Legal & Compliance
Privacy, Consent & Confidentiality Policy
Last updated: 9 March 2026 | UK GDPR | Data Protection Act 2018 | NMC Code | CQC Regulation 11
1. Our Commitment to Privacy
LSJ Rejuvenate Ltd is committed to protecting the privacy and confidentiality of all personal and health information entrusted to us. We comply fully with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the NMC Code of Conduct, and the Common Law Duty of Confidentiality.
As a CQC-regulated provider, we are also bound by CQC Fundamental Standard: Regulation 11 (Need for Consent), which requires us to ensure that care and treatment is only provided with the informed consent of the patient.
2. What Information We Hold
We may hold the following categories of personal information about you:
| Category | Examples | Classification |
|---|---|---|
| Identity | Name, date of birth, gender | Personal data |
| Contact | Email, phone, address | Personal data |
| Health & clinical | Medical history, medications, weight, BMI, clinical notes, prescriptions | Special category (Article 9) |
| Financial | Payment records (via Stripe — no card numbers stored) | Personal data |
| Communications | Consultation notes, emails, messages | Personal data |
| Technical | IP address, browser data (with consent) | Personal data |
3. Consent for Treatment
Consent is a fundamental principle of healthcare. Before any clinical assessment or treatment is provided, LSJ Rejuvenate will ensure that you have given your informed, voluntary, and documented consent.
What informed consent means
You will be given clear, accessible information about your proposed treatment, including the benefits, risks, alternatives, and what will happen if you choose not to proceed. You will have the opportunity to ask questions before consenting.
How we record consent
Consent is recorded in your clinical record at the time it is given. For prescription-only treatments, consent is obtained and documented prior to any prescription being issued.
Your right to withdraw consent
You may withdraw your consent to treatment at any time without detriment to your care. Simply contact us by email or telephone. Withdrawal of consent does not affect the lawfulness of treatment already provided.
Capacity and consent
We follow the Mental Capacity Act 2005. If there is any concern about a patient's capacity to consent, we will follow the appropriate assessment process and, where necessary, act in the patient's best interests.
4. Consent for Data Processing
Under UK GDPR, we process your personal data on the following lawful bases. Where we rely on consent as our lawful basis, you have the right to withdraw it at any time:
| Processing Activity | Lawful Basis | Withdrawable? |
|---|---|---|
| Clinical assessment & treatment | Healthcare provision (Art. 9(2)(h)) | No — required for care |
| Clinical records | Legal obligation (Art. 6(1)(c)) | No — regulatory requirement |
| Payment processing | Contract performance (Art. 6(1)(b)) | No — required for service |
| Analytics cookies | Consent (Art. 6(1)(a)) | Yes — via cookie banner |
| Marketing emails | Consent (Art. 6(1)(a)) | Yes — unsubscribe at any time |
| GP summary sharing | Consent (Art. 6(1)(a)) | Yes — tell us at any time |
5. Confidentiality
All personal and health information you share with us is treated as strictly confidential. We will not disclose your information to any third party without your consent, except in the following limited circumstances:
- Legal obligation: where we are required by law to disclose information (e.g. court order, regulatory investigation)
- Safeguarding: where there is a serious risk of harm to you or another person (see our Safeguarding Policy)
- Prescription fulfilment: sharing necessary clinical information with our pharmacy partner to dispense your prescription
- Regulatory bodies: CQC, NMC, or law enforcement where legally required
All staff and contractors with access to patient information are bound by confidentiality obligations. Clinical records are stored securely and access is restricted to authorised personnel only.
6. Your Rights
You have the following rights under UK GDPR. To exercise any of these rights, email [email protected] with the subject line "Data Rights Request". We will respond within 30 calendar days.
If you are not satisfied with how we handle your data, you may complain to the Information Commissioner's Office (ICO):
ico.org.uk/make-a-complaint | 0303 123 1113 | ICO Reference: C1734425
7. Data Retention
Clinical records are retained for a minimum of 8 years from the date of last treatment in accordance with NHS and NMC professional guidance. Financial records are retained for 7 years as required by HMRC. After the applicable retention period, data is securely deleted or anonymised.
For full details of our data retention schedule, please see our Privacy Policy.
8. Contact
LSJ Rejuvenate Ltd — Data Controller & Consent Lead
Email: [email protected]
Telephone: 07540677983
CQC Provider ID: 1-24684837405 | Companies House: 16588104 | ICO Reference: C1734425