Privacy Notice
This notice explains what personal information Lodestar Clinic collects about you, why we hold it, who we share it with, and the rights you have over it. We have written it in plain language, because a service built on independence should be equally plain about how it handles your information.
1. Who we are
Lodestar Clinic is a trading name of Stellarix Ltd, a company registered in England and Wales.
Registered office: 20-22 Wenlock Road, London, N1 7GU
Company number: 06620950
ICO registration number: ZB981994
Email: hello@lodestarclinic.co.uk
Stellarix Ltd is the data controller for the personal information described in this notice. That means we decide what information is collected and how it is used, and we are accountable for it.
Clinical services are provided by Lasun Sosanya, an Advanced Musculoskeletal and Rheumatology Practitioner registered with the Health and Care Professions Council (registration PH78564), who is bound by a professional duty of confidentiality.
2. What this notice covers
This notice covers information we collect when you visit our website, make an enquiry, book an appointment, attend an assessment or rehabilitation session, or correspond with us.
Lodestar Clinic provides independent suitability assessments and post injection rehabilitation. We do not perform injections, and we receive no payment from any clinic or provider who does. That matters for your privacy as much as for your care: we have no commercial reason to pass your details to anyone selling a treatment, and we do not do so.
3. The information we collect
Information you give us
- Identity and contact details: your name, date of birth, address, email address and telephone number.
- Appointment details: the service booked, the date and time, and whether it is by video or at your home.
- Health information: your symptoms, medical history, medications, allergies, previous injections, surgical history, relevant lifestyle information, and your goals.
- Imaging and clinical documents: X-ray, MRI or ultrasound reports and images, GP or consultant letters, and any other records you choose to share.
- Correspondence: emails, messages and notes of telephone conversations.
Information created during your care
- Clinical notes of your consultation and examination.
- Assessment findings and outcome measures.
- The written recommendation we prepare for you.
- Rehabilitation plans and progress records.
Payment information
Payments are handled by our practice management and payment providers. We receive confirmation that a payment has been made, together with limited transaction details. We do not store your full card number.
Website information
Our website is deliberately light. We use only essential cookies needed for the site and the booking system to function. See section 11.
4. Health information and the law
Information about your health is treated in law as a special category of personal data, which carries stronger protection. We collect it only because it is necessary to assess you properly and give you an honest answer, and we handle it under a professional duty of confidentiality.
5. Why we use your information, and our lawful basis
| What we use it for | Lawful basis |
|---|---|
| Arranging and delivering your appointment, and providing the service you have paid for | Article 6(1)(b) — performance of a contract with you |
| Assessing your suitability, preparing your written recommendation, and providing rehabilitation | Article 6(1)(b) contract, and Article 9(2)(h) — provision of health care or treatment by a professional subject to a duty of confidentiality, with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018 |
| Keeping accurate clinical records, as required of a registered health professional | Article 6(1)(c) legal obligation, and Article 9(2)(h) |
| Taking payment, and keeping accounting and tax records | Article 6(1)(c) legal obligation |
| Responding to enquiries and administering the service | Article 6(1)(f) legitimate interests — running the service efficiently |
| Handling complaints, insurance matters or legal claims | Article 6(1)(f) legitimate interests, and Article 9(2)(f) legal claims |
| Sending you optional updates, if you have asked for them | Article 6(1)(a) consent, which you may withdraw at any time |
6. Who we share your information with
We share your information sparingly, and only where there is a proper reason. We may share it with:
- Your GP or a treating clinician, where you ask us to, or where you consent to us sending your written recommendation onward.
- Our service providers, described in section 7, who act only on our instructions.
- Our professional indemnity insurer and professional advisers, where necessary to handle a claim or take advice.
- Regulators, courts or other authorities, where we are required to do so by law, or where there is a serious risk of harm to you or another person.
We do not sell your information. We do not share it with clinics, injection providers, product manufacturers or advertisers, and we receive no referral fees from anyone. If we suggest you consider a treatment elsewhere, that suggestion earns us nothing, and your details are not passed on unless you ask us to.
7. Our service providers
We use a small number of trusted providers to run the service. They process your information only on our documented instructions, under contract.
- Practice management and online booking: Cliniko, provided by Red Guava Pty Ltd. This holds appointment details and clinical records, and powers the booking form on our website.
- Email and business software, used for correspondence and administration.
- Payment processing, used to take and reconcile payments.
- Website hosting.
- Accounting software, for financial records.
8. Transfers outside the UK
Some of our providers are based outside the United Kingdom, or use infrastructure outside it. Where your information is transferred outside the UK, we ensure it is protected by an appropriate safeguard recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Addendum to the standard contractual clauses. You may ask us for details of the safeguard applied.
9. How long we keep your information
We keep clinical records for eight years after your last contact with us, in line with established professional guidance for adult health records in the United Kingdom. Where a patient is under 18, records are kept until their 25th birthday, or their 26th if they were 17 at the last contact.
Financial records are kept for six years plus the current financial year, as required for tax purposes. Enquiries that do not lead to an appointment are deleted within 12 months. Marketing consents are kept until you withdraw them.
When a retention period ends, records are securely deleted or destroyed.
10. How we protect your information
- Clinical records are held in a dedicated, access controlled practice management system, rather than in ordinary documents or spreadsheets.
- Accounts are protected by strong, unique passwords and, where available, two factor authentication.
- Devices are encrypted and password protected.
- Video consultations are conducted over a secure connection, and are not recorded unless you and we both agree in advance.
- Access is limited to those who need it in order to deliver or administer your care.
11. Cookies
We use only cookies that are necessary for the website and the booking system to work, together with a cookie that remembers your choice on our cookie notice, so we do not ask you repeatedly.
Our online booking form is embedded from our practice management provider, and that provider may set its own cookies when the booking form loads or when you make a booking. These support the booking process rather than advertising.
We do not use advertising cookies, and we do not track you across other websites. You can block or delete cookies through your browser settings, though parts of the booking process may not work if you do.
12. Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your information, which is the purpose of this notice.
- Access a copy of the information we hold about you.
- Rectification of information that is inaccurate or incomplete. Note that a clinical record is a historical document: where you disagree with a professional opinion recorded in it, we will add a note of your view rather than erase the original entry.
- Erasure in certain circumstances. This right is limited where we are required to retain clinical records.
- Restrict processing in certain circumstances.
- Data portability, where processing is based on consent or contract and carried out by automated means.
- Object to processing based on our legitimate interests.
- Withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email hello@lodestarclinic.co.uk. We will respond within one month. There is normally no charge. We may ask you to verify your identity before releasing information, in order to protect you.
13. Automated decision making
We do not make decisions about you by automated means, and we do not profile you. Every assessment and recommendation is made by a qualified clinician.
14. Children
Our service is intended for adults. We do not knowingly provide services to anyone under 18 other than by specific arrangement, and our website is not directed at children.
15. Changes to this notice
We may update this notice from time to time. The version number and date at the top will tell you when it last changed. Where a change is significant, we will draw it to your attention.
16. Complaints
If you are unhappy with how we have handled your information, please tell us first at hello@lodestarclinic.co.uk, so we have the chance to put it right.
You also have the right to complain to the Information Commissioner's Office at any time:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint