Privacy Notice

 

Respiratory Diagnostics Ltd

Last updated: August 2026

Respiratory Diagnostics Ltd provides respiratory physiology, allergy and sleep diagnostic services. This notice explains how we collect, use, store and share personal information when providing those services.

 

1. Who is responsible for your information?

 

Respiratory Diagnostics Ltd is a data controller for the personal and clinical information it processes when providing diagnostic services.

​

Respiratory Diagnostics Ltd is registered in England and Wales with company number 15433910.

 

ICO registration reference: ZB709358

 

Respiratory Diagnostics Ltd is wholly owned by London & Hertfordshire Respiratory Diagnostics Ltd.

 

London & Hertfordshire Respiratory Diagnostics Ltd provides corporate, financial and invoicing services for Respiratory Diagnostics Ltd. It may process limited patient-identification, service, invoicing, payment and accounting information for those purposes.

 

London & Hertfordshire Respiratory Diagnostics Ltd is registered with the Information

Commissioner’s Office under reference:

ZA491067

 

2. Contact details

 

For privacy enquiries, requests concerning your information or administrative correspondence, contact:

​

Respiratory Diagnostics Ltd
c/o MedicalSec Services Ltd
2 Henge Close
Adderbury
Banbury
OX17 3GA

Telephone: 0203 146 1771

Email: PA@chest-clinic.co.uk

Website: www.chest-clinic.co.uk

ICO registration reference: ZB709358

 

MedicalSec Services Ltd provides contracted administrative support to Respiratory Diagnostics Ltd and may receive and coordinate privacy enquiries on its behalf.

 

3. Where we provide services

 

Respiratory Diagnostics Ltd currently provides services at:

The Clementine Churchill Hospital

Sudbury Hill
Harrow
Middlesex
HA1 3RX

The Clementine Churchill Hospital is operated by Circle Health Group Limited.

 

One Stop Healthcare

One Medical House
Boundary Way
Hemel Hempstead
Hertfordshire
HP2 7YU

 

Respiratory Diagnostics Ltd provides services at these locations under contractual arrangements with the relevant hospital or clinic.

 

The tests available may vary between locations.

 

4. Our relationship with the hospitals and clinics

 

The hospital or clinic at which your test is booked is responsible for its own use of your information.

​

The host hospital or clinic will normally:

• receive the referral;

• arrange and administer the appointment;

• record your attendance;

• provide relevant referral and clinical information;

• maintain its own hospital or clinic record;

• receive the diagnostic report;

• administer hospital charges or insurer claims; and

• use the report to support your continuing care.

 

Respiratory Diagnostics Ltd will normally:

• receive the referral and relevant clinical information;

• confirm your identity and relevant medical history;

• undertake the requested test;

• record test measurements and observations;

• assess the technical quality of the test;

• arrange clinical interpretation where required;

• prepare or commission the diagnostic report;

• retain the test data and report;

• provide the report to the host hospital or clinic; and

• provide the report to the referring clinician.

 

Respiratory Diagnostics Ltd and the relevant host hospital or clinic each act as separate data controllers for the information they process.

 

Neither organisation acts solely as the other organisation’s data processor for the whole service.

 

You should also read the privacy notice issued by the hospital or clinic at which your test is undertaken.

 

5. Services we provide

 

Depending on the location, referral and clinical requirements, Respiratory Diagnostics Ltd may provide:

• full pulmonary-function testing;

• spirometry;

• spirometry with bronchodilator reversibility testing;

• postural spirometry;

• bronchial provocation or challenge testing;

• peak expiratory flow testing;

• gas-transfer testing;

• lung-volume measurement;

• fractional exhaled nitric oxide testing, known as FeNO;

• skin-prick allergy testing;

• home sleep studies;

• sleep-study setup, download, analysis and reporting;

• cardiopulmonary exercise testing;

• technical quality assurance;

• clinical interpretation of diagnostic results; and

• preparation and issue of diagnostic reports.

 

The inclusion of a test in this notice does not mean that it is available at every location.

 

6. Information we collect

 

We may collect and process:

• your name;

• date of birth;

• address;

• telephone number;

• email address;

• NHS number;

• hospital or clinic number;

• insurer membership and authorisation details;

• GP details;

• referring clinician details;

• next-of-kin or representative details where relevant;

• referral information;

• symptoms and medical history;

• diagnoses and suspected diagnoses;

• current and previous treatment;

• medicines;

• allergies;

• smoking history;

• height, weight, sex and other physiological information;

• test measurements and calculations;

• sleep-study recordings;

• oxygen saturation, pulse and respiratory measurements;

• skin-prick testing results;

• responses to bronchodilator or challenge testing;

• test-quality information;

• observations made during testing;

• medical images or graphical test outputs;

• technical reports;

• clinical reports;

• communications with the hospital, referrer and other clinicians;

• appointment information;

• invoicing and coding information;

• incident, complaint and governance records; and

• information necessary to meet regulatory, professional or insurance requirements.

Information concerning your health is classified as special-category personal data under UK data-protection law.

​

7. Where your information comes from

 

We may receive information from:

• you;

• a parent, relative, carer or authorised representative;

• the hospital or clinic at which the test is booked;

• your referring consultant;

• your GP;

• another healthcare professional;

• an NHS organisation;

• a diagnostic or treatment provider;

• your insurer, sponsor or funding organisation;

• previous test records held by Respiratory Diagnostics Ltd; and

• other lawful sources where relevant to your care.

We also generate new information when your test is undertaken, analysed and reported.

 

8. Why we use your information

 

We use personal information to:

• receive and review referrals;

• confirm your identity;

• determine whether a test can be undertaken safely;

• arrange and prepare for diagnostic testing;

• undertake the requested test;

• calculate and analyse test results;

• assess technical quality and validity;

• compare results with appropriate reference values;

• prepare diagnostic reports;

• obtain specialist clinical interpretation;

• provide results to the hospital and referring clinician;

• support diagnosis, treatment and continuing healthcare;

• communicate with you or your representative;

• manage incidents, complaints and concerns;

• undertake clinical governance;

• monitor service quality and performance;

• maintain and calibrate diagnostic equipment;

• manage appointments and administration;

• provide information required for invoicing and payment;

• comply with CQC, professional and regulatory requirements;

• respond to legal, regulatory or insurance matters;

• establish, exercise or defend legal claims;

• maintain information security; and

• ensure continuity and recovery of diagnostic records.

 

9. Our lawful bases

 

We must identify a lawful basis under Article 6 of the UK GDPR and, because we process health information, an additional condition under Article 9.

Article 6(1)(b): contract

Processing may be necessary to provide the diagnostic service requested or arranged for you, or to take steps connected with that service.

This may apply even where the hospital, clinic, insurer or another organisation is responsible for paying for the test.

Article 6(1)(c): legal obligation

Processing may be necessary to comply with legal, regulatory, taxation, accounting, health-and-safety or professional obligations.

Article 6(1)(f): legitimate interests

Processing may be necessary for the legitimate interests of Respiratory Diagnostics Ltd, the host hospital, referring clinicians and patients.

​

Those interests include:

• providing a safe and effective diagnostic service;

• maintaining an accurate clinical record;

• quality-assuring tests and reports;

• communicating results;

• managing incidents and complaints;

• maintaining information security;

• administering the service;

• recovering properly due fees; and

• protecting professional and legal rights.

 

Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and whether your interests or rights override those interests.

 

Article 9(2)(h): healthcare

 

Health information is principally processed because it is necessary for:

• medical diagnosis;

• the provision of healthcare;

• the assessment of a patient’s health; and

• the management of healthcare services,

by or under the responsibility of health professionals or other people subject to confidentiality obligations.

​

Article 9(2)(f): legal claims

Health information may also be processed where necessary to establish, exercise or defend legal claims.

​

We do not generally rely on UK GDPR consent to create, use or retain the diagnostic record.

Consent may still be relevant to the clinical decision to proceed with a particular test. Clinical consent and the UK GDPR lawful basis are separate matters.

​

10. What happens when you attend for a test?

​

The host hospital or clinic will normally arrange your appointment and provide Respiratory Diagnostics Ltd with the referral and relevant patient information.

When you attend:

• your identity will be confirmed;

• the physiologist will explain the test;

• relevant medical and safety information will be checked;

• you may be asked questions about symptoms, medicines, allergies or recent treatment;

• the test will be undertaken by an appropriately trained respiratory physiologist;

• measurements and observations will be recorded;

• the test will be checked for technical quality;

• results will be analysed;

• a report will be prepared or commissioned; and

• the report will be provided to the hospital and referring clinician.

 

Your referring clinician remains responsible for discussing the clinical implications of the result with you and deciding what treatment or further investigation may be required.

 

Respiratory Diagnostics Ltd is not normally responsible for providing general medical advice or ongoing treatment following the test unless this has been separately arranged.

 

11. Respiratory physiologists

 

Tests are undertaken by appropriately trained and competent respiratory physiologists employed or contracted by Respiratory Diagnostics Ltd.

Physiologists are required to:

• work within their competence and scope of practice;

• maintain relevant qualifications and registrations;

• complete mandatory training;

• undertake continuing professional development;

• participate in competency assessment and appraisal;

• comply with confidentiality obligations;

• comply with information-governance and security policies;

• follow relevant professional and clinical standards;

• report incidents and data breaches promptly; and

• use patient information only where necessary to provide the service.

 

Some physiologists are engaged as independent contractors.

 

Where a contracted physiologist processes information on behalf of Respiratory Diagnostics Ltd, the physiologist must act under documented instructions and contractual obligations concerning:

• confidentiality;

• information security;

• restricted access;

• data-breach reporting;

• use of individual accounts and passwords;

• restrictions on using subprocessors;

• responding to patient-rights requests;

• return or deletion of information; and

• compliance with UK data-protection law.

 

12. Reporting consultants

 

Some diagnostic results may be reviewed and reported by a consultant respiratory physician or another appropriately qualified reporting clinician.This is usually the requestor, unless they are not a Respiratory Physician, in which case a report from one of LHRD's connected doctors will be arranged. 

​

Reporting consultants may receive:

• referral information;

• medical history;

• test measurements;

• graphical outputs;

• previous results;

• observations made during testing; and

• other relevant clinical information.

 

Reporting consultants are engaged under contracts requiring them to:

• use the information only to provide the reporting service;

• maintain confidentiality;

• use appropriate security;

• process data only on authorised instructions;

• report suspected data breaches;

• avoid unauthorised disclosure or transfer;

• return or delete information when required; and

• maintain appropriate professional registration and indemnity.

The report is returned to Respiratory Diagnostics Ltd and is provided to the host hospital or clinic and the referring clinician.

 

13. MedicalSec Services Ltd

 

MedicalSec Services Ltd provides contracted administrative and secretarial support to Respiratory Diagnostics Ltd.

Authorised MedicalSec personnel may process information where necessary to:

• receive referrals and correspondence;

• communicate with patients, hospitals and referring clinicians;

• prepare clinic and testing lists;

• obtain missing referral or administrative information;

• coordinate reports;

• send approved reports;

• support invoicing and billing;

• manage administrative queries;

• receive privacy-rights requests;

• coordinate complaints and incidents; and

• provide general administrative support.

 

MedicalSec Services Ltd processes information under contractual confidentiality and data-protection obligations and only for authorised purposes.

 

MedicalSec personnel must not:

• undertake or interpret diagnostic tests;

• alter clinical measurements;

• make clinical decisions;

• approve substantive clinical reports; or

• use patient information for unrelated purposes.

Access is limited to what is reasonably required for the person’s role.

 

14. London & Hertfordshire Respiratory Diagnostics Ltd

 

Respiratory Diagnostics Ltd is wholly owned by London & Hertfordshire Respiratory Diagnostics Ltd.

The parent company undertakes corporate and financial activities, including:

• invoicing host hospitals and clinics;

• maintaining accounting records;

• processing service and payment information;

• corporate governance;

• insurance administration;

• contract administration; and

• professional and legal administration.

For these purposes, limited information may be provided to the parent company, including:

• patient name or identification details;

• hospital or clinic details;

• date of service;

• test type;

• charge or billing code;

• insurer or payment information;

• invoice status; and

• information required to investigate a disputed account.

Detailed clinical information will not normally be used for routine invoicing unless it is necessary and lawful to resolve a query, complaint, audit or legal matter.

 

15. Host hospitals and clinics

 

Information is shared with the hospital or clinic at which the test is undertaken.

 

This may include:

• referral information;

• confirmation that the test was undertaken;

• test measurements;

• reports;

• medical history relevant to the test;

• clinical observations;

• incident information;

• appointment or coding information; and

• information needed for governance, invoicing or insurance administration.

 

The hospital or clinic processes that information under its own privacy notice and its own responsibilities as a data controller.

 

At The Clementine Churchill Hospital, information may be shared with Circle Health Group personnel who require it to arrange, document, govern or support your care.

 

At One Stop Healthcare, information may be shared with authorised personnel who require it to arrange, document, govern or support your care.

 

16. Who else we may share information with

 

Where necessary and proportionate, information may be shared with:

• your referring clinician;

• your GP;

• another clinician involved in your care;

• an NHS organisation;

• another hospital or healthcare provider;

• laboratories or diagnostic providers;

• your insurer, sponsor or funding organisation;

• MedicalSec Services Ltd;

• contracted respiratory physiologists;

• reporting consultants;

• approved IT and system providers;

• equipment manufacturers or maintenance providers where appropriately de-identified or where access is strictly necessary;

• London & Hertfordshire Respiratory Diagnostics Ltd;

• accountants and auditors;

• legal and professional advisers;

• medical-malpractice and cyber insurers;

• the Care Quality Commission;

• the Information Commissioner’s Office;

• professional or accreditation bodies;

• courts and tribunals;

• law-enforcement agencies;

• safeguarding authorities; and

• other organisations where disclosure is required or permitted by law.

We disclose only the information reasonably necessary for the relevant purpose.

 

17. Information held on diagnostic equipment and computers

 

Diagnostic tests generate information on specialist medical equipment and associated computers.

Depending on the test, this may include:

• patient identifiers;

• referral information;

• raw physiological measurements;

• calculated values;

• graphical outputs;

• quality-control information;

• test comments;

• previous measurements;

• sleep-study signals;

• oxygen saturation and pulse recordings; and

• draft or final reports.

 

Testing computers and diagnostic systems are password protected.

Access is restricted to authorised personnel.

The systems are managed and maintained with support from an appointed IT service provider and relevant equipment suppliers.

Where engineers or technical-support personnel require access, this must be limited to what is necessary and subject to appropriate confidentiality, security and access controls.

 

18. Electronic storage and backups

 

Diagnostic information is held within:

• password-protected clinical testing systems;

• protected computers associated with diagnostic equipment;

• secure server storage;

• a secure cloud-based document-management environment; and

• host-hospital systems where reports are uploaded or transferred.

​

Access controls may include:

• individual user accounts;

• strong passwords;

• multi-factor authentication;

• role-based permissions;

• restricted folders;

• managed devices;

• encryption;

• logging and monitoring;

• access removal when roles change; and

• periodic access review.

 

Test data and reports are backed up to protected server or cloud storage to support:

• record availability;

• recovery following equipment failure;

• business continuity;

• protection against accidental deletion; and

• investigation of incidents.

 

19. Sending reports

 

Reports are normally provided to:

• the hospital or clinic at which the test was undertaken; and

• the clinician who referred you.

Reports may be transferred through:

• secure hospital systems;

• secure email;

• protected cloud storage;

• an approved clinical portal; or

• another appropriately secure method.

 

Reports will not normally be sent to an unrelated third party without an appropriate reason or authority.

 

A copy may be provided directly to you where appropriate and after reasonable identity checks.

​

20. Use of ordinary email

 

Ordinary email is not completely secure.

Where possible, particularly sensitive information should be transferred through secure hospital email, an approved encrypted service, protected cloud access or another appropriate secure method.

 

Where ordinary email must be used, reasonable steps will be taken to:

• verify the recipient;

• minimise the information sent;

• check attachments;

• use password protection where appropriate; and

• avoid sending information to personal or unverified addresses unnecessarily.

Please take care when providing an email address and tell the hospital or Respiratory Diagnostics Ltd promptly if it changes.

 

21. International processing

 

Respiratory Diagnostics Ltd seeks to keep identifiable clinical information within the United Kingdom.

Some suppliers may use authorised subprocessors or technical-support services located outside the United Kingdom.

Where personal information is transferred outside the UK, Respiratory Diagnostics Ltd will require an appropriate legal safeguard, which may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to the EU Standard Contractual Clauses; or

• another transfer mechanism permitted by UK law.

Where required, transfer risks and additional contractual, organisational or technical safeguards will be considered.

Contracted physiologists and reporting consultants must not transfer patient information outside the UK unless expressly authorised and lawfully arranged.

 

22. How we protect your information

Measures used to protect information include:

• individual accounts;

• password protection;

• multi-factor authentication where supported;

• role-based access;

• secure clinical systems;

• secure server and cloud storage;

• encryption where appropriate;

• managed computers and devices;

• antivirus and endpoint protection;

• software updates and patching;

• system backups;

• access logging;

• confidentiality agreements;

• data-protection clauses in contracts;

• staff and contractor training;

• incident-reporting procedures;

• breach-response arrangements;

• supplier due diligence;

• physical security at host sites;

• equipment maintenance; and

• secure deletion procedures.

No information system can be guaranteed to be entirely risk-free. Respiratory Diagnostics Ltd maintains reasonable and proportionate safeguards appropriate to the sensitivity of clinical diagnostic information.

 

23. Insurance

Respiratory Diagnostics Ltd maintains insurance appropriate to its declared activities, including:

• medical-malpractice insurance;

• public and products liability insurance;

• employers’ liability insurance; and

• cyber and data insurance.

Insurance is subject to the applicable policy terms, limits and exclusions.

The existence of insurance does not replace the company’s duties to maintain proper clinical, governance and information-security controls.

 

24. Clinical governance, audit and quality assurance

 

Information may be used where necessary for internal clinical governance and quality assurance.

This may include:

• checking test quality;

• reviewing unusual or inconsistent results;

• consultant review;

• case discussion;

• equipment quality control;

• calibration review;

• investigation of incidents;

• investigation of complaints;

• service audits;

• monitoring turnaround times;

• reviewing compliance with professional standards;

• checking that reports have reached the correct recipient; and

• responding to CQC or host-hospital assurance requirements.

Where practical, information used for broader service review will be anonymised or minimised.

Clinical governance is not the same as unrelated research.

 

25. Research, teaching and publication

 

Identifiable patient information will not be used for unrelated research, teaching or publication unless there is an appropriate lawful and ethical basis.

Where information is fully anonymised so that no individual can reasonably be identified, it may fall outside data-protection law.

Any proposed use of identifiable or potentially identifiable information for research or publication would require separate consideration of:

• lawful basis;

• confidentiality;

• ethics approval where applicable;

• research governance;

• patient information;

• consent where required; and

• appropriate security.

 

26. Children and representatives

 

Where the patient is a child, information may be shared with a person who has parental responsibility where this is lawful and appropriate.

The child’s:

• age;

• maturity;

• capacity;

• confidentiality rights; and

• best interests

will be considered.

Where another person acts on your behalf, we may request evidence of:

• your authority;

• parental responsibility;

• lasting power of attorney;

• deputyship;

• executorship; or

• another lawful basis for representation.

 

27. How long we retain information

 

Clinical diagnostic records, including raw test data, technical information and reports, are normally retained for 11 years after the patient’s last contact with the service.

Records may be retained for longer where:

• care remains ongoing;

• comparison with previous testing remains clinically important;

• the patient was under 18 at the time of treatment;

• there is a complaint;

• there is an incident investigation;

• there is an actual or potential legal claim;

• a safeguarding concern applies;

• a court order applies;

• an insurer or indemnifier has imposed a hold;

• a regulatory investigation is underway; or

• another legal or professional requirement applies.

Records relating to children will be retained at least until the applicable period for children’s records has expired and may be retained longer where the 11-year period from last contact ends later.

Contractual, equipment-maintenance, accounting, governance and insurance records may be retained for different periods.

Information will be securely deleted or destroyed when it is no longer required and no lawful reason for continued retention applies.

 

28. Your rights

 

Depending on the circumstances, you may have the right to:

• request access to your personal information;

• ask us to correct inaccurate information;

• ask us to complete incomplete information;

• request restriction of processing;

• object to processing based on legitimate interests;

• request erasure where there is no overriding reason to retain the information;

• receive certain information in a portable format;

• withdraw consent where consent is the lawful basis; and

• complain about how your information has been handled.

These rights are not absolute.

In particular, it may be necessary to retain an accurate diagnostic record for:

• patient safety;

• continuing care;

• comparison with future tests;

• professional accountability;

• regulatory obligations;

• insurance and indemnity purposes; or

• legal claims.

 

29. Access to your records

 

You are normally entitled to request a copy of information held about you.

No fee will normally be charged.

A reasonable fee may be charged only where permitted by law, including where a request is manifestly unfounded or excessive or where additional copies are requested.

We may need to verify your identity before releasing information.

Where your information is held by both Respiratory Diagnostics Ltd and the host hospital, you may make a request to either organisation for the information that it holds.

If a request relates principally to the hospital record, Respiratory Diagnostics Ltd may explain that the request should also be directed to the hospital.

 

30. Correction of records

 

Please contact us if you believe information is factually inaccurate.

Clinical and diagnostic records will not normally be silently deleted or overwritten.

Where a correction is appropriate, a dated amendment or supplementary entry may be added so that:

• the original record remains auditable;

• the correction is clear;

• the reason for the correction is recorded where appropriate; and

• the integrity of the diagnostic record is preserved.

A difference of clinical opinion does not necessarily mean that a report is factually inaccurate.

You may ask for your concern or alternative view to be recorded where appropriate.

 

31. Erasure requests

 

You may ask for information to be erased, but this right does not automatically apply to clinical diagnostic records.

An erasure request may be refused where information remains necessary for:

• safe healthcare;

• continuing treatment;

• comparison with previous or future results;

• professional accountability;

• legal or regulatory compliance;

• insurance or indemnity purposes;

• safeguarding;

• public-interest obligations; or

• establishing, exercising or defending a legal claim.

Where erasure is not appropriate, restriction or annotation may sometimes be considered.

 

32. Objection to processing

 

You may object to processing based on legitimate interests.

We will consider:

• the nature of the information;

• the purpose of the processing;

• your reasons for objecting;

• the effect on your rights;

• patient-safety considerations;

• professional and regulatory duties; and

• whether there are compelling reasons to continue.

An objection will not necessarily require deletion of an accurate clinical record.

 

33. Automated decision-making

 

Respiratory Diagnostics Ltd does not make solely automated decisions that produce legal or similarly significant effects concerning your healthcare.

Diagnostic equipment and software may:

• calculate physiological values;

• compare measurements with reference ranges;

• produce graphical outputs;

• identify technical warnings; or

• generate preliminary classifications.

These outputs are subject to review by an appropriately trained physiologist or reporting clinician.

The equipment or software does not independently decide your diagnosis or treatment.

 

34. Personal-data breaches

 

A personal-data breach may include:

• information sent to the wrong recipient;

• loss or theft of a device;

• unauthorised access;

• malware or ransomware;

• accidental deletion;

• inappropriate disclosure;

• loss of availability; or

• corruption of clinical data.

Respiratory Diagnostics Ltd maintains procedures to:

• identify and contain incidents;

• assess the information affected;

• restore availability where possible;

• notify relevant host hospitals;

• seek technical, legal and insurance advice;

• notify the Information Commissioner’s Office where required;

• inform affected individuals where the legal threshold is met; and

• identify measures to reduce recurrence.

Contracted physiologists, consultants, administrators and suppliers must report suspected breaches promptly.

 

35. Complaints

 

Please contact Respiratory Diagnostics Ltd first if you have concerns about how your information has been used:

Respiratory Diagnostics Ltd
c/o MedicalSec Services Ltd
2 Henge Close
Adderbury
Banbury
OX17 3GA

Telephone: 0203 146 1771

Email: PA@chest-clinic.co.uk

ICO registration reference: ZB709358

 

MedicalSec Services Ltd may receive and administer the complaint or information request on behalf of Respiratory Diagnostics Ltd.

 

Clinical, governance and data-protection decisions remain the responsibility of Respiratory Diagnostics Ltd.

 

You may also complain to the Information Commissioner’s Office:

Telephone: 0303 123 1113

Website: www.ico.org.uk

​

You retain the right to seek a judicial remedy where applicable.

Complaints about the hospital or clinic’s own use of information should also be directed to the hospital or clinic at which the service was provided.

​

36. Website and cookies

 

Respiratory Diagnostics Ltd does not operate a separate website.

Information about Respiratory Diagnostics Ltd, including this privacy notice, is published as part of The Chest Clinic website at www.chest-clinic.co.uk.

The website is hosted through Wix.

The cookie and website-technology provisions below apply to the Chest Clinic website as a whole, including pages concerning Respiratory Diagnostics Ltd.

What is a cookie?

A cookie is a small data file placed in the browser of your computer, telephone or tablet when you visit a website.

Cookies may be used to:

• make a website function;

• maintain security;

• remember choices;

• support accessibility;

• understand how a website is used; or

• provide features supplied by another service.

Essential cookies

Essential cookies may be placed automatically because they are required for the website to work securely and properly.

They may support:

• website security;

• fraud prevention;

• network management;

• accessibility;

• page navigation;

• remembering privacy choices; and

• basic operation of the Wix platform.

Essential cookies do not normally require consent because the website may not function properly without them.

Optional cookies

Depending on the website configuration, optional cookies may be used for:

• website analytics;

• measuring website performance;

• understanding which pages are visited;

• identifying the type of device or browser used;

• understanding how visitors reached the website;

• remembering non-essential preferences; or

• supporting third-party features.

Where consent is legally required, optional cookies should not be placed unless you have accepted them through the website cookie banner or cookie settings.

Analytics information

Where analytics are enabled and permitted, information may include:

• pages visited;

• date and time of visits;

• approximate location derived from an internet address;

• device and browser type;

• time spent on a page;

• referral source; and

• movement through the website.

Website analytics are not used to access your clinical record or make decisions about your care.

Advertising

Respiratory Diagnostics Ltd and The Chest Clinic do not knowingly sell website visitor information to advertisers.

We do not knowingly use website cookies for targeted advertising.

If advertising or marketing technology is added in future, the privacy notice and cookie controls will be updated before that technology is used.

Third-party services

Third-party services embedded in or linked from the website may use their own cookies or similar technologies.

These may include:

• maps;

• video players;

• booking tools;

• review platforms;

• accessibility tools; or

• analytics services.

Those third parties are responsible for explaining their own use of cookies and personal information.

Managing cookies

You can manage optional cookies through the cookie banner or Cookie Settings function on the website.

You may also delete or block cookies through your browser settings.

Blocking essential cookies may prevent parts of the website from working correctly.

37. Changes to this notice

This notice will be reviewed periodically and whenever there is a material change to:

• the services provided;

• the host hospitals or clinics;

• the controller arrangements;

• London & Hertfordshire Respiratory Diagnostics Ltd’s role;

• MedicalSec Services Ltd’s role;

• clinical systems;

• diagnostic equipment;

• storage or backup arrangements;

• reporting arrangements;

• suppliers or subprocessors;

• international transfers;

• retention periods;

• applicable law;

• professional guidance; or

• regulatory requirements.

The most current version will be published on the Chest Clinic website.