Privacy policy (UK GDPR)

Draft - not yet legally reviewed. This policy is a working draft and must be reviewed by a UK/Tunisia data-protection lawyer before publication. Items marked [À DÉFINIR] still need to be confirmed, in particular the identity of the data controller and the safeguards for transferring health data to Tunisia.

This policy explains how we collect, use and protect your personal data, including health data, in line with the UK GDPR and the Data Protection Act 2018.

Who is responsible for your data

The data controller is [À DÉFINIR - responsable de traitement à désigner].

You can contact us about privacy at contact@nose-clinic.co.uk.

What data we collect

Identity and contact details: your name, email, phone number.
Health information: details you share about your nose, medical history and goals, and any photos you send. This is special category (health) data.
Enquiry content: what you write in the consultation form or by message.
Technical data: basic website analytics [À DÉFINIR - préciser si des cookies analytiques sont utilisés].

Why we use it, and our lawful basis

To respond to your enquiry and arrange a consultation.
To provide and follow up on care if you proceed.
Our lawful basis for health data is your explicit consent (UK GDPR Article 9(2)(a)); you can withdraw it at any time. For general contact data we rely on taking steps at your request (Article 6(1)(b)) and our legitimate interests (Article 6(1)(f)).

International transfer to Tunisia

Because your surgery would take place in Tunis, Tunisia, some of your data (including health data and photos) would be transferred outside the UK to the surgical team in Tunisia. Tunisia is not covered by a UK "adequacy" decision, so this transfer relies on appropriate safeguards and/or your explicit consent to the transfer. [À DÉFINIR - garanties exactes à valider avec le juriste : consentement explicite au transfert et/ou clauses contractuelles.]

How long we keep your data

We keep your data only as long as necessary for the purposes above and to meet legal obligations. [À DÉFINIR - durées de conservation précises.]

How we protect it

We use appropriate technical and organisational measures to protect your data, we minimise what we collect, and we do not put health data in URLs. [À DÉFINIR - détailler chiffrement au repos, contrôle d'accès, etc.]

Your rights

Under UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. To exercise any of these, contact contact@nose-clinic.co.uk.

Complaints

If you have concerns about how your data is handled, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Changes to this policy

We may update this policy; the current version applies from the date shown when published. [À DÉFINIR - date d'entrée en vigueur.]