Privacy Notice
Last updated: 2 October 2026
1. Who we are
The Hearing Clinic (UK) Limited is the data controller responsible for the personal information described in this notice.
- Company number: SC429276
- Registered office: 4 Royal Crescent, Glasgow, G3 7SL
- Privacy contact: info@thehearingclinicuk.co.uk
- Telephone: 0333 320 7788
We have a Privacy Lead who coordinates data-protection enquiries, rights requests and complaints. References to “The Hearing Clinic UK”, “we”, “us” or “our” mean The Hearing Clinic (UK) Limited.
UK Hearing Centres is a trading name of The Hearing Clinic (UK) Limited. The same legal company is responsible for personal information collected through either brand. UK Hearing Centres has a separate brand-specific version of this notice so that patients can easily understand how their information is used.
2. Who this notice covers
This notice covers patients and prospective patients, parents and guardians, carers, people making enquiries, website visitors, event attendees, members, customers, suppliers, referrers, job applicants and other people who interact with us.
If we collect information about a child, we provide privacy information in a form appropriate to the child’s age and involve a parent or guardian where appropriate. A parent or guardian’s rights do not automatically override a competent child’s privacy rights.
3. Information we collect
- Identity and contact details: name, title, date of birth, address, email address, telephone number, preferred contact method, emergency contact and, where relevant, parent, guardian, carer or representative details.
- Health and care information: hearing and medical history, symptoms, test results, images, audiograms, ear-health information, diagnoses, clinical notes, treatment, prescriptions, devices, serial numbers, adjustments, referrals and aftercare.
- Appointment and communications information: bookings, reminders, correspondence, complaints, feedback and records of telephone, email, SMS or in-person contact.
- Transaction and membership information: purchases, invoices, refunds, warranties, care plans, membership, finance and payment status. Card details are handled by our payment providers; we do not normally retain the full card number.
- Marketing preferences: consent, opt-outs, campaign responses and the source and date of your preference.
- Website and device information: IP address, device and browser details, pages viewed, form submissions, cookie choices, referral source and advertising or analytics identifiers where you consent to non-essential technologies.
- Professional and business information: details about referrers, suppliers, business contacts and job applicants.
4. Where information comes from
We obtain information directly from you, including through clinic visits, telephone calls, email, website forms, online bookings, purchases, events and social-media enquiries. We may also obtain it from:
- a parent, guardian, carer or authorised representative;
- your GP, another clinician or healthcare provider, with an appropriate basis for sharing;
- a referrer, employer or insurer where they arrange or fund a service;
- device manufacturers and service partners supporting your care or warranty;
- our UK Hearing Centres clinics and team, or another clinic when you request a referral or transfer of care;
- a previous clinic operator or record-holder following a lawful business or care transfer; and
- website, analytics, advertising and communications providers, subject to your choices and applicable law.
Where we receive your information from another source, we will provide appropriate privacy information within the time required by law—normally within one month, or earlier if we contact you or disclose the information.
5. Why we use information and our lawful bases
| Purpose | UK GDPR lawful basis | Health/special-category condition |
|---|---|---|
| Responding to enquiries, assessing needs and arranging care | Steps at your request before a contract; contract; or legitimate interests in operating a responsive hearing-care service | Article 9(2)(h), health or social care, where health information is needed |
| Providing assessments, treatment, devices, prescriptions, aftercare and clinical referrals | Contract; legitimate interests in providing and managing safe care; and legal obligation where applicable | Article 9(2)(h) and Data Protection Act 2018 Schedule 1, Part 1, condition 2, with professional confidentiality safeguards |
| Maintaining clinical records, protecting patient safety and handling complaints or claims | Legal obligation; contract; and legitimate interests in clinical governance, defending legal rights and improving services | Article 9(2)(h) and, where necessary, Article 9(2)(f) for legal claims |
| Payments, accounts, tax, fraud prevention and administration | Contract; legal obligation; and legitimate interests in secure and efficient administration | Normally not applicable; where health information is inseparable, Article 9(2)(h) applies |
| Appointment reminders, service messages, recalls and important care information | Contract; legitimate interests in safe, effective care and reducing missed appointments; or legal obligation | Article 9(2)(h) where the message reveals or uses health information |
| Quality assurance, staff training, audit, service improvement and anonymised reporting | Legitimate interests in quality, safety and business improvement; or legal obligation | Article 9(2)(h) where identifiable health information is necessary |
| Relevant marketing by email, SMS, telephone or post | Consent, or legitimate interests where permitted. Electronic marketing also follows PECR, including the product-and-service soft opt-in only where every condition is met | We do not use health information to target marketing unless we have an appropriate Article 9 condition, normally explicit consent |
| Website security, essential functions, audience measurement and advertising | Legitimate interests for security and strictly necessary technologies; consent for non-essential cookies and similar technologies | Not normally applicable |
| Business restructuring, acquisition, clinic transfer or continuity of care | Legitimate interests in responsible business administration and continuity of care; contract; or legal obligation, depending on the circumstances | Article 9(2)(h) where health information is necessary for care or the management of care; Article 9(2)(f) where required for legal claims |
Our legitimate interests include providing and improving safe hearing care, managing our clinics and systems, protecting people and information, preventing fraud, administering the business, maintaining appropriate records and communicating relevant services.
We assess necessity and the effect on your rights before relying on legitimate interests.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not make earlier use unlawful and does not affect processing based on another lawful basis.
6. Marketing and your choices
Service messages—such as appointment confirmations, safety notices and aftercare communications—are not the same as marketing.
For marketing emails and texts to individuals, we use consent or the limited PECR soft opt-in where we obtained the details directly during a sale or genuine sales enquiry, offered an opt-out at collection, market only our own similar services and include an opt-out each time.
The Hearing Clinic UK and UK Hearing Centres are operated by the same legal company. Where the law allows us to market under an existing permission or the PECR soft opt-in, we consider what the person was told, which brand they dealt with and what they would reasonably expect.
We do not use a change of brand name to override an opt-out or expand marketing beyond those reasonable expectations.
You can opt out at any time using the unsubscribe link, replying “STOP” where offered, or contacting us. We keep a minimal suppression record so that we continue to respect your choice.
7. Who we share information with
We share only what is necessary with appropriate recipients, which may include:
- clinicians, authorised staff and contractors involved in your care;
- your GP or another healthcare professional, where lawful and appropriate;
- hearing-device manufacturers, laboratories, repair, warranty and delivery providers;
- Cliniko and other clinical-record, booking and communications providers;
- website, hosting, IT, cybersecurity, telephone, email and document providers;
- payment, finance, accounting, audit, insurance and professional advisers;
- Mailchimp or other campaign platforms, and Google or Meta services where relevant and permitted by your choices;
- another care provider when you ask for, or we lawfully arrange, a referral, shared service or transfer of care;
- regulators, courts, law enforcement, public authorities or safeguarding bodies where required or permitted by law; and
- a prospective or actual buyer, seller or successor in a properly managed business or clinic transfer.
Processors act under written contracts. If another organisation determines its own purposes for using information, it is a separate controller and must provide its own privacy information.
We do not sell personal information.
8. Business and care transfers
If we acquire, transfer or close a clinic, or another provider takes over care, relevant records may need to move to preserve safe care, warranties, servicing and aftercare.
Before a transfer, we assess the lawful basis, data minimisation, security, transparency and the recipient’s role. We use written data-sharing or transfer arrangements and give affected people a specific notice where required.
A transfer of care does not automatically authorise unrelated marketing. Marketing permissions and suppression records are reviewed separately.
9. International transfers
Some suppliers may process information outside the UK. Where the destination is not covered by UK adequacy regulations, we use an approved safeguard—such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses—and complete the required risk assessment.
We also apply security and data-minimisation measures. You may contact us for more information about the relevant safeguard.
10. How long we keep information
| Record | Retention approach |
|---|---|
| Adult clinical and hearing-care records | Normally seven years after the last episode of care, unless a longer period is necessary for ongoing care, warranty or aftercare, a complaint or claim, safeguarding, professional guidance or another legal reason. |
| Children’s clinical records | Kept for longer than adult records, taking account of the child’s age when care ends, professional guidance, limitation periods, safeguarding and ongoing care. The exact disposal date is recorded in our retention schedule. |
| Financial and tax records | Normally six years after the relevant accounting period, or longer if required by law or an active dispute. |
| Enquiries that do not become care | Normally up to two years after the enquiry closes, unless needed for a complaint, claim or suppression record. |
| Marketing records | While permission remains valid and the relationship is active. We retain minimal consent and suppression evidence for as long as needed to demonstrate and respect your choice. |
| Website analytics and cookie data | According to the period shown in our cookie-management tool and supplier settings; non-essential storage begins only after consent. |
| Recruitment records | Normally six months after the recruitment process ends for unsuccessful applicants, unless the applicant agrees to a longer talent-pool period or a legal issue requires retention. |
When the retention period ends, we securely delete or anonymise the information. Legal holds, safeguarding or an active complaint or claim may pause routine deletion.
11. Security
We use proportionate technical and organisational safeguards, including access controls, multi-factor authentication where available, encryption in transit, secure clinical systems, staff confidentiality and training, supplier checks, backup and incident-response procedures.
No system is completely risk-free, but we review safeguards and limit access to people who need it.
12. Cookies and similar technologies
Strictly necessary technologies support security and core website functions. We ask for consent before using non-essential analytics, advertising, tracking pixels or similar technologies.
You can reject non-essential technologies as easily as accepting them and change your choice at any time through “Cookie settings” in the website footer. Our separate Cookie Notice and the live cookie panel provide current details.
13. Automated decisions
We do not currently make decisions about your care or eligibility that have legal or similarly significant effects based solely on automated processing.
Digital tools may assist staff with administration, booking, transcription or analysis, but appropriately qualified people remain responsible for clinical decisions.
If this changes, we will explain the logic, significance, safeguards and your right to human intervention before the processing begins.
14. Your rights
Depending on the circumstances and lawful basis, you may have rights to:
- be informed and obtain a copy of your personal information;
- correct inaccurate or incomplete information;
- request erasure or restriction;
- receive certain information in a portable format;
- object to processing based on legitimate interests;
- object to direct marketing at any time;
- withdraw consent; and
- ask for human review of a significant solely automated decision, if one is ever used.
Some rights are not absolute. For example, we may need to retain clinical records despite an erasure request. We will explain our decision.
We normally respond within one month after receiving any information reasonably required to confirm identity or clarify the request. We carry out reasonable and proportionate searches.
Your right to object
You can object at any time to direct marketing. You can also object to processing based on legitimate interests. We will stop direct marketing and will consider other objections in accordance with the law.
15. Data-protection complaints
You can complain to us by emailing info@thehearingclinicuk.co.uk with the subject “Data protection complaint”, by telephoning 0333 320 7788, or by writing to our registered office.
Please explain what happened and the outcome you would like.
We will acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome.
You may also complain to the UK data-protection regulator through ico.org.uk/make-a-complaint . We would appreciate the opportunity to resolve the matter first.
16. Changes to this notice
We review this notice when our services, suppliers, ownership or the law changes. We will publish the updated version here and will actively tell affected people where a change is material or unexpected.
This notice is patient-facing privacy information. It is supported by internal records of processing, retention, security, data-sharing, marketing, rights-request and complaints procedures.