Last updated: 4 August 2026.
Who is responsible for your information
Data controller: Mr Arpit Patel, Consultant Trauma & Orthopaedic Surgeon (GMC 4503473), is responsible for personal information collected through this website enquiry service. Data protection enquiries and rights requests can be sent through the website's dedicated privacy request route.
Information we collect
The enquiry form may collect your name, email address, telephone number, preferred contact time, preferred location, enquiry type, message and confirmation of consent. Your message may contain information about your health, which is treated as special category personal data.
The hosting service also creates limited technical and security records, such as a request time and a non-reversible hash derived from an IP address for rate limiting. These records are used to keep the website available and protect the form from misuse; the rate-limit files are temporary and are routinely removed.
Why we use this information
Information is used to respond to your enquiry, provide administrative booking support, discuss appointment availability, answer fee or insurance questions and arrange a second opinion where requested. The website does not diagnose conditions or make treatment decisions online.
For a voluntary initial website enquiry, the practice relies on your consent under Article 6(1)(a) of the UK GDPR. Where you choose to provide health information, the practice relies on your explicit consent under Article 9(2)(a). You can withdraw consent at any time through the privacy request route. Withdrawal does not affect processing that was lawful before withdrawal, and some information may still need to be retained where another legal or professional obligation applies.
A privacy rights request does not require you to provide health information or consent to the processing of health information. The separate privacy route asks only for the details needed to identify and respond to the request.
If you later become a patient, relevant information may be handled as part of your clinical or administrative record under the privacy arrangements of the practice and the hospital or healthcare provider involved.
How the form is delivered
The website uses a same-site form handler on the Monkey Tree Hosting/Plesk hosting account. It validates the form and sends the enquiry to the configured private practice inbox. The website does not place enquiry details in a public database.
Only provide the minimum information needed for the team to understand your request. Do not send scans, medical records, payment information or identity documents through the form. The team can arrange an appropriate route if documents are needed later.
Who may receive the information
Enquiries may be accessed by Mr Patel and authorised private practice staff who need the information to respond or arrange care. Website hosting and email providers may process information when transmitting or delivering the message. Information may also be shared with a hospital, insurer or healthcare provider where necessary to arrange the service you request, or where required by law.
International processing
If a supplier transfers personal information outside the United Kingdom, the practice requires an applicable adequacy decision or another safeguard recognised by UK data protection law, such as the UK International Data Transfer Agreement or UK Addendum. Supplier arrangements should be reviewed as part of the practice's data-protection governance.
Retention and security
Enquiry information is retained only for as long as necessary to respond, manage the booking request, maintain appropriate records and meet legal or professional obligations. The retention period depends on whether the enquiry leads to care, a booking, a complaint or another record that the practice must keep. Enquiries that do not lead to ongoing care are reviewed and deleted when no longer required. If care is arranged, relevant information may form part of a longer-term clinical or administrative record.
Reasonable technical and organisational safeguards are used, but ordinary internet and email transmission cannot be guaranteed to be completely secure. This is why the form asks patients not to attach or submit detailed records.
Enquiring for someone else or for a child
If you contact the practice for another person, only share information you are authorised to provide and explain your relationship to them. A parent or person with parental responsibility should make an enquiry for a child. Do not send detailed medical records through the general form; the team will explain an approved route if information is needed.
Your data protection rights
Depending on the circumstances, you may have rights to access your information, correct inaccurate information, request deletion or restriction, object to processing, request data portability and withdraw consent. Submit a request through the dedicated privacy route. The practice may need to verify your identity before acting on a request.
Cookies and analytics
This website does not currently use advertising cookies, analytics tracking or behavioural profiling. Essential hosting and security functions may operate without using non-essential browser cookies. If tracking technology is introduced later, this notice and the consent process will be updated first.
External links
This site links to hospital, GMC, PHIN, National Joint Registry and review-profile websites. Those organisations are responsible for their own privacy practices.
Complaints
Please contact the practice first so any concern can be investigated. You also have the right to complain to the Information Commissioner's Office.