The Iron Infusion Centre

Privacy Policy

Last updated: April 2026


1. Who we are

The Iron Infusion Centre is a private healthcare provider operating in London and Hertfordshire. Iron infusions are provided by Dr Bhavini Patel (GMC No: 7293975) and Dr Nick Mulrenan (GMC No: 7177283), both GMC-registered General Practitioners.

Clinical services are delivered in appropriate clinical settings in accordance with applicable regulatory requirements, clinical governance standards, and the requirements of any host or partner healthcare provider where services are provided.

Administrative, website, and marketing activities are managed by The Iron Infusion Centre Ltd.

Our contact details:
Addresses:
London Clinic: 59 Mount Pleasant, London, WC1X 0AY
Registered Address: 6-7 East Street, Ware, Hertfordshire SG12 9HJ
Email: [email protected]
Telephone: 01920 633 050

Data protection responsibilities
The Iron Infusion Centre Ltd is registered with the Information Commissioner’s Office (ICO) and acts as the Data Controller for personal and clinical data collected in the course of providing healthcare services.

We are responsible for ensuring that your personal and medical information is handled securely, lawfully, and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Where services are delivered in partnership with other healthcare providers, those providers may have their own data protection responsibilities in relation to their services. However, The Iron Infusion Centre Ltd remains the Data Controller for patient information collected and processed as part of our clinical services.


2. The information we collect

When you use our website, contact us, or attend an appointment, we may collect the following types of information:

  • Personal details – name, address, date of birth, phone number, email address.

  • Medical information – relevant medical history, symptoms, allergies, test results, and referral information.

  • Administrative details – payment and invoicing information, insurance details (where applicable).

  • Technical data – your IP address, browser type, and anonymised analytics data (via Google Analytics 4 (GA4)).

  • Communication records – enquiries, emails, or messages exchanged with our clinic team.

We collect this information to provide safe and effective healthcare, manage appointments and billing, and improve our website and services.


3. How we use your information

We use your information to:

  • Book and manage appointments – including consultations, blood tests, and treatments.

  • Provide safe, evidence-based medical care – ensuring that your assessment and treatment are appropriate for your clinical needs.

  • Communicate with you – about appointments, treatment plans, results, and follow-up care.

  • Maintain accurate clinical records – as required by medical and legal standards.

  • Process payments and invoices – for consultations, investigations, and treatments.

  • Meet our legal and regulatory obligations – including those of the Care Quality Commission (CQC) (where applicable), General Medical Council (GMC), and HM Revenue & Customs (HMRC).

We will never sell or share your information for marketing or commercial gain.


4. Our lawful basis for processing

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we must have a lawful basis to collect and use your personal information.
The lawful bases we rely on are:

  • Provision of healthcare (Article 9(2)(h)) – for the assessment, diagnosis, and treatment of health conditions, and the management of healthcare systems and services.

  • Performance of a contract (Article 6(1)(b)) – when you book or receive a consultation, investigation, or treatment with us.

  • Legitimate interests (Article 6(1)(f)) – for essential administrative purposes, such as appointment reminders, quality monitoring, and responding to enquiries.

  • Legal obligations (Article 6(1)(c)) – where we are required by law to retain or share information (e.g. with the CQC, GMC, HMRC, or insurers).

  • Consent (Article 6(1)(a)) – only when you have explicitly agreed to optional communications, such as marketing updates.

We process medical information as special category data under Article 9(2)(h) (provision of health or social care).
We only collect the minimum information necessary to deliver safe, effective care and meet our professional and regulatory duties.


5. How we share your information

We only share your information when it is necessary for your care, for administrative purposes, or when required by law.
We will never sell or disclose your information for marketing purposes.

Your information may be shared with:

  • Healthcare professionals involved in your care – for example, your GP or other specialists, when appropriate and with your consent (unless there is a legal requirement to share).

  • Accredited laboratories – for arranging blood tests and reviewing results.

  • Regulatory and professional bodies – such as the Care Quality Commission (CQC), General Medical Council (GMC), or HM Revenue & Customs (HMRC), when legally required to do so.

  • Service providers and data processors – including our secure clinical software, email, and IT system providers, who help us deliver our services and are bound by strict confidentiality and data protection agreements.

  • Legal or insurance bodies – where disclosure is necessary to establish, exercise, or defend legal claims, or to comply with indemnity and audit requirements.

  • Partner clinics and facilities – where services are delivered within another healthcare provider’s premises (such as Lanthorn Diagnostics Ltd), limited information may be shared where necessary for clinical governance, patient safety, and operational purposes.

Where you have asked us not to share information with your GP, we will respect this unless there is a serious risk to your safety or that of others.

All third parties are required to handle your information securely and in accordance with the UK GDPR and Data Protection Act 2018.


6. How we store your information

  • We take data security seriously and use technical and organisational measures to protect your information in accordance with the UK GDPR and Data Protection Act 2018.

    • Clinical records are stored securely in electronic systems that meet UK healthcare data standards, with access restricted to authorised clinical staff only.

    • Administrative and payment records are held in secure, encrypted systems and retained in accordance with HMRC and professional record-keeping requirements.

    • Emails and electronic communications are transmitted using encrypted or secure servers.

    • Data hosting is located within the UK or EEA, and any approved third-party processors are contractually bound to maintain confidentiality and data protection standards.

    • Health records are retained for a minimum of 8 years after the last episode of care, in line with UK healthcare records management guidelines.

    • After the retention period, information is securely deleted or anonymised so it can no longer identify you.


7. Your rights under GDPR

Under the UK General Data Protection Regulation (UK GDPR), you have several rights regarding the personal information we hold about you.
You may exercise these rights at any time by contacting us at [email protected].

You have the right to:

  • Access your information – to request a copy of the personal or medical information we hold about you.

  • Request correction – to ask us to correct any inaccurate or incomplete information.

  • Request erasure – to ask for your data to be deleted where it is no longer required, or where you have withdrawn consent (except where we are required by law to retain it).

  • Restrict or object to processing – to limit how we use your data in certain situations.

  • Request data transfer – to obtain your data in a structured, commonly used electronic format, or have it transferred directly to another healthcare provider.

  • Withdraw consent – to withdraw consent for communications or marketing at any time (without affecting the lawfulness of any prior processing).

We aim to respond to all data access or correction requests within one month, in accordance with UK GDPR requirements.

If you have concerns about how we handle your information, you also have the right to contact the Information Commissioner’s Office (ICO):
www.ico.org.uk
Telephone: 0303 123 1113


8. Cookies and website data

Our website uses cookies to help it function correctly, analyse traffic, and improve the user experience.
Cookies are small text files stored on your device when you visit our site.

You can manage or disable cookies at any time through your browser settings. For more information, please see our Cookie Policy, which explains what cookies we use and how you can control them.


9. Marketing

We do not use your contact details for marketing purposes, and we do not send marketing or promotional emails.
Your information is used solely to manage your enquiry, appointment or ongoing care with The Iron Infusion Centre.

We do not sell, share or disclose your information to any third parties for marketing.


10. How to complain

If you have concerns about how we handle your personal information, please contact us first at [email protected] so we can address the issue promptly.

If you remain dissatisfied after our response, you have the right to raise your concern with the Information Commissioner’s Office (ICO), who regulate data protection in the UK:

W: www.ico.org.uk
T: 0303 123 1113


11. Data Controller and Contractual Arrangements

The Iron Infusion Centre Ltd acts as the Data Controller for all patient information collected in the course of providing its services.

Where services are delivered within partner clinics or facilities, those providers may have separate responsibilities for their own operational, regulatory, and clinical governance requirements. However, The Iron Infusion Centre Ltd remains responsible for the collection, use, and protection of patient data relating to its clinical services.

We ensure that any data sharing with partner organisations is limited to what is necessary and carried out in accordance with UK GDPR, the Data Protection Act 2018, and appropriate data-sharing agreements where required.


12. Governing Law

This Privacy Policy and any dispute or claim arising from it (including non-contractual matters) shall be governed by and construed in accordance with the laws of England and Wales.

By using our services or website, you agree that any disputes relating to data protection or privacy shall fall under the exclusive jurisdiction of the courts of England and Wales.

© 2026 The Iron Infusion Centre Ltd. All Rights Reserved.