Privacy Policy

Information we collect

We collect only what we need to provide care and respond to enquiries:

• Contact details you give us: name, email address, telephone number and the service you are enquiring about.
• Appointment information: the service requested, preferred dates and any details you include in your message.
• Clinical information created during your care, held in your medical record.
• Technical data collected automatically when you use this website, such as IP address, browser type and pages visited.

How we use your information

Your personal data is used to arrange and deliver your appointment, maintain your medical record, answer enquiries, process payments, and meet our legal and regulatory obligations as a healthcare provider. We do not sell your data, and we do not use it for automated decision-making.

Legal basis for processing

We rely on your consent when you submit an enquiry form, on the performance of a contract when you book an appointment, on our legal obligations for clinical record keeping, and on Article 9(2)(h) GDPR for the processing of health data for the purposes of medical diagnosis and the provision of care.

Who we share it with

Access is limited to clinic staff and the clinicians involved in your care. We share data with third parties only where necessary:

• Service providers who host our website, manage our enquiry forms and process payments, under written data processing agreements.
• Other healthcare professionals involved in your treatment, with your knowledge.
• Regulators, insurers or public authorities where we are legally required to do so.

Our website and embedded content

Visiting this website involves a small number of other companies, and we want to be clear about which:

• Our website is hosted by Vercel. Like any web host, it processes technical information such as your IP address and browser in order to deliver pages and protect the site.
• Our booking and enquiry forms are provided by LeadConnector (GoHighLevel), who process what you submit on our behalf. Cloudflare provides automated abuse protection on those forms.
• Our Ultrasonography page embeds a video from YouTube in no-cookie mode, and our Contact Us page embeds a Google Map. Loading either sends your IP address and the page you were viewing to Google, even though neither places a cookie.
• We use no analytics or advertising tools at present. If we introduce them, we will ask for your consent first. Our Cookie Policy sets out exactly what is placed on your device and how to change your choice.
• Some of these providers process data outside the European Economic Area. We put written data processing agreements in place with our providers.

How long we keep it

Medical records are retained for the period required by Maltese healthcare regulations. Enquiry and appointment correspondence is kept for up to two years unless it forms part of your clinical record. Data no longer needed is securely deleted.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and request a copy.
• Have inaccurate data corrected.
• Request erasure, where no legal or clinical obligation requires us to keep it.
• Restrict or object to processing.
• Receive your data in a portable format.
• Withdraw consent at any time, without affecting processing already carried out.
• Lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) in Malta.

Security

We apply technical and organisational measures to protect your data, including access controls, encrypted transmission and staff confidentiality obligations. No transmission over the internet is completely secure, but we work to reduce risk wherever we can.

Changes to this policy

We may update this policy from time to time. The revision date at the top of this page shows when it was last changed.