The Iron Infusion Centre

Privacy Policy

Last updated: July 2026


1. Who we are

The Iron Infusion Centre is a private healthcare provider operating in London and Hertfordshire and is operated by The Iron Infusion Centre Ltd. Iron infusions are provided by Dr Bhavini Patel (GMC No: 7293975) and Dr Nick Mulrenan (GMC No: 7177283), both GMC-registered General Practitioners.

At our Ware clinic, regulated healthcare services are provided by The Iron Infusion Centre Ltd, which is registered with the Care Quality Commission (CQC).

At our London clinic, services are provided from Lanthorn Clinic, where regulated healthcare services are delivered under the CQC registration of Lanthorn Diagnostics Ltd.

Clinical services at both locations are delivered in accordance with applicable regulatory requirements, professional standards and clinical governance arrangements.

Our contact details:

Ware Clinic:
6–7 East Street, Ware, Hertfordshire, SG12 9HJ

London Clinic:
59 Mount Pleasant, London, WC1X 0AY

Registered Office:
4th Floor, Fitzrovia House, 153–157 Cleveland Street, London, W1T 6QW

Email: [email protected]
Telephone: 01920 633 050

Data protection responsibilities
The Iron Infusion Centre Ltd is registered with the Information Commissioner’s Office (ICO) and acts as the Data Controller for personal and clinical data collected in the course of providing healthcare services.

We are responsible for ensuring that your personal and medical information is handled securely, lawfully, and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Where services are delivered within the premises of another healthcare provider, that provider may have separate data protection responsibilities for information it processes for its own operational, regulatory or clinical governance purposes. The Iron Infusion Centre Ltd remains the Data Controller for patient information that it collects and processes in connection with the clinical services it provides.


2. The information we collect

When you use our website, contact us, or attend an appointment, we may collect the following types of information:

  • Personal details – name, address, date of birth, phone number, email address.

  • Medical information – relevant medical history, symptoms, allergies, test results, and referral information.

  • Administrative details – payment and invoicing information, insurance details (where applicable).

  • Technical data – your IP address, browser type, and anonymised analytics data (via Google Analytics 4 (GA4)).

  • Communication records – enquiries, emails, or messages exchanged with our clinic team.

We collect this information to provide safe and effective healthcare, manage appointments and billing, and improve our website and services.


3. How we use your information

We use your information to:

  • Book and manage appointments – including consultations, blood tests, and treatments.

  • Provide safe, evidence-based medical care – ensuring that your assessment and treatment are appropriate for your clinical needs.

  • Communicate with you – about appointments, treatment plans, results, and follow-up care.

  • Maintain accurate clinical records – as required by medical and legal standards.

  • Process payments and invoices – for consultations, investigations, and treatments.

  • Meet our legal and regulatory obligations – including applicable requirements of the Care Quality Commission (CQC), General Medical Council (GMC), and HM Revenue & Customs (HMRC).

We will never sell or share your information for marketing or commercial gain.


4. Our lawful basis for processing

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we must have a lawful basis to collect and use your personal information.
The lawful bases we rely on are:

  • Provision of healthcare (Article 9(2)(h)) – for the assessment, diagnosis, and treatment of health conditions, and the management of healthcare systems and services.

  • Performance of a contract (Article 6(1)(b)) – when you book or receive a consultation, investigation, or treatment with us.

  • Legitimate interests (Article 6(1)(f)) – for essential administrative purposes, such as appointment reminders, quality monitoring, and responding to enquiries.

  • Legal obligations (Article 6(1)(c)) – where we are required by law to retain or share information (e.g. with the CQC, GMC, HMRC, or insurers).

We process medical information as special category data under Article 9(2)(h) (provision of health or social care).
We only collect the minimum information necessary to deliver safe, effective care and meet our professional and regulatory duties.


5. How we share your information

We only share your information when it is necessary for your care, for administrative purposes, or when required by law.
We will never sell or disclose your information for marketing purposes.

Your information may be shared with:

  • Healthcare professionals involved in your care – for example, your GP or other specialists, when appropriate and with your consent (unless there is a legal requirement to share).

  • Accredited laboratories – for arranging blood tests and reviewing results.

  • Regulatory and professional bodies – such as the Care Quality Commission (CQC), General Medical Council (GMC), or HM Revenue & Customs (HMRC), when legally required to do so.

  • Service providers and data processors – including our secure clinical software, email, and IT system providers, who help us deliver our services and are bound by strict confidentiality and data protection agreements.

  • Legal or insurance bodies – where disclosure is necessary to establish, exercise, or defend legal claims, or to comply with indemnity and audit requirements.

  • Partner clinics and facilities – where services are delivered within another healthcare provider’s premises (such as Lanthorn Diagnostics Ltd), limited information may be shared where necessary for clinical governance, patient safety, and operational purposes.

Where you have asked us not to share information with your GP, we will respect this unless there is a serious risk to your safety or that of others.

All third parties are required to handle your information securely and in accordance with the UK GDPR and Data Protection Act 2018.


6. How we store your information

  • We take data security seriously and use technical and organisational measures to protect your information in accordance with the UK GDPR and Data Protection Act 2018.

    • Clinical records are stored securely in electronic systems that meet UK healthcare data standards, with access restricted to authorised clinical staff only.

    • Administrative and payment records are held in secure, encrypted systems and retained in accordance with HMRC and professional record-keeping requirements.

    • Emails and electronic communications are transmitted using encrypted or secure servers.

    • Data hosting is located within the UK or EEA, and any approved third-party processors are contractually bound to maintain confidentiality and data protection standards.

    • Health records are retained for a minimum of 8 years after the last episode of care, in line with UK healthcare records management guidelines.

    • After the retention period, information is securely deleted or anonymised so it can no longer identify you.


7. Your rights under GDPR

Under the UK General Data Protection Regulation (UK GDPR), you have several rights regarding the personal information we hold about you.
You may exercise these rights at any time by contacting us at [email protected].

You have the right to:

  • Access your information – to request a copy of the personal or medical information we hold about you.

  • Request correction – to ask us to correct any inaccurate or incomplete information.

  • Request erasure – to ask us to delete your personal information in certain circumstances. This right is not absolute, and we may need to retain information to meet healthcare, legal, regulatory or professional requirements.

  • Restrict or object to processing – to limit how we use your data in certain situations.

  • Request data transfer – where this right applies, to receive certain personal information you have provided to us in a structured, commonly used and machine-readable format, or to ask us to transfer it to another organisation where technically feasible.

  • Withdraw consent – where we rely on your consent to process information, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

We aim to respond to all data access or correction requests within one month, in accordance with UK GDPR requirements.

If you have concerns about how we handle your information, you also have the right to contact the Information Commissioner’s Office (ICO):
www.ico.org.uk
Telephone: 0303 123 1113


8. Cookies and website data

Our website uses cookies to help it function correctly, analyse traffic, and improve the user experience.
Cookies are small text files stored on your device when you visit our site.

You can manage or disable cookies at any time through your browser settings. For more information, please see our Cookie Policy, which explains what cookies we use and how you can control them.


9. Marketing

We do not use your contact details for marketing purposes, and we do not send marketing or promotional emails.
Your information is used solely to manage your enquiry, appointment or ongoing care with The Iron Infusion Centre.

We do not sell, share or disclose your information to any third parties for marketing.


10. How to complain

If you have concerns about how we handle your personal information, please contact us first at [email protected] so we can address the issue promptly.

If you remain dissatisfied after our response, you have the right to raise your concern with the Information Commissioner’s Office (ICO), who regulate data protection in the UK:

W: www.ico.org.uk
T: 0303 123 1113


11. Data Controller and Clinical Location Arrangements

The Iron Infusion Centre Ltd acts as the Data Controller for patient information collected and processed in connection with our clinical services.

At our Ware clinic, regulated healthcare services are provided by The Iron Infusion Centre Ltd under its own Care Quality Commission registration.

At our London clinic, regulated services are delivered from Lanthorn Clinic under the CQC registration of Lanthorn Diagnostics Ltd. Lanthorn Diagnostics Ltd may have separate responsibilities for information it processes for its own operational, regulatory and clinical governance purposes.

Where information is shared with a clinic, healthcare provider or other partner organisation, this will be limited to what is necessary and handled in accordance with UK GDPR, the Data Protection Act 2018 and appropriate data-sharing arrangements where required.


12. Governing Law

This Privacy Policy and any dispute or claim arising from it (including non-contractual matters) shall be governed by and construed in accordance with the laws of England and Wales.

By using our services or website, you agree that any disputes relating to data protection or privacy shall fall under the exclusive jurisdiction of the courts of England and Wales.

© 2026 The Iron Infusion Centre Ltd. All Rights Reserved.