Privacy policy

The data controller is Paul Worth Neurology Ltd, a company registered in England and Wales (company number 12042009). Registered office: Spire Cambridge Lea Hospital, 30 New Road, Impington, Cambridge, CB24 9EL. We are registered with the Information Commissioner’s Office (ICO), registration number Z8737859.

For any question about this policy or your personal information, email jane@drpaulworth.co.uk or write to us at the registered office address.

This website has no forms, accounts or online payments. It collects only:

• Analytics data: how visitors use the site, collected by Google Analytics 4 (see section 5).
• Technical data: your IP address, browser and device type, which the web server records in standard logs to keep the site secure and working.
• Your cookie settings: whether you have switched analytics off, stored in your own browser.

If you phone or email the practice, we use the details you give us (such as your name, contact details and the reason for your enquiry) only to respond to you and, where you ask, to arrange an appointment. Our lawful basis is to take steps at your request before providing care, and our legitimate interest in answering enquiries.

Appointments are booked and held at the hospital you choose (Spire Healthcare or Circle Health Group). The hospital is a separate data controller for the information it holds and will give you its own privacy information.

To provide your care we hold your contact details, date of birth, medical history, examination findings, test results and correspondence. Health information is special category data. We process it to provide medical care (UK GDPR Article 6(1)(b), contract, and Article 9(2)(h), the provision of health care), under a duty of confidentiality.

We share your information only where needed for your care or your account:

• The person who referred you, usually your GP, and other health professionals involved in your care receive a report of your consultation, unless you ask us not to send one. You also receive a copy.
• Carebit, the practice management software we use for records, correspondence and the patient portal, where you can download your letters.
• Civica Medical Billing and Collection (CMBC), who handle invoicing and payments. We pass them your name, date of birth, address, telephone number and email address by secure email for billing only, with no health information.
• Your private medical insurer, if you are insured, so they can authorise and pay for your treatment.
• The hospital where you are seen, and any provider carrying out tests we request for you.

We prefer to send copies of letters by email or through the Carebit portal. Ordinary email is not encrypted, so please tell us if you would rather receive letters another way. Medical records are kept for as long as professional guidance for medical records requires.

We use Google Analytics 4 to count visits and understand which pages are useful, so we can improve the site. Analytics runs from your first visit and stays on unless you switch it off in Cookie settings, at the foot of every page.

Our lawful basis is legitimate interests: understanding aggregate use of our website. We have weighed this against your interests and keep the impact low:

• There is no advertising, remarketing or third-party tracking on this site, and no marketing cookies.
• Google signals and Google’s data sharing settings are switched off.
• Analytics data is kept for a limited period (two months) and is used only in aggregate.
• You can switch analytics off at any time, free of charge, in Cookie settings.

Google Analytics is provided by Google Ireland Limited. Some data may be processed by Google in the United States, under the UK International Data Transfer Addendum and the UK Extension to the EU-US Data Privacy Framework.

• Doctify: Dr Worth’s patient rating and reviews are shown in a widget provided by Doctify, which loads from Doctify’s servers when you view a page. Doctify receives your IP address and basic browser information to display it, and may set its own cookies (see our cookie policy). The award badges are images hosted on this site. If you read or leave a review on Doctify, Doctify’s own privacy policy applies.
• Google Fonts: the fonts on this site are loaded from Google’s servers, which receive your IP address to deliver them. No cookies are set.
• Google Maps: the clinic maps load only when you choose to show one. Until then, nothing is sent to Google Maps. Once loaded, Google’s own privacy policy applies.
• Links to other sites (Spire Healthcare, Circle Health Group, the GMC and patient organisations) open their own websites, which have their own privacy policies.

• Analytics data: two months, then deleted by Google.
• Enquiry emails and call notes: only as long as needed to deal with your enquiry, unless you become a patient.
• Patient records and billing records: as long as professional guidance and the law require.
• Your cookie settings: until you change them or clear your browser storage.

We use secure, access-controlled systems for patient records and billing, and share information only with the people listed above. We do not sell your information, and we do not use it for marketing or for automated decision-making.

Under UK data protection law you have the right to access the personal information we hold about you (including your medical records), to have it corrected or deleted where the law allows, to restrict or object to how we use it (including our use of analytics), and to data portability where it applies. To use any of these rights, contact us using the details in section 1. We will reply within one month.

If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk (opens in a new tab) or on 0303 123 1113.

We will update this policy if the way we collect or use information changes. The date at the top shows when it was last updated. See also our cookie policy and terms and conditions.