Privacy Policy
Manchester Spinal Neurosurgery Clinic — how we handle your personal data
Last updated:
Who we are
Manchester Spinal Neurosurgery Clinic is the private practice of Mr Muhammad Dherijha FRCS (Neurosurgery), Consultant Complex Spinal Neurosurgeon. The clinic operates across four private hospital sites in Greater Manchester, Cheshire, and Lancashire.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is:
Manchester Spinal Neurosurgery Clinic
c/o Altibury Health Ltd
Secretary: mrdherijha.clinic@altiburyhealth.co.uk
Tel: 0161 850 4786
Website: manchesterspinegroup.co.uk
This policy applies to personal data collected through this website and through direct enquiries to the clinic. It does not cover data held by the private hospitals at which Mr Dherijha practises — each hospital operates its own privacy policy.
Data we collect
We collect personal data in the following ways:
Contact and enquiry forms
- Full name
- Email address
- Telephone number
- Preferred hospital location
- Nature of your enquiry or symptoms (free text)
- Referral source (how you heard about the clinic)
- Preferred contact method and time
Website usage data (Google Analytics)
- Pages visited and time spent on each page
- Referring website or search query
- Browser type, device type, and operating system
- Approximate geographic location (city/region level)
- Anonymised IP address
Analytics data is only collected after you accept cookies via our consent banner. No analytics data is collected if you decline.
Data we do not collect
- We do not collect payment card details through this website
- We do not collect NHS numbers or medical records through this website
- We do not collect special category health data beyond what you voluntarily include in an enquiry message
How we use your data
We use the personal data you provide for the following purposes:
- Responding to your enquiry about a consultation or referral
- Booking and confirming appointments at one of our four clinic locations
- Communicating pre-appointment information and post-appointment follow-up
- Sending appointment reminders (by phone or email, as you prefer)
- Improving the website and patient experience using aggregated, anonymised analytics data
- Complying with our legal and regulatory obligations as a healthcare provider
We will never use your data for unsolicited marketing, sell it to third parties, or share it with any party not directly involved in your care or the administration of your appointment.
Legal basis for processing
Under UK GDPR, we rely on the following lawful bases:
Legitimate interests (Article 6(1)(f))
Responding to enquiries submitted through the contact form and managing appointment bookings.
Consent (Article 6(1)(a))
Placing analytics cookies and collecting website usage data via Google Analytics. You may withdraw consent at any time by adjusting your cookie preferences.
Legal obligation (Article 6(1)(c))
Retaining records as required by the General Medical Council, NHS England, and applicable healthcare regulations.
Vital interests (Article 6(1)(d))
In exceptional circumstances where processing is necessary to protect the life of a patient (e.g. cauda equina emergency referral).
Where we process special category data (health information you include in an enquiry message), we rely on Article 9(2)(h) — processing necessary for the provision of health or social care.
Third-party services
We use a small number of carefully selected third-party services. Each is bound by its own data processing agreement and GDPR-compliant terms.
Altibury Health Ltd
United KingdomPractice management and secretary services
Enquiry form submissions are routed to Altibury Health, who act as our practice management partner and handle appointment coordination on behalf of Mr Dherijha. Altibury Health processes data as a data processor under a formal data processing agreement.
Google Analytics (Google LLC)
United States (EU Standard Contractual Clauses apply)Website analytics
We use Google Analytics 4 to understand how visitors use this website. Analytics data is anonymised and aggregated. IP addresses are truncated before storage. Data is only collected after you accept cookies. You may opt out at any time.
GoDaddy / Airo
United States / European data centres (SCCs apply)Website hosting and infrastructure
This website is hosted on GoDaddy's Airo platform. GoDaddy processes server logs and technical data necessary to operate the hosting infrastructure. No patient enquiry data is stored by GoDaddy beyond standard server logs.
Private hospitals (Spire, Alexandra, Beardwood)
United KingdomClinical venue and patient administration
When you attend a consultation, the hospital at which you are seen will process your data under their own privacy policy. We share only the minimum information necessary to facilitate your appointment.
We do not transfer personal data outside the UK or EEA without appropriate safeguards (Standard Contractual Clauses or adequacy decisions) in place.
Retention periods
We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law.
| Data type | Retention period | Basis |
|---|---|---|
| Enquiry form submissions (no appointment) | 12 months | Legitimate interests |
| Appointment and consultation records | 8 years from last contact (adults) | GMC / NHS guidance |
| Appointment records — children | Until age 25, or 8 years from last contact if longer | GMC / NHS guidance |
| Financial / invoicing records | 7 years | HMRC requirement |
| Website analytics data | 26 months (Google Analytics default) | Consent |
| Cookie consent records | 12 months | Legal obligation (PECR) |
After the applicable retention period, personal data is securely deleted or anonymised. Paper records are shredded; digital records are permanently deleted.
Your rights under GDPR
Under UK GDPR, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to exemptions in certain circumstances (for example, where we are required to retain data by law).
Right of access
Request a copy of the personal data we hold about you (Subject Access Request).
Right to rectification
Ask us to correct inaccurate or incomplete personal data.
Right to erasure
Request deletion of your personal data where there is no compelling reason for us to continue processing it.
Right to restrict processing
Ask us to limit how we use your data in certain circumstances.
Right to data portability
Receive your data in a structured, machine-readable format where processing is based on consent or contract.
Right to object
Object to processing based on legitimate interests, including direct marketing (we do not carry out direct marketing).
Right to withdraw consent
Withdraw consent for analytics cookies at any time without affecting prior processing.
Right to complain
Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
To exercise any of these rights, please contact us using the details in the section below. We will respond within one calendar month of receiving your request. We may need to verify your identity before processing your request.
Data security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure.
- This website is served over HTTPS (TLS encryption) at all times
- Enquiry form submissions are transmitted securely and routed to Altibury Health via encrypted channels
- Access to patient enquiry data is restricted to authorised clinic staff only
- Our hosting infrastructure (GoDaddy Airo) maintains ISO 27001-aligned security controls
- We conduct periodic reviews of our data handling practices
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.
Contact & data requests
To submit a Subject Access Request, exercise any of your GDPR rights, or raise a concern about how we handle your data, please contact us by any of the following methods:
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page will always reflect the most recent revision. We encourage you to review this policy periodically.
Questions about your data?
Our secretary is happy to help with any data-related enquiry.
Contact the clinic