Subject Access Request

Your Right of Access

Under Article 15 of the UK General Data Protection Regulation (UK GDPR), you have the right to request a copy of the personal data we hold about you. This is known as a Subject Access Request (SAR).

What You Can Request

You can request:

• A copy of all personal data we hold about you
• Confirmation of whether we are processing your personal data
• Details of the purposes of processing, categories of data, and recipients
• Information about data retention periods
• A copy of your clinical records, consultation notes, correspondence, and clinical photographs
• Information about any automated decision-making (we do not currently use this)

How to Make a Request

Please submit your request in writing to:

• Email: dpo@nose.london (preferred)
• Post: Subject Access Request, NOSE LONDON LTD, 9 Harley Street, London W1G 9QY

Please include:

1. Your full name (and any previous names under which you were treated)
2. Date of birth
3. Contact address and email
4. A description of the information you are requesting (the more specific, the faster we can respond)
5. A copy of photographic identification (passport or driving licence) and proof of current address (utility bill or bank statement dated within the last 3 months)

If you are making a request on behalf of another person (for example, as a parent or legal representative), please provide evidence of your authority to act on their behalf.

Identity Verification

To protect your personal data, we must verify your identity before releasing any information. We will ask for:

• Photographic ID: Passport or driving licence
• Proof of address: Utility bill or bank statement (dated within 3 months)

We will not release any personal data until we are satisfied of your identity.

Our Response

• We will respond to your request within one calendar month of receiving it (and verifying your identity)
• In complex cases, or where the volume of data is large, we may extend this by a further two months. We will notify you within the first month if this is necessary.
• Your data will be provided in a commonly used electronic format (usually PDF), unless you request a different format
• There is no fee for a standard Subject Access Request

Excessive or Unfounded Requests

In cases where requests are manifestly unfounded, repetitive, or excessive, we may:

• Charge a reasonable administrative fee, or
• Refuse the request, giving our reasons

Hospital Records

If your request relates to data held by Weymouth Street Hospital (Phoenix Hospital Group) — for example, admission records, nursing notes, anaesthetic records, or theatre logs — please contact them directly, as they are a separate Data Controller for data collected during your hospital stay:

• Phoenix Hospital Group: phoenixhospitalgroup.com
• Phone: 020 7935 7700

We are happy to help you identify which organisation holds the data you need.

Contact

Data Protection Officer: Mr David Whitehead
Email: dpo@nose.london
Phone: 020 7183 0220
Post: 9 Harley Street, London W1G 9QY

If you are dissatisfied with our response to your Subject Access Request, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

This page is drafted in accordance with Articles 12–15 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Content authored by Mr David Whitehead BSc MBBS MSc FRCS(ORL-HNS) | GMC: 4372358 | RCS Board Certified Cosmetic Surgeon