PRIVACY POLICY

Last updated: 24 September 2026

Mr Simon Abram takes your privacy very seriously and is committed to safeguarding your personal information.

We understand that by sharing personal details with us, you are placing trust in how that information is handled. Protecting your confidentiality is a central responsibility. We comply with UK data protection law (the UK General Data Protection Regulation and the Data Protection Act 2018, together “Data Protection Laws”) and with professional confidentiality standards, including those set by the General Medical Council.

This Privacy Policy explains how and why we collect, use, store and share your personal data, including how artificial intelligence (AI) is used to help prepare clinic letters. It also explains your rights and how to exercise them.

Mr Simon Abram provides his private practice through Foundry Clinic Ltd, which is the data controller for the purposes of Data Protection Laws. References to “we”, “us” or “our” in this document mean Foundry Clinic Ltd and Mr Simon Abram.

Foundry Clinic Ltd is registered with the Information Commissioner’s Office (ICO), registration number ZC086996. Mr Abram is also registered individually, registration number ZB970249.

The information we collect

When we refer to “personal data”, we mean any information that identifies you, or could identify you when combined with other details.

Depending on your interaction with us – whether as a patient, referrer, enquirer or job applicant – we may collect information such as:

Your name, date of birth and contact details (address, email, phone number).
Details of your next of kin.
Correspondence between you and us, including referral letters and quotes.
Records of consultations, investigations, operations and treatment, whether provided by us directly or through a hospital or other provider.
Your medical history, medications, allergies and occupation, where relevant to your care.
Feedback and outcome information that you provide.
Records of phone calls, complaints or incident reports.
Payment, insurance and billing information.
Information gathered from this website, including IP address, browser type and how you use the site.

Much of this is “special category” data – information about your physical or mental health – which the law protects more strongly. We may also hold information relating to children where they are our patients.

If you share personal details about another person (for example, a next of kin), please make sure they are aware of this policy.

Our legal basis for using your information

We use your health information to provide your care, as permitted for health professionals bound by a duty of confidentiality (UK GDPR Article 9(2)(h)). Other information is used to fulfil our agreement with you, to meet legal obligations such as record-keeping, or for our legitimate interests in running the practice. Where we rely on your consent, you can withdraw it at any time.

How we use your information

We will only use your personal data for the purposes it was collected, and always in line with Data Protection Laws, confidentiality guidance and clinical record-keeping requirements. In practice, this means your data may be used to:

Provide medical care and related services to you.
Write clinic letters, operation notes and reports to you, your GP, your referrer and others involved in your care.
Manage billing, accounting, audits and fraud checks.
Respond to requests or enquiries.
Fulfil legal or regulatory requirements.
Share relevant information with clinicians and healthcare professionals directly involved in your care.
Support quality assurance, clinical audit or the investigation of complaints.
Monitor and improve services, including patient feedback and outcome tracking.
Carry out statistical analysis in anonymised form.
Make sure this website works properly.

Sensitive health information is only shared when necessary for your treatment, for clinical audit, or as required by law and professional guidance.

Use of AI

The practice uses bespoke practice management software that integrates with Anthropic’s Claude AI models through a commercial API to help prepare first drafts of clinic letters. This is provided under Anthropic’s commercial terms, which include data protection obligations and do not permit your information to be used to train AI models.

Before any information is sent, the software automatically removes your name, date of birth, hospital record number and contact details, and all information is transmitted over an encrypted connection. The clinical content is not anonymous, however, so it is protected to the same standard as the rest of your medical record.

Every letter is reviewed and approved by Mr Abram before it is sent. AI is not used to diagnose, prioritise patients or make decisions about your care.

If you have any questions or concerns about this, please raise them with us.

Service providers

We use a small number of trusted providers who process data on our behalf under contracts requiring confidentiality and security. These include Anthropic (letter drafting), Microsoft 365 (secure document storage and encrypted backups, and our online forms and referral uploads), FreeAgent (accounts), Cloudflare (website hosting) and Plausible (anonymous website statistics). Clinical information is only shared with the first two.

Some of these providers process data outside the UK, including in the United States. Where this happens, we make sure appropriate safeguards are in place to protect it to UK standards.

Sharing your information

In the course of providing your care, your information may be shared where necessary with:

Doctors, nurses and allied healthcare professionals involved in your treatment.
Administrative staff supporting your care (e.g. secretaries).
Your GP and the person who referred you (unless you have asked us not to share, and we are legally able to respect that request).
Hospitals or clinics where you are treated.
Insurers, if they are funding your care or investigating a claim.
NHS bodies, regulators and professional oversight organisations (e.g. Care Quality Commission, GMC).
The service providers listed above, and professional advisers such as accountants, auditors, legal advisers and debt recovery services.
Law enforcement or government bodies where required by law.

We never sell your personal data.

Health information

We may share relevant clinical details with external hospitals, clinics or practitioners where this is necessary for your care. In such cases, those providers may also act as independent data controllers and must manage your data in accordance with Data Protection Laws.

If your insurer is paying for all or part of your treatment, we will share information with them about the care provided, its clinical necessity and costs, but only to the extent required.

We may also share information with regulators if we are legally required to do so, for example in response to a complaint or investigation into a clinician’s professional conduct.

In emergencies, or if you are unable to give consent, we may process and share your personal data if it is necessary to protect your life or health.

We also contribute anonymised data to national clinical audits and research initiatives designed to monitor outcomes and improve standards of care.

Security of your data

We apply strict organisational and technical safeguards to protect personal data from misuse, loss or unauthorised access. Patient records are held in encrypted form on the practice’s own systems, and dictated notes are transcribed on the practice’s own computer rather than by an external service.

Where payments are made online, transactions are processed by secure third-party providers.

Although we use secure connections, transmission of information over the internet can never be guaranteed to be completely safe. If you choose to send sensitive information by ordinary email, please be aware of this risk. Referral letters can be sent securely using the upload service on our referrals page.

How long we keep your information

Medical records are kept for as long as required by law and professional guidance, in line with the NHS Records Management Code of Practice. Other information is kept only for as long as it is needed.

Cookies and this website

This website does not use cookies. We use Plausible Analytics to count visits, which does not use cookies, does not collect personal data and does not track you across other websites.

Some pages include content from other providers – a Doctify reviews widget, Google Maps and Microsoft Forms. These are covered by the providers’ own privacy policies.

Your rights

Under Data Protection Laws, you have the right to:

Request a copy of the personal data we hold about you.
Ask us to correct inaccurate information.
Ask us to delete your data, subject to legal and clinical record-keeping requirements.
Ask us to restrict how we use your data, or object to certain uses of it.
Ask for a copy of information you have given us in a portable format, where this applies.
Withdraw your consent at any time, where we rely on consent.

To exercise any of these rights, or if your contact details change, please email enquiries [at] foundryclinic.com. We may need to confirm your identity before acting on your request, and we will normally respond within one month.

If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) on 0303 123 1113 or at ico.org.uk.

Updates to this policy

This Privacy Policy is reviewed regularly and whenever the way we handle personal data changes. The date at the top shows when it was last updated.

Contact

If you have any questions about how your data is handled, please email enquiries [at] foundryclinic.com.