top of page

PRIVACY POLICY

Introduction

This privacy notice outlines how XCV Group Ltd collects, uses, protects and transfers your personal data.

The Data Protection Officer / Data Owner for the organisation is XCV Group Ltd. You can contact the Data Protection Officer by emailing contact@thehendonclinic.co.uk or writing to:

XCV Group Ltd
54 Vivian Avenue
London
NW4 3XH

 

Personal Data Collected

The personal data that we collect includes:

  • Name

  • Home address

  • Email address

  • Date of birth

  • Phone number

  • Health information

 

Purpose and Legal Basis for Processing Your Data

XCV Group Ltd takes your privacy seriously and will never sell or rent your personal data to any third party. Sharing of your data and direct marketing activities are only carried out with your express consent, which you are free to withdraw at any time.

We obtain and process your personal data to provide you with our products, services and treatments and to fulfil our legal and business obligations. We will never collect personal information that we do not need or retain data that is no longer necessary.

Where we request sensitive personal data (such as health or medical information), the reason for the request will be clearly explained. Explicit consent (via signature) is required before we process your health information.

 

Who is Processing My Data?

XCV Group Ltd, 54 Vivian Avenue, London, NW4 3XH is the Data Controller.

Phorest, Anglesea Mills, 9 Anglesea Row, Smithfield, Dublin 7, D07 W5NE, Ireland, acts as a Data Processor on behalf of the clinic. Phorest only accesses personal information for customer support or troubleshooting and must process data in accordance with this Privacy Notice and data protection laws.

Your Personal Data Is Processed To:

  • Collect personal data required to enter into a contract for services or products

  • Communicate with you regarding appointments and bookings

  • Collect health information to ensure treatments are carried out safely

  • Provide appropriate advice and safe services

  • Send relevant offers, promotions and information (with consent)

  • Maintain required records for legal, insurance and tax purposes

  • Store customer records securely

 

Your Rights as an Individual

You have the right:

  • To be informed how your data is used

  • To access your personal data

  • To correct inaccurate or incomplete data

  • To request deletion of data where there is no reason for continued processing

  • To restrict or block processing

  • To data portability

  • To object to direct marketing

You can withdraw marketing consent at any time using the unsubscribe link or by contacting us.

 

Special Categories of Personal Data

Health information is collected through consultation and consent forms to ensure treatments are safe and suitable. You may withdraw consent at any time, subject to legal, insurance and contractual obligations.

 

Process of Collection

Your data may be collected via:

  • Phorest software

  • Our website

  • Phone calls

  • In clinic

  • Email

  • Social media

  • Written forms

Records are stored securely within Phorest and in limited paper form where necessary.

 

Children's Privacy

XCV Group Ltd does not knowingly collect personal data from children under 13 without parental consent. If such data is identified, it will be removed.

 

Data Sharing

Your data is only shared with Phorest where necessary for support. We do not share your data with third parties unless legally required.

 

Use of Data Processors

We use trusted third parties under strict agreements to process data securely and lawfully.

Phorest is used for appointment scheduling, CRM and marketing.

 

How Long Do We Keep Your Data?

We retain data:

  • Minimum 7 years for tax/legal purposes

  • 10 years for health & safety records

  • Marketing data until you withdraw consent

We may retain data longer where required for legal claims.

 

Transfers of Personal Information

Data processed through Phorest is stored within the EU using AWS cloud services and is encrypted in transit and at rest.

Consequences of Not Providing Personal Data

If you do not provide required personal information, we may be unable to provide treatments or services.

 

Safeguarding Your Personal Data

We take appropriate security measures including:

  • Encrypted connections to Phorest (HTTPS/TLS)

  • Restricted staff access

  • Locked storage for paper records

 

Complaints

If you are unhappy with how your data is handled, you may contact us or the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
0303 123 1113

 

Data Protection Officer

XCV Group Ltd
54 Vivian Avenue
London
NW4 3XH

contact@thehendonclinic.co.uk
07771125990

bottom of page