Patient Privacy Notice
Last updated 6 November 2026
1. Who we are
Opus Biological Limited (“Opus”, “we”) is a sports medicine and regenerative medicine clinic. We are the data controller for the personal information in your Opus clinical record, which means we decide how it is used and are responsible for protecting it.
We see patients at two clinics:
- 54 Wimpole Street, Marylebone, London W1G 8YJ
- Emmanuel Kaye House, King Edward VII’s Hospital, 37a Devonshire Street, London W1G 6QA
At Emmanuel Kaye House we work in partnership with Bupa / King Edward VII’s Hospital. The hospital also keeps some information about you (for example when you register at its reception, or for tests it carries out) and is responsible for that information itself. Its own privacy notice explains how it uses it.
| Contact us | |
|---|---|
| Data controller | Opus Biological Limited (company number 11197130), 105 High Street, Worcester, WR1 2HW |
| ICO registration | ZA549674 |
| Data Protection Lead | Lauren Porter, Director |
| info@opusbiological.com (please mark your email “Data protection”) | |
| Phone | 020 8609 7843 |
| Post | Data Protection Lead, Opus Biological, 54 Wimpole Street, London W1G 8YJ |
2. The information we collect
| Type | Examples |
|---|---|
| Identity and contact details | Name, date of birth, address, phone, email, emergency contact. |
| Health information | Medical history, symptoms, examination findings, diagnoses, treatment and procedure records, medicines, ultrasound images and reports, blood and other test results, and letters to and from other clinicians. |
| Insurance and payment | Insurer, membership number, authorisation codes, invoices and payment records. Card payments are processed by our payment provider; we do not store full card numbers. |
| Communications | Emails, letters and notes of phone calls with you. We do not record phone calls. |
| Other | Your communication and access needs, chaperone preferences, and feedback or complaints. We do not currently use CCTV at our clinics. |
Information about your health is “special category” data, which the law gives extra protection.
3. Where we get it from
Mostly from you. We may also receive information from your GP or the clinician who referred you, your insurer, laboratories and imaging providers, Bupa / King Edward VII’s Hospital, and someone acting on your behalf with your agreement.
4. How we use it and our legal basis
| What we use it for | Legal basis |
|---|---|
| Assessing, diagnosing and treating you, and keeping your clinical record | To provide the health care you have asked for: our contract with you (or our legitimate interest in providing care where your insurer pays), and UK GDPR Article 9(2)(h) for health data. |
| Arranging and billing your care, including insurance claims | Contract with you, or our legitimate interests. |
| Communicating with you about appointments, results and follow-up | Contract with you. |
| Meeting our legal and regulatory duties, for example to the Care Quality Commission, for safeguarding, or under a court order | Legal obligation, and the relevant condition for health data. |
| Improving our service through audit, feedback and handling complaints | Our legitimate interests in providing safe, good-quality care. Audit uses the minimum information needed. |
| Sending you news, offers or newsletters | Only with your consent, which you can withdraw at any time. |
We also owe you a duty of confidentiality as your clinicians. We share information for your care where you would reasonably expect us to, and otherwise only with your agreement or where the law requires or allows it.
We do not make decisions about you based solely on automated processing.
5. Who we share it with
- Your GP and other clinicians involved in your care, unless you ask us not to (we will explain any risks of not sharing).
- Laboratories, imaging providers (for example for MRI and CT scans) and pharmacies, so they can carry out tests or supply medicines.
- Your insurer, where your care is insured: the information needed to authorise and pay for your treatment.
- Bupa / King Edward VII’s Hospital, for care at Emmanuel Kaye House.
- Organisations that provide services to us under contract and confidentiality terms, such as our clinical records system (Semble), Microsoft 365, IT support, payment processing and couriers.
- Regulators and authorities where the law requires it, for example the Care Quality Commission, the General Medical Council, the police, the local authority for safeguarding, or a court.
We never sell your information.
6. Storing your information outside the UK
Our clinical records system (Semble) and Microsoft 365 store your information in the UK. If any information ever needs to be transferred outside the UK, we make sure appropriate legal safeguards are in place first.
7. How long we keep it
We keep adult clinical records for at least 8 years after your last treatment. If you were treated at 16 or 17, we keep them until your 25th birthday (or 26th if you were 17 when treatment ended), and for at least 8 years. Financial records are kept for 6 years. Our full retention schedule is available on request.
8. Keeping it safe
Access to your record is limited to staff who need it. Our systems use passwords and two-step login, devices are encrypted, paper is locked away and shredded, and our staff are trained in confidentiality every year.
9. Your rights
You have the right to:
- get a copy of your information (a subject access request). This is free and we will normally respond within one month
- ask us to correct information that is wrong (we will add your view to the record if a clinician disagrees)
- ask us to delete information or limit how we use it, although we usually have to keep medical records for the period above
- object to us using your information for some purposes, such as audit
- withdraw consent to marketing at any time
- receive information you gave us in a portable format, where this applies
To use any of these rights, contact us using the details in section 1. We may ask for proof of identity. Patients aged 16 and 17 can make these requests themselves.
10. Concerns and complaints
If you are unhappy with how we have used your information, please contact our Data Protection Lead first. You can also complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
11. Changes to this notice
We review this notice every year. The latest version is on our website and available at reception. This version: 1.0, published 6 November 2026.
For how we use information collected through this website, see our website privacy policy.