Privacy Notice

 

Introduction

HealthLink360 is an Independent Health Clinic and recognises the importance of protecting personal and confidential information.  In all that we do we are committed to meeting our legal responsibilities regarding data protection and to working within the framework of our professional codes of conduct.

 

HealthLink360 is a Data Controller for the purposes of the Data Protection Act 2018.

 

This Privacy Notice sets out details of the information that HealthLink360 may collect from you and how that information may be used. It outlines:

·        how we will manage your personal data

·        how we use your information

·        your rights in respect of your personal information, and how to exercise them.

 

Information We Collect

We only collect information for the lawful basis of administering the services of HealthLink360. As a HealthLink360 client, this information will include:

·        Your name, address and contact details

·        Your date of birth

·        Financial information, such as bank information when you pay us

·        Occupation information, as relevant to the service you are accessing

Background referral details.

 

This information will usually come directly from you, but may also come from your sending agency or employer.

 

In order to deliver our service to you, we also collect and use more sensitive personal data. The special category personal data may include:

  • Information about your current physical or mental health and your health history.

  • Details of HealthLink360 services you have received

  • Details of your nationality, race and/or ethnicity

  • Details of your religion

  • Details of any genetic data or biometric data relating to you

  • Data concerning your sex life and/or sexual orientation

This information will be used by our clinical staff in order to give best advice and care.

 

We collect your personal data from the following places:

·        Directly from you. We may collect personal data directly from you when you:

    • Approach us to access one of our services

    • Access one of our services

    • Have consultations with one of our clinicians, where in-person, by telephone or online.

    • Complete an enquiry form on our website

    • Send us a question or correspond with us including through our website, by email or by social media

·        From other healthcare providers. Depending on the service that you access, we collect personal data about you from other organisations. This may include medical records from:

    • Your GP

    • Another healthcare professional that you have consulted

    • The NHS or any private healthcare organisation

    • Mental health providers

Medical records include personal data about your tests and diagnosis, clinic and hospital visits and medicines administered. You may provide these to us yourself, or we may ask for your consent to access your medical records.

·        From other third parties. We may also collect personal data about you from other third parties as follows:

    • your employer or sending agency

    • your family

·        Website Forms: When you submit information to our website via webform, such as your name and email, we collect the data requested in the webform in order to respond to your submissions. We share this information with Squarespace, our online form hosting provider, so that they can provide the website service to us.

 

How we use (process) your Personal Data

When we use your personal data, we have a legal basis for doing so. When we use “special category of personal data” we have an additional specific additional legal basis to do so.

 

We process data under the Legitimate Interest category as well as Special Category H (due to the sensitive nature of personal health data).

·        Our Legitimate Interest is to collect data in order to allow us to provide informed medical and psychological assessment, care and advice and to assist with the management of these services.

·        We comply with Special Category Data ‘h’ due to the medical and mental health nature of our services.

 

Additionally, we may need to use your personal data in forming a contract for us to provide our services to you. We may also need to use your personal data to comply with regulatory or legal obligations.

 

We will seek your consent to use your personal data if there is no other legal basis to use it. If we ask for your consent, we will always aim to be clear and transparent about why we need your consent and what we are asking it for. Where we are relying on consent to use your personal data you have the right to withdraw your consent at any time and we will stop using your personal data for that purpose.

 

We process your personal data in various situations in order that we can provide our services to you. This may be in the process of delivering our services to you, or after you have accessed our services, for example:

·        Confirming an appointment with you and setting it up on our system

·        To deliver our service to you

·        To receive payment from you, where this is due

·        To carry out clinical audits

·        To collate statistical information for regulatory purposes.

·        To contact you and to resolve any queries or complaints.

·        To liaise with other healthcare professionals about your care, in the event that this is required.

·        To investigate or respond to concerns, complaints or claims and to comply with legal or regulatory obligations and defending or exercising our legal rights.

·        To manage the work of our organisation, including retaining client records, accounting and financial processes. 

 

Sharing Information

We may share your personal data with the third parties listed below:

·        With your sending agency or your GP. We only share limited health information where appropriate and with your consent.  You will be asked to give written consent to sharing information and where appropriate given the option to view any information before it is shared.

·        Third party laboratory testing facilities

·        Third parties who assist in the administration of your care or who may be responsible for paying the cost of your care (for example your employer or agency)

·        Our regulator, Healthcare Improvement Scotland

·        The police or other third parties for the prevention or detection of crime

·        Government bodies, for example HMRC

·        Third parties acting on your behalf in connection with legal proceedings

·        Our third-party services providers such as IT suppliers, auditors, tax advisors, solicitors, document storage and management providers and clinical records management providers.

·        Website Analytics: We share information with Squarespace, our website analytics provider, to learn about site traffic and activity. HealthLink360’s websites collect personal data to power our site analytics, including:

    • Information about your browser, network, and device

    • Search engine pages you visited prior to coming to this website

    • Your IP address

    • This information may also include details about your use of this website, including:

    • Clicks

    • Internal links

    • Pages visited

    • Scrolling

    • Searches

    • Timestamps

 

HealthLink360 will not share your data for marketing purposes.

 

If we share your personal data, we make sure appropriate technical and organisational controls are in place to protect it, in line with data protection laws.

 

Retaining information

We keep your personal information as long as is necessary and have taken into consideration external guidance in relation to how long your data should be retained. In accordance with our ‘360 degree’ ethos, return of clients over a number of years and due to the nature of the data (health records), the minimum length of time we will retain information is until you have reached the age of 80 years and have not accessed our services for 10 years prior to that. Some information (including vaccine records) may be retained indefinitely.  

 

Security

We take the security of your data very seriously and regularly review our systems to keep up to date with security requirements and best practice. Access to your records, whether paper or electronic, is limited to the staff, agents, contractors and other third parties who have a justified need to access it. If you have any concerns, please don’t hesitate to contact us.

 

Your Rights

You have certain rights in relation to your personal data that we hold about you. These include rights to know what personal data we hold about you and how it is used. We will use and hold your personal data in accordance with our obligations and these rights.

 

·        You have the right to access your personal data. Please do this in writing to the address below giving adequate information to allow us to identify you (eg  your full name, address, date of birth) and details of what information you are requesting.  We will respond within a month but depending on how much information you request it may take longer,  but no more than 3 months,  to provide all the information.  We will not usually charge a fee for this.

·        You can have inaccurate personal data about you corrected or removed.

·        You can request that we delete certain personal data we hold about you. However, please note that there are exceptions to this right.

·        You have the right to ask us to restrict our use of your personal data. We do not have to comply with all requests to restrict our use of your personal data.

·        You have the right to ask us to transfer your personal data to you or to someone else.

·        You have the right to object if we process your data for marketing purposes.

·        You have the right to not be subject to automatic decisions (ie decisions that are made about you by computer without any human input) in relation to your care or other processes that have a legal or similarly significant effect on you.

·        Where we have asked for your consent to use your personal data, you have the right to withdraw the consent you have given us to use your personal data.

·        You have the right to object to us using your personal data in a particular way (such as sharing it with third parties), and we will stop using it in that way unless specific exceptions apply.

 

You have the right to complain about how we process your data. This can be done directly to us at the address below:

HealthLink360, Elphinstone Wing, Carberry, Musselburgh, EH21 8PW

Or email us at admin@healthlink360.org, call us on 0131 653 6767, or contact us through our form.

 

You may also complain to our regulating body:

Healthcare Improvement Scotland, Gyle Square, 1 South Gyle Crescent, Edinburgh, EH12 9EB

Our Registration Number is: 00502

 

Or

Information Commissioners Office, 45 Melville Street, Edinburgh, EH3 7HL

 

For full Details of your rights under the General Data Protection Regulations please look at the Information Commissioners Website: https://ico.org.uk/for-the-public/

Version 2.0 June 2026

Updates to our Privacy Notice

We may update this Privacy Notice from time to time to ensure that it remains accurate. This policy was last updated on 19th June 2026.

HealthLink360 is a company limited by guarantee, registered in Scotland No SC392981, Scottish Charity No SCO 00948. Registered address:  Edinburgh International Health Centre, Carberry, Musselburgh EH21 8PW