Please see the Copyright section at the end of this document.
Sole trader trading as Dr Anastasia Therianou
Dr Anastasia Therianou 134 Harley St Marylebone London W1G 7JY Principal activities Healthcare services as defined below.
Dr Anastasia Therianou is committed to protecting your privacy and legal rights when dealing with your personal information. This Privacy Notice intends to provide clear and understandable details about the information we collect about you (or anyone you have provided us with information about, e.g. your child), how we use and protect it. It also provides information about your rights that relate to the data we process.
If you have any queries about this Privacy Notice, if you are not sure what something means, or if you wish to contact us about personal information we hold, please email us at:
Dr Anastasia Therianou is registered with the Information Commissioners Office, registration number ZA557331.
You have the right to object to processing of your data, if processing of your data is based on legitimate interests, or if processing is being used for direct marketing. The definition of ‘legitimate interests’ is discussed within this Privacy Notice. Please contact us in the first instance if you wish to object.
‘we’, our’, ‘us’, ‘Company’ is a direct reference to Dr Anastasia Therianou
‘services’ means health care related services provided by us, as defined in‘Scope of healthcare services’
GDPR means EU General Data Protection Regulations that come into force on May 25th 2018.
ICO means the Information Commissioner’s Office and will also refer to any successor to it as the UK data protection authority.
Data Protection Laws means the Act, GDPR, the Regulation of Investigatory Powers Act 2000, the Telecommunications (Lawful Business Practice) (Interception of Communications) Regulations 2000 (SI 2000/2699), the Electronic Communications Data Protection Directive (2002/58/EC), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2426/2003) and all applicable laws and regulations relating to the processing of personal data and privacy, including where applicable the guidance and codes of practice issued by the ICO or any other supervisory authority, and the equivalent of any of the foregoing in any relevant jurisdiction.
Data Controller, Data Processor, Data Subject and Personal Data all have the meaning given to them in the Act and GDPR.
Website or site means the Company’s website at https://drtherianou.com/
‘patient’ or ‘patients’ means people who attend or intend to use our services
‘patient or patient’s data’ means either Personal Data or Special Category data, as defined by the GDPR.
‘personal information’ means either Personal Data or Special Category data, as defined by the GDPR.
This Privacy Notice will apply to any person (also known as a ‘data subject’) who enquires about, uses or purchases our services. Please see the section ‘Scope of Health Care Services’ for more information.
It also applies if you communicate with us in any manner, for the purpose of discussing current or past use of our services.
You may be reading a printed version of our Privacy Notice, which may notbe the latest version. Please view the current Privacy Notice on our website, or contact us using the contact details at the beginning of this Privacy Notice to request a copy of the Privacy Notice via email, in Adobe PDF format.
Dr Anastasia Therianou provides the following health care services.
Data protection laws require us to take appropriate technical and organisational measures to prevent unlawful access or processing of personal information, that the Data Controller for Dr Anastasia Therianou, are responsible for implementing.
The level of technical safeguarding of data should be appropriate to the nature of information in question, and the harm that might result from its improper use, or from its accidental deletion or destruction.
The following list shows some of the technical and organisational measures we put in place to ensure the safety and integrity of your data.
We collect personal information from you or any third parties that are acting on your behalf.
If you provide us with personal information about other people, please ensure that they have seen this Privacy Notice and understand it, before you provide this information to us.
Standard personal information which can include (but not limited to)
Special Category personal information This is personal information specifically relating to your:
Special Category personal information relating to health can include (but is not limited to) clinical notes, examination findings, medical imagingdata related to your care, diagnostic test results, correspondence and communications from other clinical professionals which relates to your current or past clinical care.
We will process your personal information for reasons set out in this Privacy Notice. By law, we need to have a lawful basis or bases for processing your Standard personal information and a lawful basis or basesfor processing your Special Category personal information. Additionally, for Special Category personal information, we are required to identify a condition or conditions for processing this data (as well as a lawful basis or bases).
These two types of personal information are discussed above in the section “Categories of personal information that we process”
As we are a provider of health care services to you, we have several reasons for processing your Special Category personal information. We would not be able to provide healthcare services to you unless we can process this information.
We undertake to process this information in line with Data Protection Laws as defined in the section “Definitions of terms within this Privacy Notice” within this document.
We process Standard personal information about you if it is determined:
We process Special Category personal information about you if it is determined:
The conditions under which we need to process your Special Category personal information are:
The law requires us to our balance the processing of your Standard personal information against your interests, rights and freedoms. We conduct a legitimate interests assessment to ensure we ensure the Standard personal information we process does not override your interests, rights or freedom that relate to your information.
The Legitimate Interests we have identified that allow us to process your Standard personal information are:
If you book into our clinic as a potential patient and we hold no previous clinical records that relate to your direct care, and then you cancel the booking, we will no longer have a legitimate interest in processing your data. In most instances, we would delete any personal information that was used to make the booking.
Please note, that if you are a patient currently undergoing treatment or have appointments booked, we will use your email address to inform you of any changes that relate to our clinic. Examples include changes to fees and change of clinic address. Even if you ask us to not send you marketing or educational emails, we will still use your email address to communicate with you regarding this clinic related information.
We process Standard personal information to fulfill our Legal Obligation, which requires us to maintain complete records relating to the health care services we supply to you. The records that we maintain require that we process a subset of your Standard personal information, with the lawful basis being a Legal Obligation. The Standard personal information we will then process under a Legal Obligation is your:
Full name; address; date of birth; gender; ontact details (such as an email address or telephone number); your parent(s) or legal guardian details if you are a minor; GP contact details
Please note, that whilst we initially use Legitimate Interests as a lawful basis for processing your data, once you attend clinic and we take any notes relating to your clinical care, we will then process your Standard personal information on the lawful basis of our Legal Obligation.
People directly involved in your healthcare that are designated as being regulated by the regulatory bodies as listed in the Medical Act 1983 or the Health Professionals Order 2001 are legally required to record information about you, that relate to preventive or occupational medicine, for medical diagnosis or the provision of health care or treatment.We are required to demonstrate we follow the legal requirements as listed in:
PART 3, Section 2, Regulation 17 (c)
(c) maintain securely an accurate, complete and contemporaneous record in respect of each service user, including a record of the care and treatment provided to the service user and of decisions taken in relation to the care and treatment provided;
Note, you as the patient are the “service user”.
We are also required by our Regulatory body, the General Medical Council (GMC), to take and process medical records, which are required to support safe and effective care. As our regulatory body is covered by UK law, this also demonstrates a legal requirement to record and maintain clinical records that relate to your clinical care.
We sometimes need to share your information with other people or organisations for the purposes set out in this Privacy Notice. We will, where required, share the minimal amount of your personal data as appropriate with the other people or organisations we are communicating with:
Generally, we store your personal information on secure systems that reside within the EEA. Where we store systems that are outside of the EEA, we will ensure that there are suitable contractual or other safe guards in place to protect your data.
These measures may include data controller (us) to data processor contracts who we have checked have the required data protection law compliance, or ensuring your data is transmitted from the EEA to other global areas in a highly encrypted format, that is then stored on secure systems using “zero knowledge” encryption. This means your data can not be decrypted by a data processor.
As we are processing your personal data for provision of health care services, we have a legal obligation to process this data.
There are also industry standard guidelines for retention of records (set bythe UK National Health Service) that we follow, in accordance with our regulatory body requirement.
Normally we will process or store your personal information for eight (8) years, but this can increase if there are specific circumstances. If you have any queries about how long we are processing your data for, please contact us.
We will also store information to ensure we can deal with any legal claims that arise from you using our services, and the data will be stored for as long as is required and advised by our legal counsel.
Your rights on us processing your personal information versus us storing your personal information are discussed in the section ‘Your rights’, below.
Any personal information that is used for marketing purposes, that has been provided using consent, will be erased in accordance with your rights if requested.
You have the following rights, however please note, that the rights are not absolute. The only absolute right you have is to request that we do not use your personal information for direct marketing.
Please do contact us if you are unsure about your rights as detailed below.We will always endeavour to help explain how your rights apply to the personal information we process, for our specified lawful reasons.
We need to inform you the name and contact details of our organisation, which is at the top of this document.
You have the right to be informed about how we collect and use your personal data. We are obliged to provide this right to be informed in a clear and concise manner. This Privacy Notice you are reading is designed to inform you how we collect and use your personal data.
You have the right to confirmation that your data is being processed and to view this information. This is known as a Subject Access Request or ‘SAR’ , but you do not have to specify this term when requesting your personal information from us. You also have the right to request a copy of your personal data that we process.
We will need to identify you using reasonable means before we will start the process of collating your personal information.
Once we have identified you, we will reply to any requests for your personal information (SARs) within 30 days, unless we deem the request to be complex, or repetitive, where we will notify you that we may take an additional two months to provide your personal information.
We will not charge you to request information from us. However, we will charge a reasonable fee if the request for information is repetitive. If we’ve provided information to you and you wish to request it again, we ask that you contact us beforehand to discuss what our reasonable fee is.
Where we refuse to respond to a request, we will explain why to you, informing you of your right to complain to the ICO without undue delay and at the latest within one month of our refusal.
You have the right to request rectification of your personal information. However, we only consider requests to correct factual information. Any clinical opinions will remain valid as they were the opinion at the time of being recorded. If it is later determined that a clinical opinion or diagnosis was then found to have changed, we will update your personal information to reflect this, but we will not change or remove the original clinical opinion.
You have the right to request erasure of personal information. If you have subscribed to any of our email educational or marketing correspondence, you have the right to request erasure from our email list, or you can click on the ‘unsubscribe’ link that appears in all emails we send. We will only use your personal information to send you marketing or educational material if you have given us your explicit permission.
We will consider all requests in conjunction with our legal obligation to retain information relating to your health care provided by us, as well as data protection law which clearly states when the right to erasure does not apply. Normally, this means we will not erase any information, unless it was not required for legal reasons.
If we determine we cannot delete data, you still have the right to ask us to restrict processing of your personal data.
You can request that we restrict processing of personal information. This means that we will stop actively processing it, and it will just be stored. Stopping processing will mean that we will not add any additional information to your existing information. This will, however, mean that we will not be able to continue seeing you as a patient.
As we do not process personal information using a lawful basis of either a)consent or b) for the performance of a contract, the right to data portability is not applicable.
You have the right to object to the processing of your personal data in certain circumstances.
You also have an absolute right to stop your data being used for direct marketing (an example being a newsletter sent out via email each week that you don’t wosh to receive anymore).
We have the right to continue to process data if there is a compelling reason to do so, and we will discuss this with you when required.
You can make an objection verbally or in writing.
We have one month to respond to your objection.
We do not make any kinds of automated decisions or perform any profiling with your personal information.
The right to lodge a complaint with a supervisory authority
We ask that you first contact us if you feel you wish to make a complaint and we will do whatever we can reasonably do to assist you.
Please see the template letter and guidelines listed on the ICO website.
You can also contact the ICO directly:
They can also be contacted at the following address:
Wycliffe House Water Lane Wilmslow SK9 5AF
This Privacy Notice has been created for Dr Anastasia Therianou by Private Practice Ninja Ltd.
Dr Anastasia Therianou has the right to edit the text contained within this notice as they require, as long as it remains solely for the use of Dr Anastasia Therianou.
This Privacy Notice is licenced to be used on the one website, https://drtherianou.com/ and can also be distributed electronically as a PDF document to patients, and stored within your own email system.
Any redistribution or reproduction of part or all of the contents in any formis prohibited, including by Dr Anastasia Therianou, who limited use of this Privacy Notice is licenced to.
You may not, except with our express written permission, distribute or commercially exploit the content. Nor may you, without our express permission, transmit it or store it in any other website or other form of electronic retrieval system.
134 Harley St, Marylebone, London, W1G 7JY
+44 (0) 2034684884
+44 (0) 2038695134
© 2019 - 2021 Therianou Anastasia | Designed by Blind Studio