Privacy Policy

This Privacy Policy explains how The Surgical Consortium Ltd, trading as The Skin Cancer Institute ("we", "us", "our"), collects, uses, stores and protects personal data when you use our website or contact us.

We are committed to protecting your privacy and handling your personal data transparently and securely.

We may collect and process the following types of personal data:

Some of our services ask you to send us clinical information before we can help. When you make a surgical enquiry through our contact form, we ask you to attach at least one of:

• a referral letter or dermatology report;
• a photograph of the mole, lesion or area you are concerned about;
• a previous histology or pathology report.

You may attach the same documents voluntarily with any other kind of enquiry, and you may include health information in your message. This is health data — “special category data” under UK data protection law — and we treat it accordingly.

Why we ask for it. We cannot tell you whether a lesion should be removed, what the procedure would involve or what it would cost without seeing something first. Asking at the point of enquiry means we can direct you to the right appointment, rather than booking you into one that turns out not to be the one you needed.

What we do with it. Your enquiry and anything attached to it goes into our clinical record system. It is seen by the clinical and administrative team handling your enquiry and by the clinician who assesses it. If you go on to become a patient, it forms part of your clinical record. We do not use it for marketing, and no automated decision is made about you on the basis of it.

Our lawful basis. We process this information under Article 6(1)(b) of the UK GDPR — steps taken at your request before entering into a contract — and, because it is health data, under Article 9(2)(h), the provision of health care and medical diagnosis, together with paragraph 2 of Schedule 1 to the Data Protection Act 2018. Our clinicians are bound by a professional duty of confidentiality.

We do not rely on your consent for this, and that is deliberate. Consent must be as easy to withdraw as it is to give, which would not be a sound footing for information that becomes part of a clinical record we are required to keep. You stay in control in a more practical way: you decide whether to send a document at all, and you can ask us to stop dealing with your enquiry at any time.

Before you attach anything. Please send only what is relevant. A photograph needs to show the area you are concerned about; there is no need to include your face or anything else that identifies you unless the lesion is there. Please do not send anything you would not want kept on file.

Large photographs are resized on your device. If an image is bigger than our upload limit, your browser reduces it before anything is sent, so that the upload completes. This happens on your own device and the reduced image is the one that reaches us.

How long we keep it. If you become a patient, these documents form part of your clinical record and are kept for the period set out in section 9. If you do not, we keep your enquiry and its attachments for 12 months and then delete them.

If you change your mind. You can ask us to delete something you have sent. We will do so, unless it has become part of a clinical record we are legally required to keep, in which case we will tell you why. Write to us at siro@thesurgicalconsortium.com.

We use personal data to:

• Respond to enquiries and contact requests
• Provide information about our services
• Manage website performance and security
• Comply with legal and regulatory obligations

We do not use your data for automated decision-making or profiling.

We process personal data under the following lawful bases:

• Contract, and steps before a contract – Article 6(1)(b) — assessing your enquiry, arranging your appointment and providing your care
• Health and social care purposes – Article 9(2)(h) UK GDPR and Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018 — any health information you send us, including photographs, referral letters and reports
• Legitimate interests – Article 6(1)(f) — running and securing our website, and responding to general enquiries that are not about your care
• Legal obligation – Article 6(1)(c) — where the law or our regulators require us to hold or disclose information
• Consent – Article 6(1)(a) — optional cookies and any marketing you have asked to receive. You can withdraw this at any time

We do not sell your personal data.

We may share data with:

• IT and website service providers (acting as data processors)
• Professional advisers where required
• Regulatory or legal authorities if legally obliged

All third parties are required to handle data securely and lawfully.

Some of the organisations that process data on our behalf are based outside the United Kingdom, mainly in the United States and the European Economic Area. Where we transfer personal data outside the UK, we do so only where the law allows it: under UK adequacy regulations where they apply — including the UK Extension to the EU–US Data Privacy Framework, where a provider is certified under it — and otherwise under the International Data Transfer Addendum to the European Commission’s standard contractual clauses, issued by the Information Commissioner.

You can ask us which providers process your information and on what basis, by writing to siro@thesurgicalconsortium.com.

We take appropriate technical and organisational measures to protect personal data, including:

• Secure systems and access controls
• Limited access on a need-to-know basis
• Regular review of data handling practices

We retain personal data only for as long as necessary:

• Clinical records, including documents you send us, are kept for 8 years after the last entry in the record
• Enquiries that do not lead to an appointment, and anything attached to them, are kept for 12 months and then deleted
• Information we are required to keep for legal, regulatory or insurance reasons is kept for as long as those requirements apply
• Website analytics data is kept as described in our Cookie Policy

Under UK data protection law, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure of data (where applicable)
• Object to or restrict processing
• Lodge a complaint with the Information Commissioner's Office (ICO)

ICO website: www.ico.org.uk

Our use of cookies is explained in our Cookie Policy, which forms part of this Privacy Policy.

We may update this Privacy Policy from time to time. Any changes will be published on this page.