What a private clinic does with your data

By Trevor, founder of Privacy Architect

You paid for a prescription. That doesn’t mean you signed away the file.

Somewhere in the paperwork there was a tick box about your information, agreed at the end of a long evening. This piece is about what that box actually did: what a private clinic keeps, who it may pass it to, how long it stays, and what you can ask for afterwards. It follows on from our piece on medical cannabis prescribing, and it starts where that one stops.

We’ve kept the law general and the questions specific, because we explain rights rather than advise on cases. If yours is a live dispute, a solicitor is the person for it.

Why health data sits in a special box

Health data is special category data. Article 9(1) of the UK GDPR prohibits processing it unless a condition applies, so a clinic needs two things, not one: a lawful basis under Article 6, and a separate condition under Article 9.

The conditions that usually matter here are explicit consent under 9(2)(a), and medical diagnosis or the provision of care under 9(2)(h). Where care is the condition, 9(3) adds a requirement that the work is done by someone under a duty of professional secrecy. The Data Protection Act 2018, Schedule 1 Part 1, paragraph 2 carries the health and social care condition and its safeguards.

One point worth holding on to: there is no “legitimate interests” condition in Article 9. It exists in Article 6 and stops there. A prescription list cannot be used for marketing on that footing.

Two gates, in practice

Here is the shape of it, without the numbering. To use your health data lawfully, a clinic needs a reason to process data at all, and then a separate, narrower reason to process this kind of data. The first reason might be that it is fulfilling a contract with you, or that it has a legal duty. The second has to come from the short list that covers health: your explicit consent, or providing you with care. Both have to be true at once. A clinic that can only name the first one has not finished the sentence.

What one published policy actually says

We read the published privacy policy of a UK cannabis pharmacy, the public page only, no account, no login.

Its special category section rests on explicit consent, and says so. Fair enough as a starting point, and worth remembering that consent can be withdrawn.

Its purposes section is where a reader’s eyebrow goes up. It offers six “lawful grounds” as a single list: contract, legitimate interests, express consent, preventative or occupational medicine and medical diagnosis, public health, and legal obligation.

Two of those six are Article 9 conditions rather than Article 6 bases. Legitimate interests appears where it cannot lawfully do the work for health data. And the law’s word is “explicit”, not “express”. These are fair questions rather than accusations: which gate is doing the work, for which purpose, and could the policy say so in plainer terms.

The same policy says it uses de-identified information (identifiers such as name, address and contact details removed) to improve its services and its “artificial intelligence systems”. That deserves a plain sentence of its own: your records may feed a system nobody sat you down to explain. It’s reasonable to ask what exactly is stripped out, who can see the result, and whether anything stays attached to you.

Questions worth asking before you sign

Ask which of the two reasons it is relying on for each thing it does, and ask for that in writing. Ask whether your GP has been told, and whether you agreed to that. Ask who inside the clinic can see your notes. Ask what happens to your data if you stop being a patient, or if the clinic closes. Ask whether anything is used to improve products or systems, and whether you can say no to that part while still being treated. A clinic that answers those five plainly is a clinic that has thought about them. One that cannot is worth a second question.

What it was like for me

When I started, it was all done by phone and video, with no paperwork at all. A nurse saw me on a video call first and passed my details to a specialist, which took three days. The specialist wrote the prescription there and then, pending my summary of care record, which holds all my medications and my back pain history. That took five days to process, not three, because there was so much on it. Once the prescription was issued, the pharmacy sorted delivery within a couple of days and I had it on the third. It was strange seeing my name on a prescription for cannabis products, but I understand why it has to be that way in a specialist field. It was a quick process, and for me a valid and warranted one.

Who else may see it

Your own care is the obvious answer, and the permitted one: sharing with the doctor you were referred to, or the pharmacy dispensing your prescription, can rest on the health and care condition, under a duty of secrecy.

Anything beyond your care needs its own justification. Consent given for treatment does not automatically stretch to research, marketing or a commercial partner. If a policy lists sharing broadly, ask which condition covers each purpose.

We haven’t verified what a police request can obtain in practice. That belongs with the driving piece, and we’d rather say so than guess.

How long they keep it

The policy we read says two years from the point of last use, and cites the NHS Records Management Code of Practice for Clinical Audit data.

Two honest notes. That Code is written for NHS organisations, so a private clinic following it is making a choice, not obeying a rule. And the citation is to audit data, while the retention line reads generally. Ask which applies to your file.

Two things we can source. Article 5(1)(e) requires data to be kept no longer than necessary, and Article 15(1)(d) entitles you to the criteria used to decide the period. If the answer is “two years”, you’re entitled to the reasoning behind it.

What you can ask for

A subject access request, under Article 15. Since February 2026 there’s a proportionality test in Article 15(1A): you’re entitled to what a reasonable and proportionate search turns up, applied back to January 2024.

The clock is one month, under the new Article 12A, running from the latest of receipt, any identity information, or a fee, with up to two further months if the request is complex, and reasons given inside the first month. It’s free unless the request is manifestly unfounded or excessive, which Article 12(5) permits a fee for.

The policy says it won’t “reformat, convert or migrate” your data and will send it in “our standard format”. If you need a file you can sort, ask early: that conversation is easier before the deadline than after.

If it goes wrong

The complaint route changed on 19 June 2026. Article 77 has gone. You complain to the clinic first, and section 164A of the Data Protection Act 2018 requires it to acknowledge within thirty days. If that doesn’t settle it, you go to the regulator under section 165.

The policy we read gives the regulator’s postal address and links a general page about rights. It doesn’t mention complaints, or the two-step route. A policy that tells you where the regulator lives but not how to complain about the clinic is half a map.

What we don’t know yet

We couldn’t read the regulator’s current guidance on special category data in full, so we haven’t leaned on it. We haven’t checked the professional guidance from the medical regulator or the care regulator, and make no claim about it. And we haven’t confirmed whether regulations have yet been made under the new power in section 74 of the Data (Use and Access) Act, so we don’t claim the health-data conditions themselves have changed beyond what’s written above.

Where we don’t know, we’d rather say so than fill the gap with something confident and wrong.

Sources

UK GDPR Article 9: https://www.legislation.gov.uk/eur/2016/679/article/9

UK GDPR Article 12: https://www.legislation.gov.uk/eur/2016/679/article/12

UK GDPR Article 15: https://www.legislation.gov.uk/eur/2016/679/article/15

Data (Use and Access) Act 2025, section 76: https://www.legislation.gov.uk/ukpga/2025/18/section/76

Data Protection Act 2018, Schedule 1: https://www.legislation.gov.uk/ukpga/2018/12/schedule/1

Data Protection Act 2018, section 165: https://www.legislation.gov.uk/ukpga/2018/12/section/165