Privacy Notice

1. About this notice

This notice explains how London Pain Management Ltd collects, uses, shares, stores and protects personal information in connection with private medical care provided by Dr Oliver Seyfried. It also explains your data-protection rights.

London Pain Management Ltd is the data controller for the information described in this notice. Dr Seyfried also has professional duties of confidentiality under applicable medical guidance.

2. Contact details

Controller: London Pain Management Ltd
Clinical lead: Dr Oliver Seyfried
Email: orseyfried@doctors.org.uk
Website: www.londonpainmanagement.com
ICO registration: ZA189473

3. Information we collect

Depending on your care and how the practice is administered, we may collect:

• identity and contact information, including your name, date of birth, address, telephone number and email address;
• clinical information, including symptoms, diagnoses, medical and medication history, allergies, examination findings, investigations, images, treatment plans and outcomes;
• referral letters, clinic correspondence, consent records and communications with you or other healthcare professionals;
• appointment, billing, insurer, authorisation and payment information;
• audio recordings and AI-assisted working transcripts when you agree to recording;
• information needed to respond to concerns, complaints, legal claims, regulatory enquiries or safeguarding issues;

4. Where the information comes from

We usually receive information directly from you. We may also receive relevant information from your GP or referrer, hospitals and clinics, other treating professionals, diagnostic providers, private medical insurers, a person authorised to act for you, or publicly available professional and regulatory sources where appropriate.

5. Why we use your information

• to assess, diagnose, advise on and provide healthcare;
• to prepare and maintain accurate clinical records and correspondence;
• to arrange appointments, investigations, procedures, prescriptions, referrals and follow-up;
• to communicate with you, your GP, referrer and other professionals involved in your care;
• to administer fees, insurer authorisations, invoices and payments;
• to meet professional, legal, regulatory, safeguarding and insurance obligations;
• to investigate and respond to concerns, complaints, incidents or legal claims;

6. Our lawful bases

Under Article 6 of the UK GDPR, the relevant lawful bases may include performance of a contract or steps taken at your request before entering a contract; compliance with legal obligations; and the legitimate interests of providing, administering and protecting a safe private medical service. Where the law requires consent for a specific optional activity, we will ask for it separately.

Because clinical information is special-category data, we principally rely on Article 9(2)(h): processing necessary for medical diagnosis and the provision or management of healthcare by, or under the responsibility of, a healthcare professional subject to duties of confidentiality. Where relevant, we may also rely on Article 9(2)(f) for the establishment, exercise or defence of legal claims, or explicit consent for a specific optional use.

7. Audio recording and AI-assisted documentation

With your agreement, Dr Seyfried may make an audio recording of a consultation and use an AI-assisted transcription service to help prepare clinical notes and correspondence. This supports accurate documentation and allows greater attention to be given to the consultation.

You will be informed in advance and asked for your agreement at the start of the consultation. You may decline or ask for recording to stop at any time without this affecting your care. If you decline, conventional clinical notes will be taken instead. The key elements of the consent discussion are recorded in your clinical record.

The recording may contain personal and special-category health information. PLAUD provides the recording and transcription service and may use contracted subprocessors to perform transcription, summarisation and related AI processing. PLAUD has confirmed in writing that, for United Kingdom accounts, recordings, transcripts and summaries are stored on Amazon Web Services in Frankfurt (eu-central-1), and that AI processing is routed through European-based API endpoints. PLAUD identified OpenAI, Google and Microsoft as AI subprocessors operating under enterprise API terms providing zero retention and no training on customer data. Its current subprocessor information is published in its Trust Center.

London Pain Management currently uses an individual PLAUD Pro subscription. PLAUD has stated that its processor Data Processing Addendum, incorporated into its Commercial Terms, applies to the Team plan. London Pain Management does not represent that the Team-plan Data Processing Addendum applies to the current Pro subscription and is reviewing the appropriate contractual arrangements for processing identifiable clinical information.

AI-generated transcripts, notes and letters are working drafts. Dr Seyfried reviews and corrects the output before information is entered into the clinical record. AI is not used to make autonomous diagnoses, treatment decisions or other decisions about your care.

When PLAUD Cloud Sync is disabled, PLAUD states that audio is processed on demand only when an AI feature is invoked and that no persistent server-side copy is retained after processing. When Cloud Sync is enabled, the storage and deletion arrangements described in this notice apply.

The final reviewed clinical letter and relevant notes are stored in Carebit. Audio and working transcripts are retained only for as long as reasonably necessary to prepare, verify and safely file the clinical record, then securely deleted under the practice retention schedule. If a recording becomes clinically or legally significant, it may be retained with the clinical record for the applicable period.

8. Who we may share information with

We share only the information reasonably necessary for the relevant purpose. Recipients may include:

• your GP, referrer and other healthcare professionals involved in your care;
• the independent hospital or clinic where you are assessed or treated;
• diagnostic, pharmacy, laboratory and imaging providers;
• your private medical insurer, where authorised or otherwise lawfully required;
• Carebit, which supports practice administration and the clinical record;
• PLAUD and its approved subprocessors for recording and transcription where you have agreed;
• secretarial, accounting, payment, IT, legal, indemnity and professional advisers who are subject to appropriate duties;
• regulators, courts, public authorities or safeguarding bodies where disclosure is required or otherwise justified by law;

We do not sell patient information.

9. International processing

PLAUD has confirmed that storage for United Kingdom accounts is in Frankfurt, Germany, and that AI processing for these accounts is routed through European-based API endpoints. Transfers from the United Kingdom to the European Economic Area are subject to the applicable United Kingdom data-protection framework, including relevant adequacy regulations. Where a further restricted transfer occurs, PLAUD states that it uses the European Commission’s Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914. London Pain Management seeks to ensure that any transfer mechanism is appropriate under applicable United Kingdom law.

PLAUD publishes current security and subprocessor information in its Trust Center. Its published Data Processing Addendum includes the Standard Contractual Clauses, but PLAUD has stated that this agreement applies to the Team plan rather than the individual Pro subscription currently used by London Pain Management.

10. Security

We use proportionate technical and organisational safeguards, including access controls, secure accounts, encryption where provided by our systems, confidentiality obligations, data minimisation, controlled sharing and secure deletion. Access is limited to people and providers who need the information for an authorised purpose.

No system can eliminate every risk. Suspected losses, unauthorised access or other personal-data incidents are assessed and managed under the practice data-breach procedure, including notification where legally required.

11. Retention

Clinical records are retained in accordance with applicable legal and professional requirements and the Records Management Code of Practice for Health and Social Care, even where care is provided privately. Different categories of information may have different minimum periods.

Financial and tax records are generally retained for the period required by HM Revenue & Customs and applicable company law. Administrative information is deleted or anonymised when no longer required.

Audio recordings and AI-generated working transcripts are reviewed regularly and deleted when no longer needed for preparing and verifying the clinical record. They are not retained indefinitely merely because cloud storage is available. PLAUD states that its backups are encrypted using AES-256, remain within its AWS European environment and are retained for 30 days. It also states that user-initiated deletion is synchronised to backups and that any residual backup copy ages out within that 30-day period. Where a recording is required for an incident, complaint, safeguarding concern or legal claim, it may be retained for longer.

12. Your rights

Depending on the circumstances, you may have rights to:

• be informed about how your information is used;
• request access to your personal information;
• ask for inaccurate or incomplete information to be corrected;
• ask for deletion or restriction of processing where the legal conditions are met;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent where a particular activity is based on consent, without affecting earlier lawful processing;

These rights are not absolute. In particular, clinical records may need to be retained where professional, legal, regulatory or patient-safety requirements apply. We may need to verify your identity before responding to a request.

13. Complaints

Please contact London Pain Management Ltd first if you have a question or concern about how your information has been handled. We will try to resolve the matter promptly.

You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk or 0303 123 1113.

14. Website information

The practice website may collect limited technical information needed for security and operation and may use cookies or analytics depending on the settings active when you visit. Where non-essential cookies are used, appropriate choices should be provided. Information submitted through a contact form or email is used to respond to the enquiry and administer any resulting appointment or care.

15. Changes to this notice

This notice will be reviewed when the practice changes how it handles information, when a relevant supplier or law changes, and at least annually. The current version and effective date will be shown on the practice website.