Privacy Notice

Last updated: August 2026

1. Who we are

Cardiology Clinic is an independent face-to-face cardiology clinic at 158 Finchley Road, London NW3 5HH. It is operated by Dr Mahmood Ahmad, Specialist in Cardiology, GMC registered — No. 6071047. We are the data controller for the personal information we collect about you.

Contact and data protection queries: drmahmoodclinic@pm.me. Email is the only contact route.

Clinic address: 158 Finchley Road, London NW3 5HH. Appointments are normally 30 minutes.

2. What information we collect

We may collect and process the following categories of personal data:

• Identity data: your name, date of birth, and GP details if you provide them
• Contact data: your email address
• Appointment data: appointment dates, times, attendance records, and emails about arranging your appointment
• Health data: what you write in your email enquiry, symptoms, medical history, medications, examination findings, ECG findings if recorded, and clinical notes from the consultation (special category data under UK GDPR Article 9)
• GP correspondence: the letter sent to your GP after every consultation and any related correspondence with your GP
• Website counter data: the page path visited on this website, and nothing else

Please do not send detailed medical records by email unless Dr Ahmad asks you to do so. If records are needed, you will be told what to send.

3. How we collect your information

We collect information directly from you when you:

• Email us to request an appointment or ask a question
• Attend a face-to-face consultation and provide your medical history
• Provide GP details so a letter can be sent after your consultation

There is no online account, no online booking system, and no payment through the website.

4. Lawful basis for processing

We process your personal data on the following legal bases under UK GDPR:

• Contract (Article 6(1)(b)): to respond to your enquiry and arrange and provide the consultation you have requested
• Health care (Article 9(2)(h)): to process health data for medical assessment, advice, and care by a regulated health professional
• Legitimate interests (Article 6(1)(f)): to manage appointments, respond to enquiries, maintain website security, and understand which pages are used through the first-party page-view counter
• Legal obligation (Article 6(1)(c)): to comply with regulatory requirements including clinical record-keeping obligations

5. How we use your information

We use your information to:

• Provide your face-to-face cardiology consultation
• Make clinical notes from the consultation
• Prepare and send a letter to your GP after every consultation
• Manage your appointment and send email reminders
• Respond to your enquiries
• Comply with legal and regulatory obligations

Health information is never shared with advertising platforms. The site runs no advertising and no third-party analytics trackers.

6. Data processors

We use the following third-party services to deliver our service. Each acts as a data processor on our behalf:

• Proton Mail (Proton AG) — email, through which appointment enquiries and correspondence reach us. Privacy policy: proton.me/legal/privacy
• DigitalOcean (DigitalOcean LLC) — hosting for this website, served from a European (Frankfurt) region. Privacy policy: digitalocean.com/legal/privacy-policy
• Cloudflare (Cloudflare, Inc.) — content delivery and security in front of the website. Privacy policy: cloudflare.com/privacypolicy

We do not use a third-party online booking platform. Appointments are requested by email only.

7. Data retention

• Clinical records and GP letters: retained for 8 years from the date of your last consultation, in accordance with clinical record-keeping guidance
• Email enquiries that do not lead to a consultation: deleted within 12 months unless there is a clear clinical, legal, or regulatory reason to keep them longer
• Appointment administration emails: retained for 3 years unless they form part of the clinical record
• First-party page-view counter records: retained for up to 24 months and record only the page path

8. Your rights

Under UK GDPR, you have the right to:

• Access your personal data (Subject Access Request)
• Rectification of inaccurate data
• Erasure of your data (subject to our legal obligations to retain clinical records)
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent where consent is the lawful basis for a specific use (this does not affect the lawfulness of processing before withdrawal)

To exercise any of these rights, contact us at drmahmoodclinic@pm.me. We will respond within one month.

9. International transfers

Proton AG is based in Switzerland, which has an adequacy decision from the UK. Our website is hosted with DigitalOcean in a European (Frankfurt) region, and Cloudflare provides content delivery and security; where any data is processed outside the UK, it is protected under appropriate safeguards in accordance with UK GDPR requirements.

10. Cookies and analytics

Our website does not use cookies, fingerprinting, advertising, or third-party analytics trackers. All fonts are self-hosted. The site uses only a first-party page-view counter to understand which pages are used. The counter records the page path and nothing else: no cookies, no fingerprinting, no personal data, and no health data.

11. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

12. Changes to this notice

We may update this notice from time to time. The “last updated” date at the top of this page will be revised accordingly. We encourage you to review this page periodically.