The Data Controller
The Data Controller is Dr Massimo Giuseppe Barcellona, trading as SHP Health Ltd.
ICO registration reference: ZA311630
For any questions about how we use your personal information, or to exercise your data protection rights, please contact:
Email: data@shphealth.co.uk
About this Privacy Notice
This Privacy Notice explains how SHP Health collects, uses, stores and shares your personal information when you use our services. We are committed to protecting your privacy and handling personal information lawfully, fairly and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
We recognise that health information is particularly sensitive and take appropriate measures to protect its confidentiality and security.
The purpose of processing your information
We collect and use personal information where necessary to provide and manage our services. This may include assessing your health and needs, providing treatment or other services, maintaining appropriate clinical and administrative records, arranging appointments, processing payments and insurance claims, communicating with you and meeting our legal, regulatory and professional obligations.
Where appropriate, we may also use personal information to improve our services and to communicate with you about SHP Health services, news or offers, in accordance with applicable marketing and privacy laws.
The lawful basis for processing your information
Under the UK GDPR, we must have a lawful basis for using your personal information. The lawful basis we rely on will depend on the purpose for which the information is being used and may include:
Information about your health is classed as special category personal data and receives additional protection under data protection law. Where we process health information for the purposes of providing healthcare, assessment, diagnosis or treatment, we rely on the condition set out in Article 9(2)(h) of the UK GDPR and the relevant provisions of the Data Protection Act 2018 relating to health and social care.
Our clinicians are also subject to professional duties of confidentiality.
What information we hold and what we do with it
The information we hold includes your:
• Personal and contact details.
• Medical history and other health-related information; including physical and mental health, family, lifestyle, social, employment and education details.
• Treatment details and related notes.
We might use your information in the following ways:
• For our own record keeping.
• To provide you with the highest levels of care, treatment and customer service.
• As a patient, we may need to contact you by email, phone or through the post. Our primary means of contact is email. We may forward appointment reminders to you and may need to liaise about payment matters.
• Where permitted by law, we may send you information about SHP Health services, events, promotions or other news that we believe may be relevant to you. We will only send electronic marketing communications where we have the appropriate consent or another lawful basis permitted under applicable electronic marketing rules. You can unsubscribe from marketing communications at any time.
• To improve our services offered to you.
The information you provide us with is held in strict confidence. We do not sell your personal information.
We may share relevant personal information where necessary with healthcare professionals involved in your care, private medical insurers, case managers, professional advisers, service providers acting on our behalf, or other organisations where there is an appropriate lawful basis for doing so.
We may also disclose information where required or permitted by law, or where this is necessary to protect the vital interests of you or another person.
We will only share information that is appropriate and necessary for the relevant purpose and will do so in accordance with our professional duties of confidentiality and applicable data protection law.
How we store your information
We store personal information using appropriate electronic and, where applicable, paper-based systems. We take reasonable technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.
Some of the systems and service providers we use to manage clinical records, appointments, communications, payments and other business activities may process personal information on our behalf. We require appropriate data protection and confidentiality arrangements to be in place where applicable.
Retention period for your information
We retain personal information only for as long as is necessary for the purposes for which it was collected and to meet our legal, regulatory, professional, insurance and contractual obligations.
Clinical records are retained in accordance with applicable professional guidance and our records retention policy. As a general rule, adult clinical records are retained for at least eight years after the end of treatment. Different or longer retention periods may apply, including for children and young people or where there is another legal, professional or insurance reason to retain records for longer.
Financial and accounting records are retained for the period required by applicable tax and accounting legislation.
Security
We take the security of your personal information seriously and use appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, loss or destruction.
These measures may include access controls, password protection, encryption where appropriate, staff training and secure systems and processes.
While no method of storing or transmitting information can be guaranteed to be completely secure, we regularly review the measures we use to protect personal information and aim to comply with applicable data protection and confidentiality requirements.
International transfers
Some of the organisations and service providers we use may process or access personal information outside the UK.
Where personal information is transferred outside the UK, we take appropriate steps to ensure that the transfer complies with UK data protection law. This may include relying on UK adequacy regulations, approved contractual safeguards or another lawful transfer mechanism.
Children’s information
We may collect and process personal information about children and young people where necessary to provide our services. We take particular care when handling children’s personal information and will involve a parent, guardian or the young person themselves as appropriate, taking account of their age, understanding, capacity and the circumstances of the service being provided.
Your Rights
Depending on the circumstances and the lawful basis on which we process your information, you may have the following rights:
Full details of your rights can be found at www.ico.org.uk.
If you wish to exercise any of these rights or would like further information, please contact us using the details provided above.
If you are dissatisfied with our response, you can complain to the Information Commissioner’s Office. Further information is available at www.ico.org.uk.
Limits to your data protection rights
Some data protection rights are not absolute and may not apply in every circumstance.
For example, we may need to retain clinical or other records even where you request their deletion, where retention is necessary to meet legal, regulatory, professional or insurance requirements.
If certain information is necessary for us to assess or treat you, we may be unable to provide some or all of our services if you do not provide that information or object to its use.
Changes to this Privacy Notice
We may update this Privacy Notice from time to time. Any changes will be published on this page.
Further information
SHP Health is registered with the Information Commissioner’s Office under registration reference ZA311630.
You can view our current registration details on the ICO register.
Updated Sep 2026