Privacy Policy

Last updated: July 2026

1. Who we are

OpenPalp is the palpitations assessment service of London Cardiology Clinic, a private cardiology service operated by Dr Mahmood Ul-Hassan Ahmad, an NHS cardiology specialist doctor (GMC no. 6071047). We are the data controller for the personal information we collect about you. The appointment and a 12-lead ECG are free for suitable patients; one-week Kardia rhythm monitoring, if clinically appropriate, is £70, paid for in clinic on the day.

Contact and data protection queries: [email protected]

Clinic address: SF Studios, Hampstead. Appointments are on Tuesday mornings.

2. What information we collect

We may collect and process the following categories of personal data:

• Identity data: your name, date of birth
• Contact data: email address, phone number, postal address
• Health data: symptoms, medical history, medications, ECG findings, clinical assessment notes, and any correspondence with your GP (special category data under UK GDPR Article 9)
• Payment data: no payment is taken online — any optional add-on is paid for in clinic, so we do not collect or store card details
• Screening and booking data: the information you enter into the screening form (name, contact details, age band, symptoms, triggers, red-flag answers) which is sent to us by email, together with appointment dates, times, and attendance records

3. How we collect your information

We collect information directly from you when you:

• Complete the screening form on our website, which opens your own email app so you can send it to us (we do not take direct online bookings)
• Email us to request an appointment or ask a question
• Attend a consultation and provide your medical history

4. Lawful basis for processing

We process your personal data on the following legal bases under UK GDPR:

• Contract (Article 6(1)(b)): to provide the free cardiology consultation you have requested, and any optional add-on you choose to pay for in clinic
• Explicit consent (Article 9(2)(a)): for processing your health data (special category data). You will be asked to provide explicit consent before your consultation
• Legitimate interest (Article 6(1)(f)): for administrative purposes, improving our services, and responding to enquiries
• Legal obligation (Article 6(1)(c)): to comply with regulatory requirements including GMC record-keeping obligations

5. How we use your information

We use your information to:

• Provide your cardiology consultation
• Prepare a written clinical report
• With your explicit consent, share your report and recommendations with your GP
• Take payment in clinic for any optional add-on you choose
• Manage your appointment and send reminders
• Respond to your enquiries
• Comply with legal and regulatory obligations

6. Data processors

We use the following third-party services to deliver our service. Each acts as a data processor on our behalf:

• Proton Mail (Proton AG) — email, through which screening forms and all correspondence reach us. Privacy policy: proton.me/legal/privacy
• DigitalOcean (DigitalOcean LLC) — hosting for this website, served from a European (Frankfurt) region. Privacy policy: digitalocean.com/legal/privacy-policy
• Cloudflare (Cloudflare, Inc.) — content delivery and security in front of the website. Privacy policy: cloudflare.com/privacypolicy

We do not use a third-party online booking platform. Bookings are requested by email only.

7. Data retention

• Clinical records: retained for 8 years from the date of your last consultation, in accordance with GMC and NHS record-keeping guidance
• Screening forms and email correspondence: retained for 3 years unless related to clinical matters, in which case they are kept with the clinical record (8 years). Screening enquiries that do not lead to an appointment are deleted within 12 months.

8. Your rights

Under UK GDPR, you have the right to:

• Access your personal data (Subject Access Request)
• Rectification of inaccurate data
• Erasure of your data (subject to our legal obligations to retain clinical records)
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time for health data processing (this does not affect the lawfulness of processing before withdrawal)

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

9. International transfers

Proton AG is based in Switzerland, which has an adequacy decision from the UK. Our website is hosted with DigitalOcean in a European (Frankfurt) region, and Cloudflare provides content delivery and security; where any data is processed outside the UK, it is protected under appropriate safeguards in accordance with UK GDPR requirements.

10. Cookies and analytics

Our website does not use cookies, and there are no third-party analytics or advertising trackers. All fonts are self-hosted. We keep an anonymous, first-party count of page views (recording only the page path, no cookies, no personal data, and nothing that identifies you) to understand which pages are useful.

11. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

12. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top of this page will be revised accordingly. We encourage you to review this page periodically.