PRIVACY NOTICE

5 STAR CLINIC LTD (“5 Star Clinic”, “the Clinic”, “we”, “us” or “our”) takes the privacy, confidentiality and security of personal information seriously.

This Privacy Notice explains how we collect, use, store, disclose and protect personal information when you use our website, enquire about or receive our services, attend the Clinic, communicate with us, make a complaint, interact with our AI-assisted communication systems, submit or respond to a public review, request documentation, use our booking systems or otherwise deal with 5 STAR CLINIC LTD.

We process personal information in accordance with applicable UK data-protection law, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”), and applicable amendments introduced by the Data (Use and Access) Act 2025.

1. Who we are

5 STAR CLINIC LTD is the data controller responsible for the personal information described in this Privacy Notice.

Company: 5 STAR CLINIC LTD
Company number: 11544941
Registered office: 49 Garstang Road, Preston, PR1 1LB
Clinic address: Ground Floor, 49 Garstang Road, Preston, PR1 1LB
Telephone: 07537 824848
Privacy and data-protection enquiries: customercare@5starclinicltd.com

As data controller, we determine why and how personal information is processed.

Where another organisation independently determines why and how it processes information, that organisation may be a separate data controller and its own privacy information may also apply.

2. Scope of this Privacy Notice

This Privacy Notice applies to personal information processed by 5 STAR CLINIC LTD in connection with our healthcare, physiotherapy, wellbeing and related services and our general business operations.

It may apply to:

  • patients and service users;
  • prospective patients;
  • children and young people receiving services;
  • parents and guardians;
  • representatives and carers;
  • people making enquiries;
  • website visitors;
  • people creating accounts or making bookings;
  • people purchasing services or products;
  • people referred to us;
  • complainants;
  • emergency contacts;
  • people communicating with us;
  • people interacting with us through social media or messaging services;
  • people posting or corresponding with us concerning public reviews;
  • people whose information is involved in insurance or reimbursement matters;
  • medico-legal service users;
  • referrers;
  • professional contacts; and
  • other individuals whose personal information we lawfully process in connection with Clinic activities.

Information may be collected through our:

  • website;
  • booking systems;
  • practice-management systems;
  • telephone;
  • AI-assisted telephone systems;
  • SMS;
  • email;
  • web chat;
  • social-media or messaging services;
  • digital or paper forms;
  • appointments;
  • clinical consultations;
  • payment systems;
  • healthcare referrals;
  • insurers and reimbursement providers;
  • legal representatives;
  • publicly accessible sources; and
  • other lawful channels.

Separate privacy information may apply to employees, contractors and job applicants.

3. Definitions

Personal information / personal data

Any information relating to an identified or identifiable living individual.

Special category data

Personal information receiving additional legal protection under the UK GDPR, including information concerning:

  • health;
  • racial or ethnic origin;
  • religious or philosophical beliefs;
  • sex life or sexual orientation;
  • genetic information; and
  • certain biometric information used for identification.

Health data

Personal information relating to an individual’s physical or mental health, healthcare, treatment or health status.

Criminal-offence data

Personal information relating to criminal convictions, offences or related allegations or security measures where the relevant provisions of data-protection law apply.

Processing

Anything done with personal information, including:

  • collecting;
  • recording;
  • organising;
  • storing;
  • viewing;
  • accessing;
  • using;
  • analysing;
  • sharing;
  • altering;
  • retrieving;
  • restricting;
  • deleting; or
  • destroying it.

Data Protection Laws

The UK GDPR, Data Protection Act 2018, PECR and other applicable UK legislation governing privacy and personal information, as amended from time to time.

Website

www.5starclinicltd.com and relevant subdomains operated by or on behalf of 5 STAR CLINIC LTD.

Cookies and similar technologies

Cookies, pixels, tags and other technologies which store information on or access information from a user’s device.

4. Personal information we may collect

The information we collect depends upon your relationship with us and the services you use.

Identity and contact information

This may include:

  • name;
  • title;
  • date of birth;
  • postal address;
  • postcode;
  • telephone number;
  • email address; and
  • other identifying or contact information reasonably required for the relevant purpose.

Appointment and service information

This may include:

  • enquiries;
  • appointment dates and times;
  • booking history;
  • cancellations;
  • non-attendance;
  • attendance history;
  • services purchased;
  • treatment packages;
  • referrals;
  • service preferences; and
  • interaction history.

Health and clinical information

Where relevant to your care, we may process information including:

  • symptoms;
  • medical history;
  • injuries;
  • diagnoses;
  • medication;
  • previous treatment;
  • relevant lifestyle information;
  • examination findings;
  • clinical assessments;
  • treatment plans;
  • progress notes;
  • clinical correspondence;
  • consent records;
  • referrals;
  • clinical outcomes; and
  • other information reasonably necessary to provide safe and appropriate healthcare.

Financial and transaction information

This may include:

  • payments;
  • prices charged;
  • refunds;
  • outstanding balances;
  • invoices;
  • amended or superseded invoice versions;
  • receipts;
  • transaction references;
  • purchased services;
  • payment status; and
  • accounting information.

Where payment-card information is entered directly into an external payment processor’s system, we do not ordinarily receive or retain complete payment-card details.

Insurance, reimbursement and medico-legal information

Where applicable, this may include:

  • insurer or reimbursement-provider information;
  • membership details;
  • authorisation information;
  • claims or reimbursement documentation;
  • invoices;
  • referral information;
  • reports;
  • correspondence;
  • case-management information;
  • legal representatives; and
  • other authorised parties.

Communications

We may process or retain:

  • emails;
  • letters;
  • SMS messages;
  • telephone notes;
  • AI-assisted communications;
  • transcripts or summaries;
  • web-chat messages;
  • social-media or messaging communications;
  • complaint correspondence;
  • evidence supplied to us; and
  • other communications relevant to your relationship with the Clinic.

Publicly available information

Where reasonably relevant and lawful, we may process information which has been made publicly available.

This may include:

  • public reviews;
  • public comments;
  • a public display name or pseudonym;
  • public reviewer profiles;
  • public social-media content;
  • dates of publication;
  • public business or professional information; and
  • other relevant publicly accessible information.

The fact that an individual has publicly disclosed some information does not mean that we may disclose additional confidential information held by the Clinic.

Website and technical information

We may process:

  • IP address;
  • browser type;
  • device information;
  • operating system;
  • referring pages;
  • pages visited;
  • approximate usage information;
  • cookie identifiers; and
  • similar technical information.

Marketing information

This may include:

  • marketing preferences;
  • consent records;
  • opt-out records;
  • suppression records; and
  • engagement with communications where lawful.

CCTV information

Limited live-view internal CCTV information may be processed as described later in this Notice.

Legal, fraud and regulatory information

Where necessary, we may process information concerning:

  • complaints;
  • legal disputes;
  • suspected misuse of Clinic documentation;
  • suspected fraud or unlawful activity;
  • safeguarding concerns;
  • professional matters;
  • regulatory matters;
  • actual or potential legal proceedings;
  • insurer investigations; and
  • requests from courts or public authorities.

A concern, suspicion or investigation does not mean that wrongdoing has been established.

5. Information about other people

You may sometimes provide information about another individual, for example:

  • a parent;
  • guardian;
  • child;
  • representative;
  • next of kin;
  • emergency contact;
  • healthcare professional; or
  • other authorised person.

You should only provide information which is appropriate and reasonably necessary for the relevant purpose.

We will process such information only where reasonably necessary for the purpose for which it was supplied or otherwise permitted by law.

6. Where we obtain personal information

Most personal information is obtained directly from you.

We may also lawfully receive information from:

  • parents or guardians;
  • carers;
  • authorised representatives;
  • healthcare professionals;
  • GPs;
  • consultants;
  • referrers;
  • case managers;
  • solicitors;
  • insurers;
  • reimbursement providers;
  • employers where appropriate and lawful;
  • payment providers;
  • practice-management or booking providers;
  • communication providers;
  • AI service providers;
  • professional bodies;
  • regulators;
  • public authorities;
  • fraud-prevention or claims-integrity teams; and
  • publicly accessible sources.

Our systems may also automatically generate information relating to:

  • website use;
  • communications;
  • bookings;
  • payments;
  • system access;
  • security; and
  • account activity.

Where information is obtained from another source rather than directly from you, we provide privacy information where required by law and subject to applicable exemptions.

ICO guidance requires privacy information to cover categories and sources where information is obtained indirectly. ICO

7. Why we process personal information and our lawful bases

We only process personal information where there is an appropriate lawful basis.

Where health or other special-category information is involved, we also identify an appropriate additional condition under Article 9 UK GDPR and, where applicable, the Data Protection Act 2018.

Where criminal-offence data is processed, the additional legal requirements concerning criminal-offence information also apply.

Healthcare and physiotherapy

We process information to:

  • assess patients;
  • provide physiotherapy and related healthcare;
  • provide treatment;
  • monitor progress;
  • make clinical decisions;
  • communicate about care;
  • make appropriate referrals; and
  • maintain healthcare records.

Our Article 6 lawful basis may include:

  • performance of a contract;
  • steps requested before entering into a contract;
  • legal obligation; and/or
  • legitimate interests.

Health information is generally processed where necessary for healthcare or treatment under Article 9(2)(h) UK GDPR, together with applicable Data Protection Act 2018 healthcare conditions.

Appointment and practice administration

We process information to:

  • answer enquiries;
  • arrange appointments;
  • reschedule or cancel appointments;
  • provide reminders;
  • administer treatment packages;
  • maintain records; and
  • provide relevant service communications.

Relevant lawful bases may include:

  • steps before contract;
  • contract; and
  • legitimate interests in efficiently administering the Clinic.

Billing and payments

We process information to:

  • collect payment;
  • issue invoices;
  • issue receipts;
  • process refunds;
  • reconcile transactions;
  • administer accounts; and
  • comply with financial and tax obligations.

Relevant bases may include:

  • contract;
  • legal obligation; and
  • legitimate interests in appropriate financial administration.

Insurance and reimbursement

Where applicable, we process information to:

  • produce accurate reimbursement documentation;
  • verify services supplied;
  • verify amounts charged;
  • confirm authorised treatment;
  • communicate with relevant insurers or reimbursement providers; and
  • investigate discrepancies.

The applicable lawful basis depends upon the circumstances and may include:

  • contract;
  • legitimate interests;
  • recognised legitimate interests;
  • legal obligation; or
  • another appropriate legal basis.

Additional conditions are applied where health or criminal-offence information is involved.

Complaints

We may process information to:

  • receive complaints;
  • investigate complaints;
  • establish relevant facts;
  • review records;
  • provide outcomes;
  • respond to allegations;
  • improve service quality; and
  • protect our legal or professional position.

Relevant bases may include:

  • legal obligation; and
  • legitimate interests in investigating complaints, maintaining standards and protecting legal rights.

Public reviews

We may process information relating to public reviews where necessary to:

  • understand the complaint;
  • establish facts;
  • respond proportionately;
  • manage our reputation;
  • protect patients or the Clinic;
  • protect our legal rights; and
  • establish, exercise or defend legal claims.

We may rely on legitimate interests for this processing, subject to confidentiality and data-minimisation requirements.

Legal claims

We may process personal information where necessary to:

  • obtain legal advice;
  • preserve evidence;
  • investigate potential claims;
  • establish legal rights;
  • exercise legal rights;
  • defend legal rights;
  • respond to litigation; or
  • comply with legal process.

Where special-category information is necessary for legal claims, Article 9(2)(f) UK GDPR may apply.

Crime and fraud prevention

Where applicable, personal information may be processed where necessary for:

  • preventing crime;
  • detecting crime;
  • investigating crime;
  • investigating suspected fraud;
  • protecting individuals or organisations against fraud;
  • verifying Clinic documentation; and
  • identifying suspected unlawful use of documentation.

UK GDPR now contains a recognised legitimate interest covering processing necessary for detecting, investigating or preventing crime. Legislation.gov.uk

Additional statutory conditions apply where special-category or criminal-offence information is involved.

Safeguarding

Where necessary and lawful, information may be processed to:

  • safeguard a child;
  • safeguard an adult at risk;
  • prevent harm;
  • respond to safeguarding concerns; or
  • protect an individual’s physical or emotional wellbeing.

Safeguarding vulnerable individuals is also included within the current recognised-legitimate-interest framework where the statutory test is satisfied. Legislation.gov.uk

Security

Personal information may be processed for:

  • physical security;
  • information security;
  • preventing unauthorised access;
  • cybersecurity;
  • investigating incidents;
  • maintaining system integrity; and
  • creating security audit trails.

Marketing

Information may be processed for direct marketing where permitted by:

  • UK GDPR; and
  • PECR.

Depending on the communication, this may involve:

  • consent; or
  • legitimate interests where legally permitted.

Analytics and advertising

Non-essential:

  • analytics;
  • advertising;
  • tracking; and
  • remarketing technologies

are only used where the required consent has been obtained.

AI-assisted communications

AI-assisted processing uses the lawful basis applicable to the underlying activity.

For example:

  • appointment booking may involve contract or steps before contract;
  • administrative communications may involve legitimate interests or contract;
  • healthcare-related processing may require an additional Article 9 condition; and
  • marketing remains subject to PECR.

CCTV

Internal live-view CCTV is operated on the basis of our legitimate interests in:

  • safety;
  • security;
  • protecting patients;
  • protecting staff;
  • protecting visitors; and
  • protecting Clinic property.

8. Legitimate interests

Where we rely upon Article 6(1)(f) legitimate interests, those interests may include:

  • operating and administering the Clinic;
  • providing effective patient administration;
  • communicating with patients;
  • maintaining accurate records;
  • investigating complaints;
  • ensuring service quality;
  • protecting patients and staff;
  • ensuring security;
  • preventing misuse;
  • recovering legitimate debts;
  • protecting our reputation;
  • responding proportionately to public allegations;
  • preventing fraud;
  • maintaining the integrity of Clinic documents;
  • obtaining professional advice; and
  • establishing, exercising or defending legal rights.

Where appropriate, we assess whether:

  1. there is a legitimate purpose;
  2. the processing is necessary for that purpose; and
  3. the individual’s interests, rights and freedoms override that interest.

Legitimate-interest assessments are documented where appropriate.

9. Recognised legitimate interests

UK data-protection law also contains certain recognised legitimate interests.

Where applicable to our activities, these may include processing necessary for:

  • detecting, investigating or preventing crime; and
  • safeguarding vulnerable individuals.

We only rely on a recognised legitimate interest where the statutory requirements are satisfied.

The fact that processing falls within a recognised legitimate-interest category does not remove other legal obligations, including:

  • data minimisation;
  • fairness;
  • transparency;
  • confidentiality;
  • special-category-data requirements; and
  • criminal-offence-data requirements.

10. Clinical consent and data-protection consent are different

Consent to clinical examination or treatment is not the same thing as consent under data-protection law.

Clinical consent relates to whether you agree to receive an examination, treatment or another healthcare intervention.

A data-protection lawful basis concerns whether and why personal information may be processed.

We do not rely upon data-protection consent for every aspect of clinical record processing.

For example, we may need or be legally entitled to retain a clinical record even where a patient:

  • withdraws clinical consent;
  • no longer attends the Clinic; or
  • asks for the record to be deleted.

Where we rely specifically on data-protection consent for an optional use, you may withdraw that consent.

Withdrawal does not affect:

  • processing lawfully undertaken before withdrawal; or
  • processing which continues under another lawful basis.

11. Health and other special-category information

Health information receives additional protection under UK data-protection law.

Where necessary for healthcare, we generally process health information in accordance with:

Article 9(2)(h) UK GDPR, and applicable provisions of the Data Protection Act 2018 concerning healthcare and treatment.

Other Article 9 conditions may apply in particular circumstances.

For example:

  • Article 9(2)(a) — explicit consent, where appropriate;
  • Article 9(2)(f) — establishment, exercise or defence of legal claims;
  • other statutory conditions where applicable.

Our clinicians and appropriate staff are subject to professional, contractual and/or legal confidentiality obligations.

12. Referrals and healthcare coordination

Where appropriate to your care and lawful, we may communicate with other healthcare professionals or healthcare services.

This may include:

  • GPs;
  • consultants;
  • specialists;
  • physiotherapists;
  • other healthcare providers; and
  • authorised referrers.

Information may include:

  • referral letters;
  • relevant clinical findings;
  • treatment information;
  • reports; and
  • other information reasonably necessary to coordinate healthcare.

Information is only shared where there is an appropriate lawful basis and relevant confidentiality requirements are satisfied.

13. Clinical photographs, video and other clinical media

Where clinically appropriate, we may create:

  • photographs;
  • video;
  • movement recordings;
  • measurements;
  • diagrams; or
  • other media

for purposes such as:

  • clinical assessment;
  • documenting presentation;
  • treatment;
  • monitoring progress; and
  • maintaining appropriate clinical records.

Where such information forms part of healthcare provision, it is treated as confidential clinical information.

We will not use identifiable clinical photographs, videos or patient material for:

  • advertising;
  • promotional campaigns;
  • social-media marketing;
  • testimonials; or
  • other unrelated promotional purposes

merely because it was originally collected for healthcare.

Where separate consent is required for an optional promotional use, that consent will be obtained separately.

14. Clinical governance, quality assurance and professional development

We may process information where reasonably necessary for:

  • clinical governance;
  • service-quality monitoring;
  • internal audit;
  • complaint learning;
  • staff supervision;
  • professional development;
  • internal training;
  • patient-safety improvement; and
  • service improvement.

Where reasonably possible, information used for these purposes will be:

  • anonymised;
  • pseudonymised; or
  • minimised.

Identifiable health information will only be used where there is an appropriate lawful basis and the use is necessary and proportionate.

15. Complaints and dispute management

We may process information where necessary to receive, investigate and respond to a complaint or dispute.

This may include reviewing:

  • appointment records;
  • clinical records;
  • consent records;
  • correspondence;
  • invoices;
  • payment information;
  • communication logs; and
  • other relevant evidence.

Access will be limited to persons who reasonably require the information to manage the matter.

Where a complaint develops into:

  • legal proceedings;
  • an insurer matter;
  • a regulatory matter;
  • a professional matter; or
  • another formal dispute,

relevant information may be retained and processed for legal, regulatory or evidential purposes.

16. Public reviews and reputation management

Where a person publishes a review or public statement about the Clinic, we may process:

  • the public review;
  • the publicly available profile information associated with it; and
  • relevant information held in Clinic records

where reasonably necessary to:

  • understand the issue;
  • investigate factual allegations;
  • establish relevant facts;
  • manage the complaint;
  • respond proportionately;
  • protect the Clinic’s legitimate reputation; and
  • establish, exercise or defend legal rights.

Where we respond publicly, we seek to use the minimum personal information reasonably necessary.

We will not use a public review platform simply as an opportunity to disclose confidential healthcare information.

Where possible, we will avoid publishing unnecessary:

  • diagnoses;
  • detailed treatment information;
  • clinical records;
  • actual appointment information;
  • actual financial information;
  • insurer details;
  • policy details;
  • reimbursement details;
  • claim information; or
  • other confidential personal information.

We may use generalised or hypothetical examples where appropriate to explain Clinic practices without unnecessarily disclosing an individual’s private circumstances.

More detailed matters may instead be handled through confidential channels.

A person’s decision to publish some information publicly does not remove our confidentiality obligations in relation to other information held by the Clinic.

17. Fraud prevention and verification of Clinic documentation

We have a legitimate interest in protecting:

  • patients;
  • insurers;
  • reimbursement providers;
  • other organisations; and
  • the Clinic

from:

  • fraud;
  • misuse of Clinic documentation;
  • false or inaccurate claims;
  • duplicate use of documentation;
  • unauthorised alteration of documentation; and
  • other unlawful activity.

Where we have an objective and documented reason to verify whether:

  • an invoice;
  • receipt;
  • report;
  • referral letter;
  • certificate; or
  • other Clinic document

has been used appropriately, we may undertake proportionate verification.

Where necessary and lawful, this may involve communication with:

  • an appropriate insurer;
  • reimbursement provider;
  • authorised claims representative;
  • claims-integrity team;
  • fraud-prevention function;
  • professional adviser;
  • regulator;
  • law-enforcement body; or
  • other relevant authorised organisation.

We do not undertake indiscriminate or unjustified enquiries.

We seek to process and disclose only the minimum information necessary for the relevant verification.

Where appropriate, we may initially disclose limited identifying information and provide additional information only if:

  • the recipient is confirmed as relevant;
  • further information is necessary; and
  • there is an appropriate lawful basis.

Where suspected unlawful activity involves health information or criminal-offence information, additional UK GDPR and Data Protection Act 2018 requirements apply.

A concern, verification exercise or suspicion does not constitute a finding that an individual has committed fraud or another offence.

18. AI-assisted communications and administration

We use AI-enabled and automated technologies to assist with administrative and communication activities.

These may include:

  • answering telephone calls;
  • responding to routine enquiries;
  • web chat;
  • SMS;
  • email communications;
  • providing booking links;
  • arranging appointments;
  • rescheduling appointments;
  • cancelling appointments;
  • sending appointment reminders;
  • responding to common service questions;
  • routing communications;
  • extracting administrative information from communications; and
  • creating administrative summaries.

Depending upon the interaction, an AI-assisted system may process:

  • your name;
  • telephone number;
  • email address;
  • enquiry;
  • appointment information;
  • booking preferences;
  • service requirements;
  • information you provide during the interaction; and
  • the content of communications.

Voice processing and transcription

An AI-assisted telephone system may electronically process spoken information, including converting speech into text or producing a summary so that the system can understand and respond to the interaction.

This may occur without the audio of the call being retained as a recording.

Text, transcripts, summaries or resulting administrative records created through AI-assisted processing are personal information where they relate to an identifiable person.

They are processed and retained only where reasonably necessary for the relevant purpose.

Call recording

Where the audio of a telephone call is recorded and retained, appropriate notice will be provided at or before the recording begins.

If audio is not recorded and retained, we will not describe the call as being recorded merely because speech is electronically processed or transcribed by an AI-assisted system.

This Privacy Notice explains our use of AI-assisted transcription and processing.

Where reasonably appropriate, callers may also be directed to this Privacy Notice for further information.

Formal records

Where information generated through an AI-assisted communication becomes relevant to:

  • an appointment;
  • patient administration;
  • a clinical record;
  • financial administration;
  • a complaint;
  • safeguarding;
  • fraud investigation;
  • or a legal matter,

the relevant information may be incorporated into the corresponding Clinic record.

Human involvement

AI-assisted communication systems support administrative processes.

They are not a substitute for professional clinical judgement.

AI systems do not independently:

  • diagnose medical conditions;
  • prescribe clinical treatment; or
  • make autonomous clinical decisions.

Where practicable, a person may request communication with a member of staff rather than continuing an AI-assisted interaction.

Automated decision-making

We do not currently use solely automated processing to make decisions about clinical treatment or access to healthcare services which produce legal or similarly significant effects without meaningful human involvement.

If that changes, we will update our privacy information and implement the safeguards required by law.

ICO guidance requires organisations to be transparent about the purposes for which AI uses personal information and about significant automated decision-making where applicable. ICO

AI and communications suppliers

We may use specialist providers for:

  • AI technology;
  • telephony;
  • SMS;
  • messaging;
  • email;
  • transcription;
  • hosting;
  • communications infrastructure; and
  • associated technical services.

Where such providers act as processors on our behalf, we require appropriate contractual and data-protection safeguards.

Where a provider acts independently as a controller for a particular activity, its own privacy information may also apply.

We do not use identifiable clinical health information for behavioural advertising.

Where an AI or communications provider processes information outside the United Kingdom, the international-transfer provisions in this Notice apply.

19. Social media and messaging platforms

We may operate accounts or communicate through:

  • social-media platforms;
  • messaging services;
  • online review platforms; and
  • other third-party communication services.

If you communicate with us using a third-party platform, that provider may independently process information under its own terms and privacy notice.

We may retain relevant communications where necessary for:

  • enquiries;
  • bookings;
  • appointments;
  • customer service;
  • complaints;
  • clinical administration;
  • financial administration;
  • fraud prevention;
  • legal matters; or
  • another legitimate Clinic purpose.

Where appropriate, relevant information may be transferred into our formal Clinic records.

We recommend that detailed or sensitive medical information is not posted publicly or sent through public comments.

Where appropriate, we may ask you to continue a sensitive conversation using a private or more secure communication channel.

20. CCTV and premises monitoring

Internal Clinic CCTV

We operate limited CCTV inside the Clinic for:

  • safety;
  • security;
  • protection of patients;
  • protection of staff and visitors; and
  • protection of Clinic property.

The Clinic’s internal CCTV is live-view only. It is not configured to record or retain CCTV footage.

No retained Clinic CCTV recording is therefore created by the internal system.

Live viewing may nevertheless involve processing personal information where identifiable individuals are visible.

Access to the live CCTV system is restricted to authorised persons and is only used for legitimate security and safety purposes.

Appropriate signage should be displayed within the premises.

ICO guidance confirms that organisations using surveillance systems must provide appropriate transparency, generally including visible signage identifying the system’s purpose and controller/contact information. ICO

External CCTV

External CCTV covering areas outside the Clinic premises is operated and controlled by the landlord or relevant building operator, rather than by 5 STAR CLINIC LTD, where that landlord determines why and how the cameras operate.

The landlord or building operator is responsible for its own:

  • lawful basis;
  • privacy information;
  • CCTV signage;
  • recordings;
  • security;
  • access arrangements;
  • retention; and
  • disclosure arrangements.

Questions specifically concerning external CCTV should therefore be directed to the controller identified on the relevant signage or building information.

If the Clinic lawfully receives particular external CCTV footage in connection with an incident, we will process that information only where there is an appropriate lawful basis, for example:

  • security;
  • investigation of an incident;
  • crime prevention; or
  • establishment, exercise or defence of legal claims.

21. Safeguarding, emergencies and serious harm

In appropriate circumstances, we may use or disclose personal information where necessary and lawful to:

  • safeguard a child;
  • safeguard an adult at risk;
  • prevent serious harm;
  • respond to an emergency;
  • protect vital interests;
  • prevent or investigate crime;
  • comply with a court order;
  • comply with another legal obligation; or
  • comply with an overriding professional or public-interest duty.

Any decision is considered on its particular circumstances.

We seek to disclose no more information than is reasonably necessary for the relevant purpose.

22. Payment processing

We may use external payment processors.

Where card details are entered directly into a payment provider’s system, that provider processes the payment information under its own security and privacy arrangements.

5 STAR CLINIC LTD does not ordinarily store complete payment-card numbers.

We may retain information required for legitimate accounting and transaction purposes, including:

  • amount;
  • transaction date;
  • payment status;
  • transaction reference;
  • refund information; and
  • limited payment-method information.

23. Who we may share personal information with

Where necessary and lawful, information may be shared with categories of recipients including:

  • Clinic clinicians;
  • authorised staff;
  • authorised contractors;
  • practice-management providers;
  • booking providers;
  • cloud providers;
  • IT providers;
  • cybersecurity providers;
  • telephone providers;
  • SMS providers;
  • email providers;
  • messaging providers;
  • AI and transcription providers;
  • payment processors;
  • accountants;
  • auditors;
  • solicitors;
  • professional advisers;
  • insurers;
  • professional-indemnity providers;
  • GPs;
  • consultants;
  • other healthcare providers;
  • referrers;
  • reimbursement providers;
  • case managers;
  • authorised medico-legal parties;
  • regulators;
  • professional bodies;
  • safeguarding authorities;
  • courts;
  • tribunals;
  • law-enforcement bodies;
  • fraud-prevention and claims-integrity functions; and
  • prospective purchasers or advisers involved in a genuine business transaction.

Where a supplier acts as our processor, appropriate data-protection arrangements are required.

Some recipients may act as independent controllers and their own privacy information may apply.

We do not sell patient personal information.

We do not provide identifiable clinical health information to advertising organisations for targeting advertising according to a person’s medical condition.

24. Direct marketing

Clinical consent, signing a treatment form, enquiring about treatment, booking an appointment or receiving a service does not by itself constitute blanket consent to receive electronic marketing.

We may send marketing where:

  • valid consent has been given; or
  • another legally permitted basis applies, including the PECR soft opt-in where all statutory requirements are satisfied.

Where the soft opt-in applies, this includes circumstances where:

  • we obtained the contact details directly;
  • they were obtained during a sale or negotiation for sale;
  • the marketing concerns our own similar products or services;
  • an opt-out was offered when the information was obtained; and
  • each subsequent marketing message contains an easy opt-out.

You may opt out of direct marketing at any time.

We may retain limited suppression information after an opt-out so that we can continue to respect that preference.

An opt-out from marketing does not prevent necessary non-marketing communications such as:

  • appointment reminders;
  • clinical communications;
  • invoices;
  • safety notices;
  • complaint communications; or
  • other service-related messages.

25. Analytics, advertising and profiling

Subject to the required consent and applicable legal requirements, we may use website technologies to:

  • understand website use;
  • improve website functionality;
  • measure advertising performance;
  • measure campaigns;
  • create advertising audiences; and
  • display relevant advertising.

We may use limited marketing segmentation or profiling to tailor marketing activity.

You have an absolute right to object to direct marketing, including related profiling.

We do not use clinical health records to create behavioural advertising profiles.

26. Cookies and similar technologies

Our website uses cookies and similar technologies.

Some are strictly necessary for:

  • website security;
  • network communication;
  • session functions;
  • user-requested services; or
  • essential site functionality.

Where the PECR strictly-necessary exemption applies, consent is not required.

Non-essential technologies such as:

  • analytics;
  • advertising;
  • remarketing; and
  • tracking technologies

are activated only where the required consent has been obtained.

Our cookie controls allow visitors to manage relevant preferences.

Consent can be withdrawn or changed using the available cookie-preference controls.

Information about individual:

  • cookies;
  • providers;
  • purposes; and
  • durations

should be provided through the Clinic’s separate Cookie Policy / Cookie Declaration.

27. Children and young people

Our general website advertising is not specifically directed at children.

We may, however, provide healthcare services to children and young people.

When processing children’s information we take particular care regarding:

  • confidentiality;
  • transparency;
  • security;
  • parental or guardian involvement; and
  • the young person’s own rights.

Parents or guardians will be involved where appropriate, taking account of:

  • age;
  • competence;
  • capacity;
  • circumstances;
  • confidentiality rights;
  • professional standards; and
  • applicable law.

Where a young person is sufficiently competent to understand the relevant matter, they may have rights in respect of their own healthcare information and confidentiality.

We do not use children’s clinical health information for behavioural advertising.

28. International transfers

Some service providers may process personal information outside the United Kingdom.

This may include providers of:

  • cloud services;
  • website infrastructure;
  • email;
  • communications;
  • AI;
  • telephony;
  • analytics;
  • advertising;
  • payments; or
  • other technical services.

Where processing involves a restricted international transfer, we use an appropriate legal mechanism.

This may include:

  • applicable UK adequacy regulations;
  • the UK International Data Transfer Agreement;
  • a UK Addendum to approved Standard Contractual Clauses; or
  • another legally permitted transfer mechanism.

Where required, we consider relevant transfer risks and supplementary protections.

You may contact us for further information regarding relevant transfer safeguards.

29. Data retention

We retain personal information only for as long as reasonably necessary for the purposes for which it is held and in accordance with applicable:

  • UK data-protection law;
  • healthcare-record requirements;
  • professional guidance;
  • clinical requirements;
  • company law;
  • taxation requirements;
  • accounting obligations;
  • insurance requirements;
  • limitation periods;
  • complaint requirements;
  • safeguarding requirements;
  • regulatory requirements; and
  • legal-claims requirements.

The UK GDPR does not impose one universal retention period. We are required to be able to justify why information remains necessary and to delete or anonymise information when it is no longer needed. ICO

We maintain and periodically review retention arrangements for different categories of information.

Clinical and physiotherapy records

Clinical and physiotherapy records are retained in accordance with applicable healthcare-record requirements and relevant professional guidance.

Current professional physiotherapy guidance generally identifies:

  • adult records — eight years from the date of last treatment; and
  • children’s records — longer retention, generally until at least age 25 in accordance with applicable professional healthcare-record guidance.

Different or longer periods may apply where circumstances require, including:

  • treatment of children and young people;
  • safeguarding;
  • serious or long-term conditions;
  • mental-capacity considerations;
  • legal proceedings;
  • professional complaints;
  • regulatory investigations;
  • ongoing insurance matters;
  • legal holds;
  • medico-legal cases; or
  • other clinical or legal reasons.

Current CSP guidance states that retention schedules vary and generally identifies eight years after last treatment for adult records and longer retention for children’s records. CSP Case Studies

At the end of the relevant period, records will be:

  • reviewed;
  • securely destroyed; or
  • anonymised,

unless continued identifiable retention remains justified.

Financial, tax and accounting records

Financial and accounting records are retained for the period required by applicable:

  • taxation legislation;
  • company law;
  • accounting requirements;
  • audit requirements; and
  • legitimate legal purposes.

Complaints and disputes

Complaint and dispute information may be retained for as long as reasonably necessary to:

  • investigate the matter;
  • communicate the outcome;
  • demonstrate appropriate handling;
  • meet regulatory requirements; and
  • address any reasonably anticipated legal claim.

Public-review disputes

Where a public review gives rise to:

  • a formal complaint;
  • evidence preservation;
  • legal correspondence;
  • platform proceedings; or
  • litigation,

the relevant review, response and supporting evidence may be retained for as long as reasonably necessary for evidential or legal purposes.

Legal proceedings and litigation holds

Where litigation, regulatory proceedings or another formal dispute is reasonably contemplated, routine deletion of relevant information may be suspended.

Relevant information may then be preserved until the legal or evidential requirement has concluded.

Fraud and document-verification records

Records concerning suspected fraud, claims verification or misuse of Clinic documentation are retained only for as long as reasonably necessary for:

  • the investigation;
  • related insurer enquiries;
  • regulator involvement;
  • law-enforcement processes;
  • complaints;
  • legal claims;
  • evidential requirements; or
  • another lawful purpose.

AI communications

AI-generated:

  • transcripts;
  • summaries;
  • administrative notes;
  • messages; and
  • other AI-assisted records

are retained only as long as necessary for the purpose for which they are used.

Where an AI-generated record becomes part of a:

  • clinical record;
  • appointment record;
  • financial record;
  • complaint file;
  • safeguarding record;
  • fraud investigation; or
  • legal file,

the retention period applicable to that underlying record will apply.

Telephone audio recordings

Where the audio of a telephone call is recorded, it will be retained only for as long as reasonably necessary for the purpose for which the recording was made.

If it becomes relevant to:

  • patient care;
  • a complaint;
  • safeguarding;
  • a dispute;
  • investigation; or
  • legal proceedings,

it may be retained for longer where justified.

CCTV

The Clinic’s internal CCTV does not create retained recordings.

Accordingly, there is no Clinic retention period for internal CCTV recordings.

External CCTV operated by the landlord is subject to the landlord’s own retention arrangements.

Marketing records

Marketing information is retained only while it remains necessary and lawful.

A limited suppression record may be retained following an opt-out in order to ensure that the opt-out continues to be respected.

Website and cookies

Relevant retention periods are specified in the Cookie Policy / Cookie Declaration.

General communications

Emails, SMS messages, letters, social-media communications and other correspondence are retained according to their purpose.

Where correspondence forms part of:

  • a clinical record;
  • financial record;
  • complaint file;
  • safeguarding file;
  • fraud file;
  • legal file; or
  • other formal business record,

the retention rules for that underlying record apply.

Backups

Deleted information may remain temporarily within secure backups until the relevant backup cycle expires.

Backup systems are not used to retain information indefinitely where there is no longer a lawful need for it.

30. Information security

We use appropriate technical and organisational measures designed to protect personal information from:

  • unauthorised access;
  • accidental loss;
  • unlawful disclosure;
  • destruction;
  • alteration;
  • misuse; and
  • other security risks.

Depending upon the circumstances, measures may include:

  • password protection;
  • authentication controls;
  • role-based access;
  • restricted permissions;
  • encryption;
  • secure systems;
  • secure communications;
  • backups;
  • cybersecurity protections;
  • confidentiality obligations;
  • processor contracts;
  • staff training;
  • supplier due diligence;
  • incident procedures; and
  • restricted access to sensitive information.

Patient and sensitive information is accessible only to persons who reasonably require it for their role.

No information system can be guaranteed to be entirely risk-free.

We therefore review security measures having regard to:

  • the nature of the information;
  • its sensitivity; and
  • the risks associated with the processing.

31. Personal-data breaches

We maintain procedures for:

  • identifying;
  • containing;
  • investigating;
  • assessing;
  • documenting; and
  • responding to

personal-data breaches.

Where required by law, we will notify:

  • the Information Commissioner’s Office; and/or
  • affected individuals.

We maintain appropriate records of personal-data breaches and the decisions made in relation to them.

32. Your data-protection rights

Depending upon the circumstances and lawful basis, you may have the following rights.

Right to be informed

You have the right to receive clear information about how your personal information is processed.

This Privacy Notice forms part of that information.

Right of access

You may ask whether we hold personal information about you and request access to information to which you are legally entitled.

Right to rectification

You may request correction of inaccurate information or completion of materially incomplete information.

Clinical record-keeping requirements may require us to preserve the original contemporaneous entry and record a later correction or clarification rather than simply deleting the original.

Right to erasure

You may request deletion where the right applies.

The right to erasure is not absolute.

Information may need to be retained for reasons including:

  • healthcare-record requirements;
  • legal obligations;
  • professional obligations;
  • taxation;
  • accounting;
  • fraud prevention;
  • safeguarding;
  • regulatory requirements; or
  • legal claims.

Right to restriction

You may request restriction of processing where the relevant statutory conditions are satisfied.

Right to data portability

Where the statutory requirements are satisfied, you may be entitled to receive certain information you provided to us in a:

  • structured;
  • commonly used; and
  • machine-readable

format, or request that it be transmitted to another controller where technically feasible.

Right to withdraw consent

Where processing is based on consent, you may withdraw your consent.

Withdrawal does not affect processing which occurred lawfully before withdrawal.

Rights concerning automated processing

Where statutory protections concerning automated decision-making apply, you may have rights including:

  • receiving appropriate information;
  • obtaining meaningful human involvement;
  • expressing your point of view; and
  • challenging a decision.

We do not currently use solely automated systems to make significant clinical or healthcare-access decisions without meaningful human involvement.

33. IMPORTANT — YOUR RIGHT TO OBJECT

You have the right to object to certain processing of your personal information.

Where we rely upon:

  • legitimate interests; or
  • a recognised legitimate interest,

you may object to the processing where applicable.

We will consider your objection in accordance with the legal test which applies to the particular processing.

You have an absolute right to object at any time to the use of your personal information for direct marketing, including profiling related to direct marketing.

To object, contact:

customercare@5starclinicltd.com

The ICO specifically requires the right to object to be brought to people’s attention clearly and separately from other privacy information. ICO

34. Exercising your rights

To exercise a data-protection right, contact:

customercare@5starclinicltd.com

We may need to obtain sufficient information to:

  • confirm your identity;
  • locate the relevant information; and
  • protect personal information from unauthorised disclosure.

We respond within the applicable statutory timeframe, normally one month, subject to lawful extensions, exemptions or other provisions.

Not every right applies in every circumstance.

35. Data-protection complaints

If you believe 5 STAR CLINIC LTD has infringed data-protection law in its handling of your personal information, you may make a data-protection complaint to us.

Email

customercare@5starclinicltd.com

Post

5 STAR CLINIC LTD
Ground Floor
49 Garstang Road
Preston
PR1 1LB

We will:

  • provide an accessible method for making a complaint;
  • acknowledge a data-protection complaint within 30 days;
  • investigate the complaint appropriately and without undue delay;
  • keep you appropriately informed of progress; and
  • communicate the outcome without undue delay.

The statutory complaints requirements applying to organisations handling personal data came into force in 2026. ICO

You also have the right to complain to the:

Information Commissioner’s Office (ICO)

Website: ico.org.uk

Telephone: 0303 123 1113

The ICO is the UK’s independent data-protection regulator.

36. Is providing personal information mandatory?

Certain personal information is necessary for us to:

  • assess whether we can provide treatment;
  • provide safe healthcare;
  • make a booking;
  • administer an appointment;
  • provide a requested service;
  • create accurate clinical records;
  • process payment;
  • issue accurate invoices;
  • satisfy insurance or reimbursement requirements; or
  • comply with legal or professional obligations.

If information reasonably required for those purposes is not provided, we may be unable to:

  • accept an appointment;
  • provide some or all of the requested treatment;
  • produce requested documentation; or
  • provide another requested service.

Information requested solely for optional purposes, such as consent-based marketing, does not have to be provided as a condition of treatment unless it is independently required for another lawful purpose.

37. Third-party websites and services

Our website or communications may contain links to services operated by other organisations.

Those organisations may independently process personal information under their own privacy policies.

We are not responsible for independent third-party privacy practices merely because our website links to another service.

Where another organisation processes personal information on our behalf as our processor, appropriate contractual and data-protection requirements apply.

38. Changes of ownership or business structure

If all or part of 5 STAR CLINIC LTD is:

  • sold;
  • reorganised;
  • merged;
  • transferred; or
  • involved in another genuine business transaction,

relevant personal information may be disclosed to:

  • appropriate professional advisers;
  • prospective purchasers;
  • financiers; and
  • successor organisations

where necessary and lawful.

Appropriate confidentiality and data-protection safeguards will apply.

Any successor controller remains subject to applicable data-protection law.

39. Changes to this Privacy Notice

We may update this Privacy Notice where:

  • our services change;
  • our systems change;
  • our processing activities change;
  • our service providers change;
  • legislation changes;
  • regulatory guidance changes; or
  • we identify that further transparency is appropriate.

The latest version will be published on our website with its most recent update date.

Where a material change affects how we use personal information and the law requires additional notice to an individual, we will take appropriate steps to provide it.

We will not treat continued use of our services as blanket consent to new processing where:

  • consent is required; or
  • another specific lawful basis must be established.

ICO guidance requires privacy information to be reviewed and updated and new uses to be brought to people’s attention before the new processing begins. ICO

40. Contact us

For:

  • privacy enquiries;
  • data-protection complaints;
  • objections;
  • access requests;
  • rectification requests;
  • deletion requests;
  • restriction requests;
  • marketing opt-outs; or
  • other information-rights enquiries,

please contact:

5 STAR CLINIC LTD
Ground Floor
49 Garstang Road
Preston
PR1 1LB

Email: customercare@5starclinicltd.com
Telephone: 07537 824848
Company number: 11544941