Who we are
Palpitation Clinic is a private cardiology service led by Dr Aftab Gill, Consultant Interventional Cardiologist (GMC 4499826). We are responsible for (the "controller" of) the personal information described in this notice. Contact us about anything in this notice using the form on our contact page.
What we collect
- Enquiries: your name, phone number, email address, the type of appointment you are interested in, the best time to call, and anything you choose to write in the message box.
- Consultations: information about your health, symptoms, medical history, medicines, test results and recordings, and details of your GP.
- Payments: a record of fees paid. We do not store card details.
- Website: our web host keeps standard server logs, such as IP addresses, for security. We do not currently use analytics or advertising cookies.
Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Responding to your enquiry and arranging an appointment | Your consent, and taking steps at your request before entering into a contract (Article 6(1)(a) and (b)) |
| Providing your consultation, tests and treatment | Contract (Article 6(1)(b)); for health information, the provision of health care (Article 9(2)(h)) |
| Keeping medical records and meeting professional and legal duties | Legal obligation (Article 6(1)(c)) and the provision of health care (Article 9(2)(h)) |
| Website security | Our legitimate interest in keeping the site secure (Article 6(1)(f)) |
Who we share it with
- Your GP, with your consent, so your records stay up to date.
- Other clinicians and services involved in your care, such as heart monitoring providers or a hospital you are referred to, only as needed for your care.
- Service providers who host our website and email, under contracts that protect your information.
- Others where the law requires it, or to protect you or someone else from serious harm.
We never sell your information or use it for marketing without your permission. Where any provider processes information outside the UK, we make sure appropriate safeguards are in place.
How long we keep it
- Enquiries that do not lead to an appointment: up to 12 months.
- Medical records: at least 8 years after your last contact with us, in line with UK guidance on adult health records.
Keeping it safe
We use secure, password-protected systems and limit access to the people who need it to care for you. Please don't send detailed medical information through the website enquiry form; we'll tell you the best way to share it once we have been in touch.
Your rights
You have the right to ask for a copy of your information, to ask us to correct it, and in some cases to ask us to delete it, restrict its use, or object to how we use it. Where we rely on your consent, you can withdraw it at any time. Some medical records must be kept even if you ask us to delete them. To make a request, contact us using the details above.
If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Last updated October 2026.