Privacy Notice

Althea Women’s Health Ltd

Last Updated: June 14, 2026

Introduction
- Althea Women’s Health Leicester UK ("the Clinic", "we", "us", or "our") is committed to protecting and respecting the privacy of all individuals whose personal data we process. We recognise that the personal data we hold is often highly sensitive in nature, and we take our responsibilities in relation to its protection extremely seriously.
- This Privacy Notice explains how we collect, use, store, and protect your personal data in accordance with the UK General Data Protection Regulation (Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018) (the "UK GDPR") and the Data Protection Act 2018 (the "DPA 2018").
- Please read this Privacy Notice carefully. By engaging with our services or using our website, you acknowledge that you have read and understood this Privacy Notice. Where we rely on your consent as a legal basis for processing your personal data, we shall seek that consent separately and explicitly in accordance with the requirements of the UK GDPR.
The Data We Collect
- We collect and process the following categories of personal data in connection with the provision of our services and the operation of our clinic and website.
- Identity Data: This includes your full name, title, date of birth, sex, gender identity, NHS Number and photographic identification where required for identity verification purposes.
- Contact Data: This includes your postal address, email address, telephone number(s), and emergency contact details.
  - general medical history, including pre-existing conditions, surgical history, and family medical history;
  - Diagnostic data and information obtained through various diagnostic procedures.
- Financial Data: This includes billing information, payment card details (processed through our secure payment provider), invoices, insurance policy details, and records of payments made and outstanding.
- Technical Data: Where you use our website, we may collect technical data including your internet protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website. We also collect information about your website usage, including the pages you visit, the links you follow, and the duration of your visit.
‍How we collect your personal data
- We collect personal data in general from the following sources, but this is not an exhaustive list.
- Directly from you: We collect the majority of your personal data directly from you when you register as a service user, complete our registration and consent forms, attend consultations and appointments, undergo diagnostic tests, communicate with us by telephone, email, letter, or through our website, or provide feedback or make a complaint.
- From referring clinicians and healthcare providers: Where you are referred to us by your general practitioner, another consultant, or an NHS or private healthcare provider, we may receive personal data (including medical records and referral letters) from the referring clinician or provider.
- From laboratories and diagnostic service providers: We receive test results, laboratory reports, and diagnostic data from external laboratories and diagnostic service providers who carry out tests and analyses on our behalf or to whom we refer samples. All laboratories and diagnostic service providers used by the clinic are accredited by the United Kingdom Accreditation Service.
- From your partner or family members: Where your partner or family members provide information relevant to your ultrasound test (for example, family medical history), we may receive personal data from those individuals.
- From our website and digital platforms: We collect technical data automatically when you visit our website through the use of cookies and similar technologies. Please refer to our Cookies Policy for further information HERE
Legal Basis For Processing
- Under the UK GDPR, we must have a valid legal basis for processing your personal data. The legal bases upon which we rely are set out below.
- Consent (Article 6(1)(a)): Where you have given clear and explicit consent to the processing of your personal data for one or more specific purposes. We rely on consent for certain processing activities, including the use of your data for research purposes, the sending of marketing communications, and certain disclosures to third parties that are not otherwise required by law.
- Performance of a contract (Article 6(1)(b)): Where the processing is necessary for the performance of a contract to which you are a party (for example, your agreement with the Clinic), or in order to take steps at your request prior to entering into a contract.
- Legal obligation (Article 6(1)(c)): Where the processing is necessary for compliance with a legal obligation to which we are subject, including the Health and Social Care Act 2012, and other applicable legislation and regulations.
- Vital interests (Article 6(1)(d)): Where the processing is necessary in order to protect the vital interests of you or another natural person. We may rely on this basis in emergency medical situations.
- Legitimate interests (Article 6(1)(f)): Where the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms. Our legitimate interests include the effective administration and management of the Clinic, the improvement of our services, the prevention of fraud, and the establishment, exercise, or defence of legal claims.
Legal Basis For Processing Special Category Data
- Where we process special category data (including health and medical data), we must also satisfy an additional condition under Article 9 of the UK GDPR and Schedule 1 to the DPA 2018.
- Explicit consent (Article 9(2)(a)): Where you have given explicit consent to the processing of your special category data for one or more specified purposes. We rely on explicit consent for certain processing activities, including the use of your health data for research purposes and the disclosure of your health data to third parties who are not directly involved in the provision of our services.
- Medical diagnosis and treatment (Article 9(2)(h)): Where the processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services, on the basis of United Kingdom law or pursuant to a contract with a health professional, and subject to the conditions and safeguards referred to in Article 9(3) of the UK GDPR. This is the primary legal basis upon which we process your health and medical data. Processing under this condition is subject to the requirement that it is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law (paragraph 2 of Schedule 1 to the DPA 2018).
- Public interest in the area of public health (Article 9(2)(i)): Where the processing is necessary for reasons of public interest in the area of public health, such as ensuring high standards of quality and safety of healthcare and of medicinal products or medical devices, on the basis of United Kingdom law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject.
- Substantial public interest (Schedule 1, Part 2 of the DPA 2018): Where the processing is necessary for statutory or governmental purposes, for the administration of justice, or for other purposes of substantial public interest as set out in Schedule 1 to the DPA 2018.
How We Use Your Personal Data
- Testing purposes: To provide you with pregnancy and gynecology diagnostic services, including conducting consultations, carrying out diagnostic tests and a gynecological ultrasound scan.
- Administrative and operational purposes: To register you as a service user, manage your appointments, maintain your medical records, process referrals, communicate with you regarding your appointments, and manage the day-to-day operations of the Clinic.
- Billing and financial purposes: To issue invoices, process payments, manage your account, liaise with your insurer (where applicable), and pursue outstanding debts.
- Legal and regulatory compliance: To comply with our legal and regulatory obligations, including our obligations under the Care Quality Commission (Registration) Regulations 2009, the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, and other applicable legislation and regulations.
- Clinical audit and quality improvement: To carry out clinical audits, quality assurance activities, and service improvement initiatives in order to maintain and improve the quality and safety of our services.
- Safeguarding and public protection: To fulfil our obligations in relation to safeguarding, including the protection of children and vulnerable adults, and to cooperate with law enforcement agencies where required by law.
- Establishment, exercise, or defence of legal claims: To establish, exercise, or defend legal claims, including in connection with complaints, litigation, and regulatory proceedings.
Consent To Ultrasound Testing and Data Processing
- Before providing an ultrasound test, we will ask you to provide your written consent to the proposed ultrasound test and to the processing of your personal data in connection with that testing.
- Your consent to the processing of your personal data for ultrasound testing purposes is separate from, and in addition to, your consent to the testing itself. You may withdraw your consent to data processing at any time by contacting our Data Protection Lead, although please note that withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal, and that we may continue to process your personal data on other legal bases (for example, legal obligation or legitimate interests) where applicable.
Sharing Your Personal Data
- We may share your personal data with the following categories of recipients, where necessary and in accordance with the legal bases set out in Section 4 and 5 above.
- NHS bodies and other healthcare providers: We may share your personal data with your general practitioner, referring clinician, other NHS trusts or foundation trusts, and other healthcare providers involved in your care, where this is necessary for your ultrasound testing or for the coordination of our services.
- Laboratories and diagnostic service providers: We share samples and associated data with external laboratories and diagnostic service providers who carry out tests and analyses on our behalf.
- Partner clinics and satellite centres: Where your ultrasound testing involves the use of a partner clinic or satellite centre, we may share your personal data with that clinic or centre to the extent necessary for the provision of your ultrasound test.
- Insurers and funding bodies: Where your ultrasound testing is funded in whole or in part by a private medical insurer, the NHS, or another funding body, we may share relevant personal data with that insurer or funding body for the purposes of verifying eligibility, processing claims, and managing payments.
- IT service providers and data processors: We engage third-party IT service providers to support the operation of our clinical and administrative systems, including electronic service user record systems, appointment booking systems, and website hosting. These providers process personal data on our behalf and are bound by data processing agreements in accordance with Article 28 of the UK GDPR.
- Professional advisors: We may share your personal data with our legal advisors, auditors, accountants, and other professional advisors where this is necessary for the establishment, exercise, or defence of legal claims, or for the purposes of obtaining professional advice.
- ‍
- Regulatory and law enforcement bodies: We may disclose your personal data to regulatory bodies (including the Care Quality Commission and other professional regulatory bodies), law enforcement agencies, and the courts where we are required to do so by law or where disclosure is necessary for the purposes of safeguarding, the prevention or detection of crime, or the establishment, exercise, or defence of legal claims.
- Research organisations: Where you have provided your explicit consent, we may share your personal data (in anonymised, pseudonymised, or identifiable form, as specified in your consent) with approved research organisations for the purposes of medical research.
- We will not sell your personal data to any third party. We will not share your personal data with any third party for their own marketing purposes without your explicit consent.
International Transfers
- We do not transfer your personal data outside the United Kingdom.
Data Retention
- We retain your personal data only for as long as is necessary in line with Data Protection Legislation and applicable NHS Retention Schedules to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements. In determining the appropriate retention period, we have regard to the nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process the data, whether we can achieve those purposes through other means, and the applicable legal, regulatory, and professional requirements.
Your Rights
- The UK GDPR gives you certain rights about how your information is collected and used. To make a request for your personal information, contact the clinic at admin@altheawomenshealth.co,uk or call 0116 504 2929.
- You also have the following rights:
  - The right to be informed about the collection and use of your personal data – this is called the ‘right to be informed’.
  - The right to access your personal data, this is commonly called a ‘right of access’, or Subject Access Request (“SAR”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
  - The right to ask us to correct any information you think is not accurate or complete – this is called the ‘right to rectification’.
  - The right to ask us to delete your personal information in certain circumstances – this is called the ‘right to erasure’.
  - The right to ask us to stop using your information – this is called the ‘right to restriction of processing’.
  - The ‘right to object to processing’ of your information, in certain circumstances.
  - Rights in relation to automated decision making and profiling.
  - The right to withdraw consent at any time (where relevant).
  - The right to complain to the Information Commissioner if you feel we have not used your information in the right way.
  - There are legitimate reasons why your information rights may be refused. For example, some rights will not apply:
  - Right to erasure does not apply when the lawful basis for processing is legal obligation or public task.
  - Right to portability does not apply when the lawful basis for processing is legal obligation or public task.
  - Right to object does not apply when the lawful basis for processing is contract, legal obligation or vital interest. If the lawful basis is consent, you don’t have the right to object, but you have the right to withdraw consent.

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office. However, before doing so please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand. The ICO will expect you to have done this before reviewing your complaint.

‍

Storing Your Information
- We have implemented appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage, in accordance with Article 32 of the UK GDPR. These measures include, but are not limited to:
  - access controls and authentication mechanisms to restrict access to personal data to authorised personnel on a need-to-know basis;
  - staff training on data protection and information security;
  - incident response procedures for the detection, reporting, and investigation of personal data breaches.
- Whilst we take all reasonable steps to protect your personal data, please be aware that no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal data.
Withdrawal of Consent and the Right to Lodge a Complaint
- If you have any concerns or complaints about the way in which we have handled your personal data, we encourage you to contact our Data Protection Lead at admin@altheawomenshealth.co,uk or call 0116 504 2929. We will investigate your complaint and endeavor to respond to you within 30 days.
- If you are not satisfied with our response, or if you wish to make a complaint directly to the supervisory authority, you have the right to lodge a complaint with the Information Commissioner's Office ("ICO"). The ICO's contact details are as follows:
  
  Information Commissioner's Office
  Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
  Telephone: 0303 123 1113
  Website: www.ico.org.uk
  ‍
- We would, however, appreciate the opportunity to address your concerns before you approach the ICO, and we ask that you please contact our Data Protection Lead in the first instance.
Changes To This Privacy Notice
- We keep this Privacy Notice under regular review and may update it from time to time to reflect changes in our processing activities, changes in applicable law or regulatory guidance, or changes in our organisational structure. Any changes will be posted on our website and, where appropriate, notified to you by email or other direct communication.
- The date on which this Privacy Notice was last updated is shown at the top of this document. We encourage you to review this Privacy Notice periodically to stay informed about how we are protecting your personal data.
- Where we make material changes to this Privacy Notice that affect the way in which we process your personal data, we will take reasonable steps to notify you in advance and, where required by law, seek your consent to the new processing activities.
Contact Us
- If you have any questions about this Privacy Notice, about the way in which we process your personal data, or if you wish to exercise any of your rights under the UK GDPR, please contact us using the following details:
  
  Althea Women’s Health Leicester UK, Lonsdale House,
  High Street, Lutterworth, Leicestershire, United Kingdom, LE17 4AD
  Email: at admin@altheawomenshealth.co,uk
  Telephone: 0116 504 2929.

‍

Schedule your visit