptom check sorts a pattern of pain, decides nothing about anyone and stores none of your answers itself, and the counting of its steps is described in section 9.

Your right to object. You may object at any time to processing based on our legitimate interests, including the measurement of this website, for which the switch in section 9 is the way to object; we then stop unless we can show compelling grounds to continue. You may also tell us at any time that you do not want a letter to go to your GP (section 4).

To use any of these rights, contact our Data Protection Officer (section 12). If we refuse a request, we tell you why, and you may complain to us, complain to the Information Commission or apply to a court. After a patient's death, a personal representative, or a person with a claim arising from the death, may apply for access to the records under the Access to Health Records Act 1990, free of charge.

9. Cookies and measurement

This website measures how it is used, so that we can improve it. Measurement runs by default; the switch at the end of this section turns it off, for the browser you are using, at any time.

Google Analytics, loaded through Google Tag Manager, counts visits, the pages read, the routes taken through the site, how far down a page you read and the links you follow to other sites, the terms searched for on the site, the enquiries sent through our form, and the clicks on our telephone, email and WhatsApp links. This includes the steps you take through our symptom check, which are counted in the same way. It sets two cookies that last up to two years, so that a returning visitor is counted once rather than twice; your IP address is used only to place you roughly, down to the city, and is then discarded, since Google does not keep IP addresses from the United Kingdom. Google Ireland Limited provides the service and processes this data as our processor under Google's data processing terms, business.safety.google/adsprocessorterms; Google keeps each visit's record for 14 months and a returning visitor's record for 14 months from the last visit, deleting them in a monthly run, and keeps the aggregate counts, which identify no one, for its standard reports. We use none of Google's advertising features and have not turned on Google Signals, so this data is not used to build an advertising profile of you. Google's own account of what it collects from sites that use its services is at policies.google.com/technologies/partner-sites. Google Tag Manager itself keeps nothing about you beyond its ordinary request logs, which Google deletes within 14 days.
Microsoft Clarity, loaded the same way, records how pages are used: where visitors click, how far they scroll, and replays of visits that rebuild the page and the pointer's movements, in which anything typed is masked, as is the text of the questions and answers of our symptom check. When measurement is on, Clarity sets two cookies on this site, one that lasts a year and one that lasts a day; Microsoft's own domains may set further cookies, the longest lasting about 13 months, which Microsoft uses for its own analytics and advertising, though this site gives Microsoft no advertising consent, so Clarity shares nothing with Microsoft Advertising. Microsoft holds this data in its Azure cloud; it keeps the replays for 30 days, except a sample of them and any we mark to keep, which it keeps for up to nine months, and the click and scroll data for nine months; it has access to the data and uses it, as a controller in its own right, to improve its products and services, under the Microsoft Privacy Statement. Microsoft lets us delete this data only for the site as a whole, not for one visitor. We have linked Clarity to our Google Analytics, so that Clarity's reports can be read beside Google's and a replay matched to the visit Google Analytics counted. Clarity also honours the Global Privacy Control signal if your browser sends it.
Netlify, our hosting provider, keeps a server record of each request, with your IP address, your browser's type and the page asked for, for security and reliability; from those records it counts visits and visitors, a visitor being a distinct IP address within a day, with no cookies; and a small script of its own, which sets no cookies, measures how quickly pages load and reports it to Netlify, which shows it to us only in aggregate. Both run whether the switch below is on or off, since neither goes through Google Tag Manager. Netlify keeps the server records for as long as its security and reliability work needs them and does not publish the period; the counts and speed figures it shows us cover the last 30 days. Netlify also receives the enquiries sent through our contact form, passes each through the spam filter Akismet, stores it, and emails us those that pass; we delete them from Netlify's store on the schedule in section 6. Netlify's privacy statement is at netlify.com/privacy.
Other content. Some pages load content from other providers in order to work: the Doctify review widgets on our home and reviews pages, and the Google map on our contact page, which loads with the page. Those providers receive the standard technical data of a request, your IP address among it, and may set their own cookies under their own privacy notices: Doctify's, and for the map the Google Privacy Policy and the Google Maps additional terms, under which Google handles map data as a controller in its own right. The map shows three fixed hospital markers and does not ask for your location.

We rely on our legitimate interest in understanding how the website is used (Article 6(1)(f)). For Google Analytics' cookies, which gather statistics about the site's use, the switch below is the simple, free means of objecting that the Privacy and Electronic Communications Regulations ask for; it turns Microsoft Clarity off as well. The steps you take through our symptom check can say something about your health, so for them we rely as well on Article 9(2)(j) of the UK GDPR with the condition for statistical purposes in the Data Protection Act 2018 (Schedule 1, paragraph 4): the statistics serve the public interest in better information for patients, since what the counts show us improves a free check that anyone may use; the processing is carried out in accordance with Article 84B, with the safeguards Article 84C requires; and the data is pseudonymous, carrying nothing that identifies you by name, used only in aggregate, and never used to make a decision about you.

None of this identifies you by name, and nothing you type into the enquiry form is captured by measurement.

Your choice on the switch is kept in this browser's own storage, under the name "rcl-measurement", not in a cookie, until you change it or clear that storage. Safari deletes that storage after seven days of Safari use in which you do not interact with this site, and the switch then shows measurement on again.

10. Children

The practice treats adults only and sees no one under 18. If we hold information about a person under 18, for example in a family history a patient gives us, we handle it under this policy, and a parent or someone with parental responsibility may exercise that person's rights on their behalf where the young person cannot, or asks them to, in line with the law and professional guidance.

11. Changes to this policy

We may change this policy, for example when we change how we work or when the law changes. The "Last updated" date at the top of the page shows when the current version took effect. If a change affects how we use information about you as a patient, we tell you before it takes effect.

12. How to contact us, and how to complain

For any question about your information, or to use your rights, contact:

Data Protection Officer: Dr Vyacheslav Borukhson
Rheumatology Consultancy Limited
C/O Sandison Easson & Co, Rex Buildings, Alderley Road, Wilmslow, Cheshire, SK9 1HY
Telephone: +44 (0) 20 8152 3999
Email: compliance@rcl.london

If you think we have handled your information wrongly, you have the right to complain to us, and we ask you to do so first. You can complain by email to the address above, through the enquiry form on our contact page, by telephone, or by post to our registered office. We acknowledge a complaint within three working days, answer it in full within 20 working days, and tell you if we need longer and why. You also have the right, at any time, to complain to the Information Commission under section 165 of the Data Protection Act 2018: its helpline is 0303 123 1113, Monday to Friday, 9am to 5pm, and its website is ico.org.uk.