Privacy Policy

1. Who we are

This website relates to the private vascular and endovascular surgical practice of Mr Shanka Benaragama.

For enquiries concerning personal information or this privacy policy, please contact the practice by email:

benaragama.admin@lips.org.uk

Depending on where your consultation, investigation or treatment takes place, the relevant hospital or healthcare provider may also act as a separate data controller for information it collects and holds about you.

2. Information we may collect

The information collected will depend on your interaction with the practice and the care you receive.

Personal information may include:

• Your name and contact details.
• Appointment and correspondence details.
• Referral information and details provided by you or another healthcare professional.
• Medical history, symptoms, diagnoses and information relevant to your care.
• Medication and allergy information.
• Results of scans, investigations, laboratory tests and other clinical assessments.
• Information about previous procedures or treatment.
• Clinical photographs or other medical records where appropriate to your care.
• Correspondence with hospitals, clinicians, insurers and other healthcare providers involved in your care.
• Private medical insurance and authorisation information where relevant.
• Technical information generated through use of this website, such as device, browser or cookie information where applicable.

3. How your information may be used

Personal information may be used where necessary to provide and administer your private medical care.

This may include:

• Responding to consultation enquiries.
• Arranging and managing appointments.
• Assessing symptoms and medical history.
• Providing diagnosis, advice, investigation and treatment.
• Preparing and maintaining clinical records.
• Corresponding with your GP, referring clinician or other healthcare professionals where appropriate.
• Arranging investigations, procedures, hospital admission or follow-up care.
• Communicating with private hospitals and healthcare providers involved in your care.
• Managing billing, insurance or administrative requirements where applicable.
• Meeting professional, regulatory, clinical governance and legal obligations.
• Protecting patients and others where disclosure is necessary for safeguarding, public interest or legal reasons.

4. Lawful bases for processing

Personal information is processed only where there is an appropriate lawful basis under applicable UK data protection law.

Depending on the circumstances, this may include processing that is necessary for:

• Providing or arranging healthcare.
• Entering into or performing a contract for private medical services.
• Compliance with a legal or regulatory obligation.
• Legitimate interests in operating and administering a medical practice, provided those interests do not override your rights and freedoms.
• Protecting vital interests in limited circumstances.
• Your consent where consent is the appropriate legal basis.

Health information is special category data. Where health information is used for medical diagnosis, treatment or the management of healthcare, an additional lawful condition for processing special category data is also required.

5. Who information may be shared with

Your information is not sold.

Where necessary and appropriate, information may be shared with organisations or professionals involved in providing, coordinating or administering your care.

This may include:

• Your GP or referring clinician.
• Other consultants and healthcare professionals involved in your care.
• Hospitals and clinics at which you are assessed or treated.
• Diagnostic imaging and laboratory providers.
• Nursing, allied healthcare or multidisciplinary teams involved in your care.
• Private medical insurers where relevant to your treatment or claim.
• Administrative or professional service providers supporting the practice.
• Regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law.

Only information that is reasonably necessary for the relevant purpose should be shared.

6. Storage and security

Appropriate organisational and technical measures are used to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Medical information may be held within secure clinical systems operated by the practice, hospitals or other healthcare organisations involved in your care.

Email is used for private practice enquiries. Patients should avoid sending unnecessary highly sensitive information by ordinary email unless requested or appropriate arrangements have been made.

7. How long information is kept

Personal and medical information is kept only for as long as necessary for the purposes for which it was collected and to meet applicable medical, professional, regulatory, insurance and legal obligations.

Different categories of records may be subject to different retention periods. Clinical records may need to be retained for significant periods because they form part of the continuing medical record and may be required for future care, regulatory or legal purposes.

8. This website, analytics and cookies

This website is hosted using Squarespace. Like many websites, technical information may be processed automatically when you visit the site.

Cookies and similar technologies may be used for functions such as website security, performance, analytics, preferences and functionality.

Some cookies are necessary for a website to function. Where non-essential cookies are used and consent is required under applicable law, they should only be set after the appropriate choice has been provided to the visitor.

You can also control or delete cookies through your browser settings, although disabling some cookies may affect how parts of the website operate.

9. Your data protection rights

Depending on the circumstances and the legal basis on which information is processed, you may have rights in relation to your personal information.

These may include the right to:

• Ask whether personal information about you is being processed.
• Request access to personal information held about you.
• Ask for inaccurate information to be corrected.
• Request deletion of information in certain circumstances.
• Ask for processing to be restricted in certain circumstances.
• Object to certain types of processing.
• Request transfer of information where the right to data portability applies.
• Withdraw consent where processing depends on your consent.

Some rights are not absolute. For example, medical records may need to be retained where there is a professional, regulatory, clinical or legal reason to do so.

To make a request concerning your personal information, contact the practice using the email address below.

10. Concerns and complaints

If you have concerns about the way your personal information has been handled, please contact the practice first so the issue can be reviewed.

You also have the right to raise a concern with the UK supervisory authority, the Information Commissioner’s Office (ICO).

Further information about data protection rights and how to make a complaint is available from the ICO.

11. International transfers

Some technology, hosting or service providers may process information outside the United Kingdom.

Where personal information is transferred internationally, appropriate legal mechanisms and safeguards should be used where required by UK data protection law.

12. Links to other websites

This website may contain links to other healthcare providers, hospitals or external websites.

Those organisations operate their own websites and privacy practices. This privacy policy does not govern the way third-party websites process personal information.

13. Changes to this privacy policy

This privacy policy may be updated from time to time to reflect changes in the practice, website, technology or legal requirements.

The date shown at the top of this page indicates when the policy was most recently updated.