Herts Allergy – Privacy Policy and Data Privacy Notice
For patients, prospective patients, website visitors and other individuals whose personal information is processed by Herts Allergy.
Effective date: 7th October 2026
1. Introduction
Herts Allergy is committed to protecting personal information and maintaining medical confidentiality. This notice explains what information we collect, why we use it, how it is protected and retained, who may receive it, and the rights available under UK data protection law.
2. Who we are
Dr Daniel Carlton-Conway is the owner of Herts Allergy. Dr Carlton-Conway is the data controller for personal information processed in connection with its private allergy service.
Contact: Dr Daniel Carlton-Conway, Herts Allergy, St Albans Rooms, 21 Victoria Street, St Albans, Hertfordshire AL1 3JJ. Email: allergy@hertsallergy.com. Website: www.hertsallergy.com.
3. What personal information we collect
We may process identity and contact details; relevant allergy and other health information; symptoms, medical history, medication, investigations, laboratory test requests and results, correspondence and treatment records; information supplied through the website enquiry form or by telephone, voicemail or email; appointment, invoicing and payment information; and information supplied by parents, guardians, spouses or partners, family members, friends, GPs or other healthcare professionals where appropriate.
4. How we collect information
Information may be obtained directly from you or, where appropriate, from a parent or guardian, spouse or partner, family member, friend or another person acting on your behalf. Information may also be received through the Herts Allergy website enquiry form, by email, telephone, voicemail or consultation, and from GPs, other healthcare professionals or other sources where appropriate and lawful.
5. How we use information
We use information to respond to enquiries, arrange and provide allergy care, request and receive laboratory investigations, maintain clinical records, communicate about care, manage appointments and payments, handle complaints and safety matters, meet legal/regulatory obligations, and operate and secure the practice.
6. Lawful bases and health information
Herts Allergy processes personal information in accordance with Article 6 of the UK General Data Protection Regulation (UK GDPR). Depending on the purpose of the processing, the relevant lawful basis may include processing that is necessary to take steps at your request before entering into a contract, or for the performance of a contract with you (Article 6(1)(b)), and processing necessary for the legitimate interests of Herts Allergy (Article 6(1)(f)), where those interests are not overridden by your interests, rights or freedoms. Other lawful bases may apply where required or permitted by law.
Health information is special-category personal data. Where Herts Allergy processes health information for medical diagnosis, the provision of healthcare or treatment, or the management of healthcare services, it relies on Article 9(2)(h) of the UK General Data Protection Regulation (UK GDPR). This is supplemented by section 10 and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, which provide the relevant UK-law condition for processing for health or social care purposes. Processing is carried out by, or under the responsibility of, a healthcare professional subject to professional confidentiality, in accordance with Article 9(3) of the UK GDPR and section 11 of the Data Protection Act 2018.
7. Confidentiality
Clinical information is treated as confidential and disclosed only where necessary for care, with appropriate authority, where required by law, or where another recognised legal or professional justification applies.
8. Website enquiries – Wix
The Herts Allergy website uses Wix. Website enquiries may contain health information, so the form is designed to collect only what is needed, including a brief description of the allergy problem, and users are asked not to provide unnecessary information.
Wix is used as a temporary collection and transmission platform rather than as the definitive clinical record. Form information is sent by an automated notification to the Herts Allergy practice email address. Clinically relevant information is transferred to the clinical record where required. Submissions are periodically permanently deleted from Wix in accordance with the Data Retention and Disposal Policy.
9. Email – Proton Mail
Herts Allergy uses Proton Mail for practice email. Email arriving from an external service is not necessarily end-to-end encrypted throughout the delivery path. Once stored in Proton Mail, it benefits from Proton's storage security and encryption arrangements. Clinically significant correspondence is incorporated into or retained with the clinical record as appropriate; routine administrative email is deleted when no longer required.
10. Telephone, call recording and voicemail – Yay.com
Herts Allergy uses Yay.com to provide its telephone and voicemail service. Telephone calls may be recorded for patient safety and to provide an accurate record where there is a complaint, concern or dispute about telephone communications. Routine call recordings are normally retained for 30 days and are then deleted. Access to recordings is restricted to authorised persons. A particular recording may be retained for longer where it is relevant to an existing or reasonably anticipated complaint, incident, investigation or legal claim, and will then be retained only for as long as reasonably necessary for that purpose. Callers are informed that calls may be recorded. Voicemail messages may also contain personal or health information; clinically relevant information is transferred to the appropriate clinical record where necessary, and voicemail messages are deleted when no longer required in accordance with the Herts Allergy Data Retention and Disposal Policy.
11. Electronic records and cloud storage
Electronic clinical records and practice documents may be stored in Dropbox and accessed on authorised, appropriately secured devices. Access is limited to those who need it. Devices are protected using appropriate controls such as strong authentication, device encryption, automatic locking, current security updates and two-factor authentication where available.
12. Backups
Herts Allergy maintains an encrypted offline backup for recovery and business continuity. Backups are not used as a separate working clinical archive. Information deleted from live systems may persist temporarily in protected backups until the normal secure replacement or overwrite cycle removes it.
13. International processing and transfers
Some service providers may process personal information outside the UK. Where this amounts to a restricted international transfer, Herts Allergy will use an applicable UK adequacy regulation or other appropriate safeguard and will keep relevant contractual and transfer arrangements under review.
14. Security
Herts Allergy uses proportionate technical and organisational safeguards, including access controls, strong passwords, two-factor authentication where available, encrypted devices and backup media, data minimisation, restricted access, security updates, automatic screen locking and review of processor arrangements.
15. Data retention
Information is retained only for as long as needed for its purpose and applicable clinical, legal, regulatory, insurance and accounting requirements. Detailed periods and review rules are set out in the Herts Allergy Data Retention and Disposal Policy.
16. Your data protection rights
Depending on the circumstances, you may have the right to request access to personal information held about you; ask us to correct inaccurate or incomplete information; request erasure; request restriction of processing; object to certain processing; and request transfer of information in a portable format where the right to data portability applies. These rights are not absolute. For example, Herts Allergy may need to retain clinical information despite a request for erasure where there is a lawful clinical, legal or regulatory reason to do so. You will not normally be charged for exercising your rights, although data-protection law permits a reasonable fee or refusal in certain circumstances, including where a request is manifestly unfounded or excessive.
17. Requests
Requests concerning personal information should be sent to allergy@hertsallergy.com. Herts Allergy may need to verify identity before releasing information and will respond in accordance with applicable law.
18. Complaints
Please contact Herts Allergy first if you have concerns about use of your information. You also have the right to complain to the Information Commissioner's Office (ICO).
19. Website and cookies
The website may use essential cookies required for operation and, where enabled, analytics or other non-essential technologies. Non-essential cookies are handled in accordance with applicable UK privacy and electronic communications requirements, including consent where required.
20. Who we share information with and our service providers
Where necessary and appropriate, personal information may be shared with healthcare professionals involved in your care, administrative staff or contractors working for Herts Allergy, and organisations that provide services to Herts Allergy. Relevant service providers include Wix (website hosting, enquiry forms and related website services), Proton Mail (practice email), Dropbox (electronic clinical record and document storage), Yay.com (telephone and voicemail services), and The Doctors Laboratory (TDL) (pathology laboratory testing and electronic test-request/results services). Where laboratory testing is required, Herts Allergy may provide TDL with relevant patient identification, contact and clinical information through its secure electronic portal, together with the relevant pathology sample. TDL processes information for purposes including carrying out requested laboratory tests and providing results to Herts Allergy. Depending on the processing concerned, TDL may act as a processor on behalf of Herts Allergy and/or as a controller in its own right. If Google Analytics or another analytics service is enabled on the website, its use will be described in the website cookie information and appropriate cookie controls will be used. Service providers process information for relevant purposes and are subject to appropriate contractual and data-protection arrangements where required. Herts Allergy may also disclose information where required by law or where another recognised legal or professional justification applies.
21. Links to other websites
The Herts Allergy website may contain links to websites operated by other organisations. Herts Allergy is not responsible for the privacy practices or content of those websites. You should review the privacy information provided by the relevant organisation when using an external website.
22. Changes of ownership or control
If Herts Allergy undergoes a change of ownership or control, relevant records may be transferred to a successor where lawful and appropriate, with appropriate safeguards for confidentiality and data protection.
23. Automated decision-making
Herts Allergy does not use solely automated decision-making producing legal or similarly significant effects in the provision of allergy care.
24. Changes to this notice
This notice is reviewed periodically and updated when material changes are made to services, systems, law or regulatory guidance.
25. Contact us
Questions about this notice or Herts Allergy's use of personal information should be sent to allergy@hertsallergy.com.