Your business details, retention periods and international-transfer providers are now completed. The main item still to confirm is the cookies / analytics in section 10. As with any legal document, we recommend a final check by a suitably qualified adviser to ensure it reflects your data practices.
Insight MSK ("we", "us", "our") is committed to protecting your privacy and handling your personal information responsibly. This policy explains what information we collect, how and why we use it, who we share it with, and the rights you have. It applies to visitors to this website and to patients of our clinics.
Last updated: July 2026.
1. Who we are
Insight MSK is the data controller responsible for your personal information. We provide ultrasound-guided musculoskeletal assessment and injection services from clinics at Canary Wharf and Dulwich, London.
- Contact for data protection queries: please use our contact form and mark your message for the attention of our data protection contact.
- Postal address: 128 City Road, London EC1V 2NX
- ICO registration number: ZB524982
As a provider of healthcare that processes personal data, we are required to register with the Information Commissioner's Office (ICO) and pay the annual data protection fee.
2. The information we collect
Depending on how you interact with us, we may collect:
- Identity and contact details, your name, date of birth, postal address, email address and telephone number.
- Health information (special category data), your symptoms, medical and treatment history, medications, examination findings, ultrasound scan images, diagnoses, the treatment you receive and clinical correspondence.
- Appointment and payment information, appointment dates, the services provided, and payment records. Card payments are handled by our payment provider; we do not store full card details.
- Website and technical data, your IP address, browser type, device information, and information about how you use our website, collected through cookies and similar technologies (see section 10).
3. How we collect your information
- Directly from you, when you contact us, complete a booking or enquiry, or attend an appointment.
- Through our online booking and clinical records system (see section 5).
- During your assessment and treatment in clinic.
- From your GP, consultant or referrer, where relevant and with your knowledge.
- Automatically, through cookies and analytics when you use our website.
4. How and why we use your information
We only use your personal information where the law allows us to. Our lawful bases under the UK GDPR are as follows:
- To provide your healthcare, assessing, diagnosing and treating you, and keeping accurate clinical records. Lawful basis: performance of a contract and our legitimate interests (Article 6). For your health data, we rely on the provision of health care and treatment condition (Article 9(2)(h)), under the responsibility of a regulated health professional.
- To manage appointments and communicate with you, confirmations, reminders, results and follow-up. Lawful basis: contract and legitimate interests.
- To take payment and keep financial records, Lawful basis: contract and legal obligation.
- To meet legal and professional obligations, including clinical record-keeping standards and the requirements of our regulators (for example the Health & Care Professions Council). Lawful basis: legal obligation and Article 9(2)(h).
- To operate and improve our website, Lawful basis: your consent (for non-essential cookies) and our legitimate interests in a secure, effective website.
- With your consent, for anything not covered above, such as sharing information with a third party at your request. You can withdraw consent at any time.
5. Who we share your information with
We do not sell your personal information. We share it only where necessary, with appropriate safeguards and data protection agreements in place:
- Our clinical records and booking provider, Carepatron, which hosts our appointment booking and patient records on our behalf as a data processor, acting only on our instructions.
- Your GP or other healthcare professionals, where this is part of your care and with your consent.
- Payment and IT service providers, such as our payment processor and website hosting provider, acting as data processors.
- Regulators, insurers or legal authorities, where we are required to do so by law, or to establish, exercise or defend legal claims.
6. International transfers
Some of our service providers may process or store personal information outside the United Kingdom. We use the following providers:
- Tuta Mail, contact-form messages sent to us by email are processed using Tuta Mail. Tuta states that its data is stored in ISO 27001-certified data centres in Germany, which is covered by the UK's adequacy regulations for international data transfers.
- Krystal Hosting, our website is hosted by Krystal Hosting Ltd in the UK. Krystal may use suppliers, group companies or infrastructure located outside the UK; where required, appropriate safeguards are used for any restricted international transfer.
- Carepatron, we use Carepatron for appointment booking, practice administration and patient records. Carepatron is based in New Zealand and may use cloud-service providers and other sub-processors located outside the UK or the European Economic Area.
Where Carepatron processes personal information on our behalf, the processing is governed by our agreement with Carepatron and its UK Data Processing Addendum. Where an international transfer requires additional safeguards under UK data-protection law, Carepatron's UK Data Processing Addendum incorporates the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.
For other international transfers, we rely on a lawful transfer mechanism under UK data-protection law, such as:
- a UK adequacy regulation;
- the UK International Data Transfer Agreement;
- the UK Addendum to the EU Standard Contractual Clauses; or
- another lawful safeguard applicable to the transfer.
You may contact us using the details in this policy if you would like further information about the safeguards used for international transfers.
7. How long we keep your information
We keep your personal information only for as long as necessary for the purposes described in this policy and to meet our legal, professional, regulatory and insurance obligations.
- Clinical records: we generally retain adult clinical records for at least eight years from the date of your last treatment or consultation, in line with applicable UK health-record retention guidance. Longer periods may apply to certain records, including those relating to children, maternity care, mental health treatment, complaints, adverse incidents or possible legal claims.
- Enquiries and prospective patients: if you contact us but do not become a patient, we generally retain your enquiry and contact details for up to three years from our last contact with you, unless a shorter period is appropriate or you ask us to delete them sooner.
- Website and technical data: website logs and technical information are retained only for as long as necessary for website security, administration and troubleshooting. The retention period may vary depending on the type of data and the relevant website or analytics provider.
- Financial and administrative records: information contained in invoices and other business records is retained for the period required by applicable accounting and tax legislation.
If we become aware of a complaint, adverse event or potential legal claim, we may retain relevant information for longer where reasonably necessary. When information is no longer required, we securely delete it or anonymise it.
8. How we protect your information
We use appropriate technical and organisational measures to keep your information secure, including access controls, encryption in transit, secure and reputable software providers, and limiting access to those who need it to provide your care. We keep these measures under review.
9. Your rights
Under UK data protection law you have the right to:
- be informed about how your data is used (this policy);
- request access to the personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to erase your information in certain circumstances;
- ask us to restrict or object to how we use your information;
- request portability of information you have provided to us;
- withdraw consent where we rely on it.
Some of these rights are limited where we have a legal or professional obligation to retain clinical records. To exercise any right, contact us using the details in section 1. We will respond within one month. There is normally no charge.
10. Cookies
We keep cookies to a minimum. Our website does not use advertising, analytics or other tracking cookies. The only cookies are the essential, strictly necessary cookies set by our Carepatron appointment-booking widget, which are required for the booking function to work. Because these cookies are strictly necessary, they do not require your consent. You can still block or delete cookies in your browser settings, although the booking function may then not work correctly.
11. Changes to this policy
We may update this policy from time to time. The latest version will always be published on this page with an updated "last updated" date.
12. How to contact us or complain
If you have any questions about this policy or wish to exercise your rights, please contact us using the details in section 1.
If you are unhappy with how we have handled your information, you have the right to complain to the Information Commissioner's Office (ICO):
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Helpline: 0303 123 1113 · ico.org.uk
We would, however, appreciate the chance to address your concerns first.