Your information.
Handled with care.

FITCARDIOLOGY LTD is a company registered in England and Wales. The company number is 16457244.

For the purposes of applicable data protection law, FITCARDIOLOGY LTD may act as a controller of personal information collected through this website and in connection with enquiries handled by the company, where it determines the purposes and means of that processing.

This policy concerns website visitors, people making general enquiries, individuals requesting appointment information and other people who communicate with us through the contact channels described on this website.

The information collected depends on how you interact with the website and which details you choose or are asked to provide. This may include the following categories, where applicable.

Contact and identification details

• Name and preferred form of address.
• Email address and telephone number.
• Information needed to identify and respond to an enquiry.

Appointment and referral enquiry information

• Your preferred contact method and appointment preferences.
• Details about the administrative nature of your enquiry.
• Referral-related information or documents, where requested through an appropriate channel and necessary for the enquiry.
• Relevant correspondence about appointment requests and arrangements.

Technical and website information

Depending on the website configuration, we or our service providers may process technical information such as IP address, browser type, device information, pages visited, timestamps, cookie identifiers and website error or security logs.

Information you choose to send

Please provide only information relevant to your enquiry. Do not submit passwords, payment card details or detailed medical records through a general contact form. If additional documentation is necessary, we will explain the appropriate submission method where one is available.

Subject to the circumstances and applicable law, personal information may be used for the following purposes:

• Responding to questions and general correspondence.
• Reviewing and coordinating appointment enquiries.
• Clarifying referral information and administrative requirements.
• Communicating relevant information about proposed or confirmed arrangements.
• Maintaining appropriate enquiry, business and correspondence records.
• Operating, maintaining and securing the website and its forms.
• Identifying and addressing technical errors, misuse or potential security incidents.
• Meeting applicable legal obligations and establishing, exercising or defending legal claims where necessary.

We do not describe website enquiries as clinical assessments. Any clinical service or processing undertaken by a separate healthcare provider is subject to the actual arrangements and privacy information applicable to that provider.

We do not state that information is used for advertising, profiling or automated clinical decisions unless such processing is actually introduced and appropriately disclosed.

UK data protection law requires a valid lawful basis for processing personal information. The basis used depends on the purpose and circumstances of the particular processing.

Depending on the situation, the relevant basis may include:

• Steps before entering into a contract or performance of a contract: where processing is necessary to respond to a request for proposed services or fulfil an agreement with you.
• Legitimate interests: where necessary for an identified legitimate interest, after assessing the impact on your rights and freedoms and where this basis is appropriate.
• Legal obligation: where processing is necessary to comply with a legal requirement.
• Consent: where consent is the appropriate legal basis for the specific activity and has been validly obtained.

Not every lawful basis applies to every activity. The company should identify and document the applicable basis before processing the relevant information.

Where information concerning health or another special category is processed, an additional condition under Article 9 UK GDPR is required, alongside an Article 6 lawful basis. Where required, relevant conditions and safeguards under the Data Protection Act 2018 must also be met.

Information about a person’s physical or mental health can constitute special category personal data. Appointment or referral information may also reveal information about health, depending on its content and context.

We aim to limit collection to information reasonably necessary for the relevant enquiry or arrangement. Where special category data is processed, the applicable legal condition and safeguards must be established for that activity before processing begins.

Depending on the actual service and responsibilities involved, this may require specific arrangements for access controls, confidentiality, record handling and secure communication.

Please do not send detailed medical histories, test results, identity documents or other sensitive records through a general enquiry form unless an appropriate method has been provided and the information has been requested.

Personal information may be disclosed where necessary and lawful for the purposes described in this policy. Depending on the actual arrangements, recipients may include:

• Website hosting, maintenance and technical support providers.
• Providers that operate the website’s forms, email or communication systems.
• Professional advisers, auditors or insurers where necessary and appropriate.
• Healthcare professionals or organisations involved in a requested arrangement, where necessary and lawful.
• Courts, regulators, law enforcement bodies or other authorities where disclosure is required or legally permitted.

Service providers should only receive information appropriate to their role and should be subject to relevant contractual, confidentiality and data protection requirements where applicable.

We do not claim that information is shared with a particular healthcare organisation or professional unless that sharing is part of the actual arrangement. We do not sell personal information as a commercial data product.

Some website or communication service providers may process information outside the United Kingdom. Whether an international transfer occurs depends on the providers and technical configuration actually used.

Where personal information is transferred internationally, the transfer must comply with applicable UK data protection law. Depending on the destination and circumstances, this may require applicable adequacy regulations, appropriate safeguards such as an approved transfer agreement, or another permitted transfer mechanism.

Information about relevant safeguards and how to obtain further details can be requested using the contact details below.

Personal information should be kept only for as long as necessary for the purpose for which it was collected, taking account of applicable legal, regulatory, contractual and record-keeping requirements.

The appropriate retention period may differ between general enquiries, appointment correspondence, financial records, technical logs and records containing health information.

We should maintain a retention schedule that reflects the company’s actual activities and applicable requirements. When information is no longer needed, it should be securely deleted, destroyed or irreversibly anonymised where appropriate, unless continued retention is legally required or permitted.

This policy does not impose one universal retention period on all information because the applicable period depends on the record type and circumstances.

Appropriate technical and organisational measures should be used to protect personal information against unauthorised access, accidental loss, alteration, disclosure or destruction. The measures required depend on the nature of the information, the risks involved and the systems used.

Such measures may include access restrictions, appropriate account security, software maintenance, secure transmission where supported, backups and procedures for handling suspected data incidents.

No website or method of electronic transmission can be guaranteed to be completely secure. Please avoid sending unnecessary sensitive information through general website forms or ordinary email.

This website may use cookies or similar technologies that support essential website functions, remember preferences, protect forms or measure website usage, depending on the services enabled.

Non-essential cookies and similar technologies should only be used in accordance with applicable requirements, including obtaining consent where required. The exact technologies used depend on the website’s current configuration.

You can manage available cookie choices through the website’s cookie controls, if provided, and through your browser settings. Blocking certain cookies may affect some website functions.

For further details, please read our Cookie Policy.

Subject to the applicable legal conditions and exemptions, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate or incomplete information.
• Request erasure of personal information where the legal requirements are met.
• Request restriction of processing in circumstances provided by law.
• Object to processing based on legitimate interests or another applicable ground where the law provides this right.
• Receive certain information in a portable format where the right to data portability applies.
• Withdraw consent where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Make a complaint to the Information Commissioner’s Office (ICO) if you believe your information has been handled contrary to applicable data protection law.

These rights are not absolute and may be subject to legal conditions or exemptions. For example, information may need to be retained where a legal obligation applies.

To make a request, contact us using the details below and explain what you would like us to do. We may need to verify your identity before acting on a request.

Where the UK GDPR statutory response period applies, the usual deadline is one calendar month from receipt of a valid request. This period may be extended by up to a further two months for complex or multiple requests, where the law permits; if an extension applies, we must provide the required notice within the applicable period.

If you have a question or concern about how your personal information is handled, please contact us first so that we can review the matter.

You also have the right to complain to the UK Information Commissioner’s Office. Information about how to contact the ICO and how to raise a concern is available at ico.org.uk/make-a-complaint/ .

Making a complaint to us does not remove any statutory rights you may have to contact the ICO.

Where an enquiry concerns a child or another person who is represented by someone else, we may need to establish the authority of the person making the enquiry before disclosing information or taking action.

Personal information relating to children should be handled with particular care. Please do not submit a child’s detailed health information through a general contact form unless necessary and an appropriate method has been provided.

Applicable legal requirements and the circumstances of the request will determine what information can be processed and disclosed.

This website may contain links to external websites or services for additional information. Those websites operate under their own privacy notices and practices.

We recommend reviewing the relevant privacy information before providing personal information to an external website. The inclusion of a link does not, by itself, mean that FITCARDIOLOGY LTD operates, controls or endorses that external service.

This policy may be updated when our website, enquiry processes, service providers or applicable legal requirements change. The version published on this page is intended to describe the information-handling practices applicable at the time it is displayed.

If a change materially affects how personal information is processed, additional information or communication will be provided where required by law.

For questions about this Privacy Policy, or to make a request concerning your personal information, please use the contact details below.