Privacy Notice
How we collect, use, and protect your personal data in accordance with UK data protection law.
ICO Registration: ZA303314 · Data Controller: Mr Bijan Khoubehi · Last updated: 4 August 2026
Who We Are
London Urology Specialists (representing Mr Paul Cathcart, Professor Mark Emberton, Mr Bijan Khoubehi, Honorary Associate Professor Jeremy Ockrim, Mr Richard Nobrega, Mr Anthony Noah, Professor Clement Orczyk and Mr Alberto Coscione, subsequently referred to as 'we', 'us' or 'our') gather and process your personal information in accordance with this privacy notice and in compliance with the relevant data protection regulation and laws. This notice provides you with the necessary information regarding your rights and our obligations, and explains how, why, and when we process your personal data.
As a practice of our size, London Urology Specialists is not legally required to appoint a statutory Data Protection Officer. Data protection matters are overseen by our Data Controller, Mr Bijan Khoubehi, whose contact details are below.
Contact for data & privacy queries
Mr Bijan Khoubehi · 18 Devonshire Street, London, W1G 7AQ
Tel: 0300 302 0202 · Email: info@londonurologyspecialists.co.uk
Information We Collect
We process your personal information to meet our legal, statutory and contractual obligations and to provide you with our clinical services. We will never collect any unnecessary personal data from you and do not process your information in any way, other than as specified in this notice.
Personal data we collect
- Name & date of birth
- Home address
- Personal and/or business email address
- Home & mobile telephone numbers
- Medical insurance policy details
- Bank/card details when payments are taken
- GP and other healthcare professional contact details (only with your consent)
Special category data
We also collect your health and specific medical information (special category data) to allow us to practise safely on your behalf. This is the most sensitive data we hold and is treated with the highest level of protection.
We collect this information through online forms, health questionnaires, your registration document, letters and emails from other clinicians, investigation results, and our own clinical notes and correspondence.
Telephone calls
Calls to and from our practice are recorded for training, quality assurance, and accurate record-keeping. You will be informed that the call is being recorded at the start of each call. Recordings are stored securely, retained only for as long as necessary for these purposes, and accessed only by authorised staff.
Data received from third parties
We also receive personal data about you from sources other than you directly — typically your GP or referring clinician, your medical insurer, other treating specialists, hospital test and imaging providers, and (where relevant) your next of kin. This data is shared with us to enable safe, co-ordinated clinical care, in accordance with Article 14 UK GDPR.
How We Use Your Personal Data
We take your privacy very seriously and will never disclose or share your data without your consent, unless required to do so by law. We only retain your data for as long as is necessary and for the purpose(s) specified in this notice. You are free to withdraw your consent at any time.
Communications with your GP and other relevant specialists to maintain coordinated care
Request forms for tests and scans, providing clinical context to allow accurate interpretation
Arrangement of hospital admissions and surgical procedures at partner facilities
Supplying clinical letters to hospitals as required by CQC regulations
Lawful Bases for Processing
Under UK GDPR we must have a valid legal basis to process your personal data. The bases we rely on are:
Contract
To deliver the clinical care you have engaged us to provide — including consultations, investigations, treatment, billing and follow-up.
Legal obligation
To comply with our statutory duties — for example, retaining financial records under UK tax law and meeting CQC clinical-record requirements.
Legitimate interests
For activities that are necessary to run the practice and that do not override your rights — such as communicating with your referring GP, recovering unpaid invoices, and protecting our systems against fraud or misuse.
Consent
Where we rely on your explicit agreement — for example, sending appointment reminders by text or email, or sharing information with parties other than your treating clinicians. You can withdraw consent at any time.
Health data — Article 9(2)(h)
For your medical records and other special category data, we rely on Article 9(2)(h) UK GDPR: processing necessary for the provision of health care by a regulated health professional, supported by the Data Protection Act 2018.
Children & Adolescents
Our Adolescent Urology service treats young people under the age of 18. Where a patient is a child, we process their personal and clinical data on the same basis as for adults — primarily Article 9(2)(h) UK GDPR for the provision of health care — but with additional safeguards:
Appointments are arranged by a parent or person with parental responsibility, who provides consent to treatment and to the processing of the child's data.
Where a young person is judged to have sufficient understanding (Gillick competence), their own views and confidentiality are respected as far as is clinically appropriate.
Children's records are held with the same security, retention rules and access controls as adult records, and are never used for marketing.
Once a patient reaches the age of 18 they can request access to and control over their own records directly.
Automated Decision-Making
We do not make decisions about you based on solely automated processing, and we do not use your data for profiling. All clinical decisions are made by a qualified clinician. Where we use AI-assisted tools (such as Heidi Health for consultation transcription), the output is reviewed by your treating clinician before being added to your record.
Your Rights
You have the right to access any personal information that we process about you and to request information about:
What personal data we hold about you
The purposes and legal basis for processing
Recipients to whom data has been disclosed
How long we intend to store your data
The right to correct or erase your data
The right to restrict processing or object to direct marketing
The right to data portability (receiving your data in a structured, commonly used format)
The right to withdraw consent at any time, without affecting the lawfulness of prior processing
If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the request, to ensure your data is protected.
How to exercise your rights
To make a Subject Access Request or exercise any other right above, write to us at info@londonurologyspecialists.co.uk or by post to 18 Devonshire Street, London, W1G 7AQ. We will respond within one calendar month of receiving your request. We may extend this by a further two months for complex requests and will let you know if so. There is normally no charge, but we may charge a reasonable fee or refuse manifestly unfounded or excessive requests.
Links to Other Websites
Our website contains links to other websites that are not operated by us — for example, hospital partners, NHS resources, professional bodies, medical journals, and the personal profiles of our consultants on third-party platforms. These links are provided for your convenience and information only. We are not responsible for the content, privacy practices, or data protection arrangements of any external site, and inclusion of a link does not imply endorsement. We encourage you to review the privacy notice of any website you visit.
Safeguarding Measures
We take your privacy seriously and take every reasonable measure and precaution to protect and secure your personal data. We have several layers of security in place including SSL/TLS encryption, pseudonymisation, restricted access, IT authentication, firewalls, and antivirus and malware protection.
Wherever possible, your personal data is stored within the UK or EEA. Some of the third-party services we use (for example Zoom for video consultations, and certain Microsoft 365 functions) may involve transfers of personal data outside the UK. Where this happens, transfers are protected by appropriate safeguards such as the UK International Data Transfer Addendum (IDTA), the EU Standard Contractual Clauses (SCCs), or transfers to countries the UK has determined offer an adequate level of protection. We may also transfer your records outside the EU where this is necessary for your continuity of care — for example if you reside abroad for part of the year.
Data breaches. In the unlikely event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, in accordance with our obligations under UK GDPR. We will also report qualifying breaches to the Information Commissioner's Office (ICO) within 72 hours.
How Long We Keep Your Data
We only ever retain personal information for as long as is necessary and have strict review and retention policies in place.
6 years
Basic personal data (name, address, contact details) — required under UK tax law
8 years
Medical records — from the date of last contact with us
You are not obligated to provide your personal information to us; however, as this information is required to arrange investigations, treatment and provide safe co-ordinated clinical care, we may not be able to offer our services without it.
Lodging a Complaint
We only process your personal information in compliance with this privacy notice and in accordance with relevant data protection laws. If you wish to raise a complaint regarding the processing of your personal data or are unsatisfied with how we have handled your information, you have the right to lodge a complaint with the supervisory authority.
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Tel: 0303 123 1113 ·
www.ico.org.uk
Changes to This Notice
We keep our privacy notice under regular review and may update it from time to time to reflect changes in our practice, the services we use, or relevant data protection law. The "Last updated" date at the top of this page reflects the most recent revision. Where changes are material — for example, a new processor, a change in how we use your data, or a change in your rights — we will bring them to your attention through our website and, where appropriate, by direct communication. We recommend checking this page periodically to stay informed.
Consent
To provide reminders about appointments and update you with relevant clinical information, we would like to contact you by phone, text, or email. You have the right to modify or withdraw your consent at any time by contacting us directly.