Data Protection Information

Introduction
At Heartstone Group, we are committed to protecting and respecting your privacy. This Data Protection Information explains how we collect, use, store, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What Information We Collect
We may collect and process the following personal data:

• Personal details (e.g., name, date of birth, contact details)
• Health information (e.g., medical history, diagnostic images, reports)
• Payment and billing details (if applicable)
• Communication records (e.g., emails, appointment requests)

How We Use Your Data
We process your data to:

• Provide diagnostic imaging services and medical reporting
• Manage appointments and communicate with you about your care
• Ensure compliance with legal and regulatory requirements
• Improve service quality and patient safety

Legal Basis for Processing
We process personal data under the following lawful bases:

• Consent: When you agree to share your health data for imaging and reporting
• Contractual obligation: To provide services as per your appointment
• Legal obligation: Compliance with healthcare regulations
• Legitimate interest: Service improvement and security

How We Store and Protect Your Data

Your personal data is securely stored in encrypted systems with restricted access. We implement technical and organizational measures to prevent unauthorized access, data breaches, and loss.

Data Sharing

We only share your data when necessary, and only with:

• Healthcare professionals involved in your diagnosis and treatment
• Regulatory authorities when required by law
• Third-party service providers (e.g., cloud storage, software providers) under strict confidentiality agreements

Your Rights Under UK GDPR
You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data (where applicable)
• Restrict processing of your data
• Object to data processing in certain circumstances
• Request data portability

To exercise these rights, please contact us at info@heartstonegrp.org

How Long We Keep Your Data

We retain your medical records for a minimum of 8 years (or longer for certain medical conditions, per NHS guidelines). Non-medical data is kept only as long as necessary.

Contact Us

For any data protection inquiries, please contact our Data Protection Officer (DPO) at: info@heartstonegrp.org

If you have concerns about how we handle your data, you may also contact the Information

Commissioner’s Office (ICO) at www.ico.org.uk .