Privacy Notice

Effective date: 6 October 2026
Last reviewed: 6 October 2026

At Elanic, we take the privacy and confidentiality of your personal information seriously.

This Privacy Notice explains how we collect, use, store and share personal information about you when you enquire about, receive or are referred for healthcare services at Elanic, use our website, or otherwise interact with us.

It also explains your rights in relation to your information and how to contact us if you have any questions or concerns about how your information is handled.

Who we are

Elanic provides independent healthcare services from our facilities in Glasgow.

Patients may come to Elanic:

• directly as self-paying patients;
• through a private medical insurer;
• following referral by a consultant, GP or other healthcare professional;
• through an NHS Board or other healthcare organisation;
• through an employer or other organisation funding or arranging treatment; or
• through another agreed healthcare pathway.

For the purposes of data protection law, Elanic is responsible for determining how and why personal information is processed where we act as the data controller.

In some circumstances, we may work alongside other healthcare organisations and responsibilities for personal information may be shared or determined by the relevant contractual and legal arrangements.

Elanic Ltd
ICO registration number: Z2601418

What information we may collect about you

The information we collect will depend on the services you receive and your relationship with us.

It may include:

• your name, address, date of birth and contact details;
• patient identification details, including NHS or CHI number where applicable;
• emergency contact and next-of-kin details;
• referral information;
• medical history and current medical conditions;
• information about medications and allergies;
• consultation notes and clinical correspondence;
• pre-assessment information;
• clinical photographs where clinically appropriate;
• diagnostic information, including imaging and laboratory results;
• operation and procedure records;
• anaesthetic records;
• nursing and recovery records;
• follow-up and aftercare information;
• information provided by your GP, consultant or another healthcare provider;
• information relating to your private medical insurer where applicable;
• information relating to treatment funded or arranged by another organisation;
• payment and billing information;
• communications between you and Elanic;
• complaints, feedback and clinical-governance information; and
• information you provide when using our website, online forms or other digital services.

Information about your health is classed as special category personal data and receives additional protection under data protection law.

Where we obtain your information

We may receive personal information directly from you or from appropriate third parties involved in arranging or providing your care.

These may include:

• your GP;
• a consultant or other referring healthcare professional;
• another hospital or healthcare provider;
• an NHS Board or other NHS organisation;
• your private medical insurer;
• diagnostic imaging providers;
• laboratories;
• physiotherapists and other allied healthcare providers;
• organisations funding or arranging your treatment; and
• family members or authorised representatives where appropriate.

Where another organisation refers you to Elanic, we may receive relevant personal and health information before we contact you directly.

We use this information only where necessary to assess your suitability for treatment, contact you, arrange your care, provide treatment and fulfil our clinical, legal, regulatory or contractual responsibilities.

How we use your information

We may use your personal information to:

• respond to enquiries;
• assess whether our services are appropriate for you;
• arrange consultations, investigations, pre-assessment and treatment;
• provide safe and effective clinical care;
• maintain an accurate clinical record;
• communicate with you about appointments and your care;
• communicate with healthcare professionals involved in your treatment;
• arrange diagnostic tests, imaging, pathology, physiotherapy or other services;
• manage self-pay, insured, referred or externally funded treatment;
• process payments and insurance claims;
• manage referrals and treatment funded by other organisations;
• provide appropriate follow-up and aftercare;
• manage complaints, concerns and feedback;
• investigate incidents and support clinical governance;
• meet regulatory, legal and professional obligations;
• monitor and improve the quality and safety of our services;
• protect the security of our patients, staff, systems and premises;
• establish, exercise or defend legal claims; and
• send marketing communications where permitted by law and where the appropriate requirements have been met.

Our lawful bases for using your information

Data protection law requires us to have a lawful basis for processing personal information.

Depending on the purpose, Elanic may process your personal information because:

• Contract: processing is necessary to provide healthcare or other services under a contract with you, or to take steps at your request before entering into a contract;
• Legal obligation: processing is necessary for us to comply with a legal or regulatory obligation;
• Public task: processing is necessary for the performance of a task carried out in the public interest, where applicable;
• Legitimate interests: processing is necessary for Elanic's legitimate interests, or those of another organisation, provided those interests are not overridden by your rights and freedoms;
• Vital interests: processing is necessary to protect your life or the life of another person in an emergency; or
• Consent: where we specifically rely on your consent for a particular activity.

Where we rely on legitimate interests, these may include:

• operating and improving our healthcare services;
• managing our relationship with patients;
• maintaining appropriate information and cyber security;
• preventing fraud or misuse of our services;
• managing complaints and legal claims; and
• communicating with patients where this is reasonably expected, necessary and proportionate.

How we lawfully process health information

Health information and other special category personal data require an additional legal basis.

For the provision and management of healthcare, Elanic will generally rely on Article 9(2)(h) of the UK GDPR, where processing is necessary for:

• medical diagnosis;
• the provision of health care or treatment; or
• the management of health care systems and services,

and the information is processed by, or under the responsibility of, professionals who are subject to duties of confidentiality.

In other circumstances, a different lawful condition may apply, for example where processing is necessary for:

• the establishment, exercise or defence of legal claims;
• substantial public-interest reasons;
• public-health requirements; or
• protection of vital interests where appropriate.

Consent and your healthcare

Consent to medical treatment is separate from consent under data protection law.

We will obtain appropriate consent before providing treatment or carrying out procedures.

However, we do not generally rely on data-protection consent as the legal basis for maintaining and using your clinical record where another lawful basis applies.

Where we do rely specifically on your consent, for example for certain marketing activities or another optional use of your information, you may withdraw that consent at any time.

Withdrawing consent will not affect processing that was lawful before consent was withdrawn.

Who we may share your information with

We will only share your information where there is an appropriate clinical, legal, regulatory or operational reason to do so.

Depending on your care, this may include:

• consultants and other healthcare professionals involved in your treatment;
• your GP;
• another hospital or healthcare provider;
• anaesthetists;
• laboratories and pathology services;
• diagnostic imaging providers;
• physiotherapists and other allied health professionals;
• pharmacies;
• your private medical insurer;
• an NHS Board or other organisation funding or arranging your treatment;
• organisations supplying medical devices, implants or prostheses where necessary for your care;
• regulators and statutory bodies;
• emergency services where appropriate;
• legal, insurance or professional advisers;
• organisations providing secure IT, hosting, backup, payment-processing or other services on our behalf; and
• other organisations where disclosure is required or permitted by law.

We require organisations processing information on our behalf to protect that information appropriately and only use it for agreed purposes.

We do not sell your personal information.

Treatment funded or arranged by another organisation

In some circumstances, your treatment may be funded, commissioned or arranged by another organisation, such as a private medical insurer, NHS Board or other healthcare organisation.

Where this applies, relevant information may be received from or shared with that organisation where necessary to:

• manage your referral;
• assess eligibility or suitability;
• confirm authorisation;
• arrange appointments or treatment;
• provide clinical care;
• support clinical communication;
• provide discharge or follow-up information;
• report treatment progress or outcomes;
• manage billing and contractual requirements;
• support clinical governance and incident management; and
• demonstrate that the agreed service has been delivered appropriately.

Only information necessary for the relevant purpose should be shared.

Keeping your information secure

We use appropriate technical and organisational measures to protect personal information against unauthorised access, disclosure, loss, alteration or destruction.

These measures include, where appropriate:

• access controls based on role and operational need;
• individual user accounts;
• multi-factor authentication;
• encryption of patient information in transit and at rest;
• endpoint and network security controls;
• system monitoring;
• audit logging;
• encrypted backup arrangements;
• staff confidentiality requirements;
• data protection and information-governance training;
• secure disposal arrangements; and
• incident-reporting and escalation procedures.

Access to patient information is restricted to people who require it for legitimate clinical, administrative, governance or support purposes.

Where your information is stored

Elanic's principal patient-management systems and patient information are hosted within the United Kingdom.

We do not routinely transfer patient information outside the UK.

Where we use third-party organisations to process information on our behalf, we carry out appropriate due diligence and put contractual and security safeguards in place.

If personal information is transferred outside the UK in future, we will ensure that an appropriate lawful transfer mechanism and safeguards are in place as required by data protection law and will update this Privacy Notice where appropriate.

How long we keep your information

We keep personal information only for as long as necessary for the purposes for which it was collected and to meet our clinical, legal, regulatory, professional and contractual obligations.

Clinical records are retained in accordance with applicable healthcare record-retention requirements, including relevant Scottish Government Health and Social Care Records Management guidance and associated retention schedules.

Different types of records may therefore be retained for different periods.

At the end of the applicable retention period, information will be securely deleted, destroyed or anonymised where appropriate.

Automated decision-making

Elanic does not currently use solely automated decision-making or profiling to make decisions about your eligibility for, or provision of, clinical treatment which produce legal or similarly significant effects.

If this changes in future, we will provide appropriate information about how such processing works and your rights in relation to it.

Your rights

Depending on the circumstances and the lawful basis on which your information is processed, you may have the right to:

• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• request restriction of the way your information is used;
• object to certain types of processing;
• request deletion of your personal information in certain circumstances;
• request that certain information be provided to you or another organisation in a portable format where the right to data portability applies; and
• withdraw consent where we are relying specifically on consent.

These rights are not absolute and may not apply in every situation.

For example, we may be required to retain clinical records even where you request deletion because of legal, regulatory, professional or patient-safety requirements.

If we cannot comply with a request, we will explain why.

Accessing your medical records

You have the right to request access to personal information held about you.

Requests for copies of your medical records or other personal information can be made using the contact details below.

We may need to verify your identity before releasing information.

Marketing communications

We may contact you about Elanic services or other relevant information where data protection and electronic-marketing rules permit us to do so.

Where consent is required for marketing, we will seek your consent.

You can change your marketing preferences or withdraw marketing consent at any time by contacting us or using the unsubscribe option included in marketing communications.

Withdrawing consent to marketing will not affect your medical care or our ability to retain and use information required for your healthcare.

Website information

When you use our websites, we may collect limited technical information about your visit and information you choose to provide through online forms.

We may use cookies and similar technologies to:

• provide website functionality;
• maintain website security;
• understand how our websites are used; and
• support marketing activity where permitted.

Further information is available in our Cookie Policy.

Our websites may contain links to external websites operated by other organisations. Elanic is not responsible for the privacy practices or content of those external websites.

Complaints, incidents and legal matters

We may use and retain relevant information where necessary to:

• investigate a complaint or concern;
• respond to a clinical, information-governance or security incident;
• establish, exercise or defend legal claims;
• meet regulatory reporting requirements;
• cooperate with statutory or regulatory bodies; or
• protect the safety and rights of patients, staff or others.

Information will only be used where necessary and proportionate for these purposes.

Data protection and information governance

Elanic has arrangements in place for oversight of data protection and information governance.

For questions about how we use your information, to exercise your data-protection rights, request access to your records or raise a privacy concern, please contact:

Elanic Hospital
128 Bath Street
Glasgow
G2 2EN

Telephone: 0141 332 5106
Email: [email protected]

Data Protection Officer:
Vivek Sivarajan

Complaints to the Information Commissioner's Office

If you are unhappy with how we have handled your personal information, we would encourage you to contact us first so that we have the opportunity to investigate your concern.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.

Information about making a complaint is available from the ICO.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in:

• our services;
• the way we process personal information;
• legal or regulatory requirements; or
• our systems and suppliers.

The most current version will be published on our website and will show the date it was last reviewed.

Last reviewed: 6 October 2026