London Shoulder & Elbow
Last updated: 20th July 2026
This policy explains how London Shoulder & Elbow collects, uses and protects your personal information when you use this website or contact the practice. We are committed to protecting your privacy and handling your information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
London Shoulder & Elbow is the private practice of Mr Toby Baring, Consultant Shoulder and Elbow Surgeon.
The data controller for the personal information described in this policy is:
Mr Toby Baring, London Shoulder & Elbow
[PRACTICE POSTAL ADDRESS]
Email: londonshoulderandelbow@gmail.com
If you have any questions about this policy or how your information is handled, please contact us using the details above.
Information we collect
Information you give us
When you contact the practice through the enquiry form on this website, by email or by telephone, we collect the information you provide.
This typically includes:
Your name
Your email address and telephone number
The content of your message
Because this is a medical practice, your message may include information about your health, such as your symptoms or a condition you would like to discuss. Health information is a special category of personal data under UK GDPR and we treat it with additional care, as described below.
If you go on to become a patient, we will collect further information needed to provide your care, including medical history, referral letters, imaging and correspondence with other healthcare providers and insurers. That information is handled under the practice's clinical record keeping obligations and any additional privacy information you are given at the time.
Information collected automatically
When you visit this website, we collect limited technical information automatically:
Plausible Analytics. We use Plausible, a privacy-friendly analytics tool, to understand how visitors use the site, for example which pages are visited and how visitors arrive here. Plausible does not use cookies and does not collect or store any personal information. All statistics are aggregated and cannot identify you.
reCAPTCHA.
Our enquiry form uses Google reCAPTCHA to protect against spam and automated abuse. reCAPTCHA collects technical information about your device and behaviour on the form to distinguish people from automated software.
Website hosting. This website is hosted by Webflow, which collects standard technical logs (such as IP addresses) needed to deliver the site securely.
How we use your information
We use your information to:
Respond to your enquiry and correspond with you about appointments
Provide and administer your care if you become a patient
Communicate with other parties involved in your care where appropriate, such as hospitals, your GP, other treating clinicians and your private medical insurer
Keep records the practice is required to keep as a regulated healthcare provider
Understand how the website is used so we can improve it
Protect the website and the practice against spam and misuse
We do not sell your information, and we do not use your health information for marketing.
Our lawful bases for using your information
Under UK GDPR, we rely on the following lawful bases:
Responding to enquiries and running the website: legitimate interests (Article 6(1)(f)). It is in our legitimate interest to respond to people who contact the practice and to keep the website working and secure.
Providing your care: performance of a contract (Article 6(1)(b)) and, for health information, the provision of health care under Article 9(2)(h), by or under the responsibility of a professional subject to an obligation of confidentiality.
Meeting legal and regulatory obligations: legal obligation (Article 6(1)(c)), for example record keeping requirements that apply to medical practice.
Website analytics: legitimate interests (Article 6(1)(f)). Our analytics tool does not use cookies or collect personal information, so this processing has minimal privacy impact.
Who we share your information with
Your information may be shared with:
Practice staff. Mr Baring's secretarial team handle enquiries and appointments on his behalf.
Those involved in your care. With your knowledge, information may be shared with hospitals where Mr Baring operates, your GP, other treating clinicians, and your private medical insurer where you are using insurance to fund treatment.
Service providers. We use trusted providers to run the practice and this website: Google for practice email, Webflow for website hosting, Plausible for website analytics, and Google reCAPTCHA for spam protection. These providers act as data processors under their published UK GDPR data processing terms.
We never share your information with anyone else unless we are required to by law or you ask us to.
How your information is protected
Practice email is encrypted in transit and at rest
This website is served over an encrypted connection (HTTPS)
Access to your information is limited to the people who need it to handle your enquiry or care
International transfers
Some of our service providers, including Google and Webflow, are based in the United States and may process data there. These transfers are covered by recognised UK GDPR safeguards, including the UK Extension to the EU-US Data Privacy Framework and the UK International Data Transfer Addendum to the standard contractual clauses. Our analytics provider, Plausible, is based in the European Union and stores its data there.
How long we keep your information
Enquiries that do not lead to treatment: we keep enquiry correspondence for 12 months and then delete it
Patient records: if you become a patient, your records are kept in line with the retention periods that apply to medical records in the UK, which is normally a minimum of 8 years after your last treatment for adults, and longer in some circumstances
Analytics data: our analytics statistics are aggregated and contain no personal information
Cookies
This website only uses essential cookies, which are needed for the site and the enquiry form (including reCAPTCHA spam protection) to work. We do not use advertising or tracking cookies, and our analytics tool (Plausible) is cookie-free. You can manage cookies through your browser settings.
Your rights
Under UK GDPR you have the right to:
Ask for a copy of the information we hold about you (a subject access request)
Ask us to correct information that is inaccurate or incomplete
Ask us to delete your information, where there is no overriding requirement for us to keep it (medical records are subject to legal retention requirements and usually cannot be deleted on request)
Object to or ask us to restrict how we use your information
Withdraw consent at any time, where consent is the basis for processing
Ask for your information in a portable format
To exercise any of these rights, contact us at londonshoulderandelbow@gmail.com. We will respond within one month.
Complaints
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk
Changes to this policy
We may update this policy from time to time. Any changes will be published on this page with an updated date at the top.
