Privacy Policy

Who we are

Mr. Ronnie Davies is the data controller for this website (msec.co.uk) and for the clinical records held about you as a patient. You can contact us at info@msec.co.uk or via the phone numbers on the Contact page.

What we collect, and why

We collect personal information in three contexts:

• Booking enquiries via the website. If you use the booking form or contact form, we collect your name, contact details, date of birth, GP / referrer information, the reason for your enquiry, and any insurance details you provide. We use this to contact you about your appointment and to provide your care.
• Clinical care. If you become a patient, we hold a clinical record covering your history, examination findings, scan results, treatment plans, operation notes and follow-up. This is the standard medical record required by our regulator (the General Medical Council) and by clinical good practice.
• Website analytics. With your consent (via the cookie banner) we measure aggregated, anonymised information about how visitors find and use the site — pages viewed, devices used, geographic region. We do not profile individuals.

We never sell your information. We never use it for marketing without your explicit consent.

Lawful basis

The lawful basis for processing your information is set out in UK GDPR Article 6 and Article 9:

• Article 6(1)(b) — performance of a contract — for the practical arrangements of your care.
• Article 6(1)(f) — legitimate interest — for replying to a website enquiry.
• Article 9(2)(h) — the provision of healthcare — for clinical information.
• Article 6(1)(a) — your consent — for website analytics cookies.

Who we share it with

Your personal information is shared only with people who need it to provide your care:

• The hospital where you're treated (Wythenshawe Hospital for NHS care, Circle Highfield Hospital for private care). Each hospital is itself a data controller for your hospital record.
• Your GP and any referring clinician — to keep them informed of your care.
• Your insurer — if you have asked us to process your treatment through private medical insurance.
• Other clinicians involved in your care — for example, physiotherapists, anaesthetists, radiologists.
• The patient portal software that supports our booking process — held under a data processor agreement.
• HMRC, regulators, courts — where we are legally required to.

We will never share your information for commercial purposes.

How long we keep it

NHS clinical records are kept according to the NHS Records Management Code of Practice (currently 8 years after the last contact for adults, longer for some categories). Private clinical records are kept for at least 8 years.

Booking enquiries that don't result in an appointment are kept for 12 months in case you come back to us, then deleted.

Website analytics are aggregated and held for 26 months by Google Analytics.

Your rights

Under UK GDPR you have the right to:

• See a copy of the information we hold about you (a "subject access request").
• Ask us to correct anything that's wrong.
• Ask us to delete information in some circumstances (this doesn't override our legal duty to keep clinical records).
• Object to processing in some circumstances.
• Withdraw consent for processing that relies on your consent.

To exercise any of these rights, email info@msec.co.uk. We respond within one calendar month.

If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at any time.

Cookies

See our Cookie Policy for the specifics of what cookies this website uses.

Changes to this policy

This policy was last updated in May 2026. If we make material changes we will note the update date here.