Privacy Policy

Last updated: 13 October 2026

This policy explains how we use the personal information you give us when you visit this website, send an enquiry or contact Mr Oezdogan's practice.

Who we are

This website is run by PANTA RHEI - PLASTIC SURGERY LTD, the company through which Mr Yildirim Oezdogan, consultant plastic surgeon (GMC 7366644), provides private care. The company is the data controller for the information described here.

Registered office: 34 Durnford Road, London N11 2EH
Company number: 11512714 (registered in England and Wales)
ICO registration number: ZB146021
Contact: enquiries@oezdogan.co.uk

What information we collect

Enquiry form: your name, email address, telephone number (optional) and your message.
Email: whatever you include when you write to us.
Consultation and treatment: if you go on to book, we hold the information needed to arrange and provide your care, such as contact details, appointment details, medical history, examination findings, clinical photographs, correspondence and, for insured patients, your insurer and authorisation details.
Website visits: basic technical information, such as your IP address and browser type, is processed by our hosting provider to deliver the site and keep it secure. We do not use analytics or advertising cookies.

Please do not include medical details or photographs in the enquiry form. These are discussed safely at your consultation.

We also receive information about you from others involved in your care: your GP or another doctor who refers you, the hospitals where you are seen, other clinicians, and your insurer if you are claiming.

Why we use it and our legal basis

To reply to your enquiry and arrange appointments. Legal basis: steps taken at your request before a contract, and our legitimate interest in responding to people who contact us. If you include health details in an enquiry, we use them only to reply, under the health care condition below.
To provide and record your care. Health information is special category data. We process it for the provision of health care by a registered health professional bound by a duty of confidentiality (UK GDPR Articles 6(1)(b) and 9(2)(h), and Data Protection Act 2018, Schedule 1, paragraph 2).
To deal with insurers, billing and accounts. Legal basis: contract and legal obligation.
To meet professional, legal and regulatory duties, including GMC requirements, medical indemnity and responding to complaints or claims. Legal basis: legal obligation and our legitimate interest in running a safe, accountable practice. Where health information is involved, we rely on the establishment, exercise or defence of legal claims (UK GDPR Article 9(2)(f)).

We do not use your information for marketing, and we never sell it.

Giving us your information is your choice, but we need your contact details to reply to you and your medical information to treat you safely. We do not make decisions about you by automated means.

Who we share it with

Only when needed for your care or to run the practice:

The hospitals where you are seen or treated: Highgate Hospital (Nuffield Health), The London Welbeck Hospital and Chase Lodge Hospital. Highgate Hospital and Chase Lodge Hospital hold the medical records for care provided there, and The London Welbeck Hospital holds the records for inpatient care. Mr Oezdogan's practice holds the records for outpatient care at The London Welbeck Hospital. Each hospital acts as a separate data controller for the records it holds, under its own privacy notice.
Other clinicians involved in your care, such as anaesthetists, radiologists, pathology laboratories and hand therapists.
Your GP, with your agreement.
Your private medical insurer, if you are claiming.
Our medical secretary, who works for the practice under a contract, and service providers who support the practice: Healthcode (practice software, billing and insurer claims), Microsoft (Microsoft 365 email), Hostinger (website hosting and the enquiry form) and our accountant. Each is bound by a written contract that requires them to keep your information confidential and secure.
Regulators, our medical indemnity provider or legal advisers, where required by law or to handle a complaint or claim.

Where your data is stored

Your information is stored in the UK or the European Economic Area. Our email is provided by Microsoft 365. Our website and enquiry form are hosted by Hostinger, whose servers for this site are located in the EEA. Where any provider transfers data outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Addendum.

How long we keep it

Enquiries that do not lead to a consultation: up to 12 months, then deleted from our mailbox and from the website's form records.
Medical records: in line with UK guidance for health records, normally 8 years after your last treatment for adults, and longer where required. Cosmetic surgery records may be kept longer to support any future care.
Financial records: 6 years, as required by law.

Your rights

You have the right to:

ask for a copy of the information we hold about you
ask us to correct information that is wrong
ask us to delete information, where we are not required to keep it
object to or ask us to restrict how we use it
ask us to transfer information you gave us to another provider

Some of these rights are limited, for example we must keep medical records for the periods above. To use any of these rights, email enquiries@oezdogan.co.uk. We will reply within one month.

Complaints

If you are unhappy with how we have handled your information, please email enquiries@oezdogan.co.uk first. We will acknowledge your complaint within 30 days and tell you the outcome. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Cookies

This website does not use analytics, advertising or tracking cookies. See our Cookie Policy for details.

Changes to this policy

We may update this policy from time to time. The latest version will always be on this page.