Last updated: 26 October 2026
This Privacy Policy explains how Lanthorn Diagnostics Ltd (“Lanthorn Clinic”, “we”, “us”, “our”) collects, uses, stores, and protects your personal information in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our website, booking system, or clinical services, you agree to the terms of this Privacy Policy.
1. Who we are
Lanthorn Diagnostics Ltd is a private medical clinic registered with the Care Quality Commission (CQC). We provide diagnostic ultrasound and related imaging services. We are the data controller for the personal information described in this policy.
- Trading name: Lanthorn Clinic
- Companies House registered: Lanthorn Diagnostics Ltd
- Email: [email protected]
- Clinic address: 59 Mount Pleasant, London, WC1X 0AY
- Registered office address: FIRST 244 EDGEWARE ROAD, LONDON, W2 1DS
We may collect and process the following categories of personal data:
2.1 Personal and contact details. Name, date of birth, address, email address, telephone number.
2.2 Health and medical information (special category data). Medical history, imaging reports, referrals, diagnostic outcomes, the reason you give for booking or requesting a scan, and other health information required to provide clinical services.
2.3 Booking and payment details. Appointment information, your preferred days and times, deposit and payment records (processed securely via our payment provider). We do not store card details directly.
2.4 Technical and website information. When you use our website, limited technical data such as your IP address, browser type and the pages you visit is processed by our hosting provider to deliver the site and keep it secure. If you accept analytics cookies, we also use Google Analytics (through Google Tag Manager) to understand how the site is used; nothing from Google loads until you accept, and Google’s advertising features stay off unless you accept marketing cookies (see our cookie policy). The map on our contact pages is provided by Google Maps and only loads if you choose to show it; Google may then collect location and IP data.
3.1 Directly from you, when you:
- a) Book an appointment through our website or our Semble booking portal.
- b) Send us an enquiry, a callback request, a blood test request, or an MRI, CT or X-ray request through our website.
- c) Provide medical information during consultations.
- d) Contact us by email, telephone, or in person.
3.2 Indirectly, from:
- a) Your GP, consultant, or other healthcare providers (with your consent).
- b) External imaging providers where we refer you for MRI, CT, or X-ray scans.
We process your personal data for the following purposes:
- 4.1 To deliver clinical services: booking appointments, arranging scans with our imaging partners, carrying out imaging, creating reports, and communicating results.
- 4.2 To maintain medical records in line with clinical and regulatory obligations.
- 4.3 To manage billing and payments.
- 4.4 To meet legal and regulatory requirements, including Care Quality Commission compliance.
- 4.5 To respond to enquiries and requests you send us through our website, by email or by telephone.
- 4.6 To improve our services and website, ensuring security and functionality.
5. Legal basis for processing
Our processing of personal data is lawful under:
5.1 Article 6 UK GDPR (lawful bases for processing):
- 6(1)(b), processing necessary for the performance of a contract (provision of healthcare services), or to take steps at your request before entering into one, such as responding to a booking or scan request.
- 6(1)(c), compliance with a legal obligation.
- 6(1)(f), legitimate interests in managing and improving our services and keeping our website secure.
5.2 Article 9 UK GDPR (special category health data):
- 9(2)(h), processing necessary for medical diagnosis and provision of healthcare or treatment.
6. Systems and third-party processors
We use the following secure systems to manage data. All third-party providers act on our instructions and are contractually bound to comply with UK GDPR.
- 6.1 Semble: patient management, appointment booking and our booking portal. Bookings made on our website are created directly in Semble.
- 6.2 Biotronics3D PACS & RIS: storage and reporting of imaging results.
- 6.3 Forth: handling blood test results presentation and sharing.
- 6.4 Cloudflare: hosts our website and provides its security, including Cloudflare Turnstile, which checks that forms are sent by a person rather than automated software. Information you enter on our website passes through Cloudflare’s network on its way to the systems below; Cloudflare does not keep it.
- 6.5 Supabase: secure database, hosted in the UK, where we keep enquiries and MRI, CT and X-ray requests sent through our website.
- 6.6 Resend: sends email notifications of website bookings, enquiries and requests to our clinic team. Emails are sent from Resend’s EU (Ireland) region.
- 6.7 Google Maps: embedded on our contact pages; only loads if you choose to show the map, and may then process location and IP data.
- 6.8 Google Analytics and Google Tag Manager: only if you accept analytics or marketing cookies; used to measure how the site is used and, with marketing consent, our advertising.
7. Data sharing
We may share your personal data only when necessary:
- 7.1 With external imaging providers (MRI, CT, X-ray) where referral is required, including to arrange a scan you have requested through our website.
- 7.2 With your GP, consultant, or other healthcare professionals, where clinically relevant and with your consent.
- 7.3 With regulators (e.g. CQC) or where required by law.
- 7.4 With approved service providers, such as lab partners (Forth, Randox and TDL) and the IT providers listed in section 6, for secure hosting, communication and system maintenance.
We will never sell or share your personal data for marketing purposes.
8. Data retention
8.1 Medical records are retained in line with the NHS Records Management Code of Practice:
- a) Adult medical records: minimum of 8 years after last treatment.
- b) Imaging records: as clinically appropriate.
8.2 Non-clinical data (e.g. enquiries and website requests) is retained no longer than necessary.
9. Your rights
Under UK GDPR, you have the following rights:
- 9.1 Right to access your personal data.
- 9.2 Right to request correction of inaccurate data.
- 9.3 Right to request erasure (where legally permissible).
- 9.4 Right to restrict processing.
- 9.5 Right to data portability.
- 9.6 Right to object to processing.
- 9.7 Right to lodge a complaint with the Information Commissioner’s Office (ICO) (www.ico.org.uk).
To exercise your rights, contact us at [email protected].
10. Data security
10.1 We implement appropriate technical and organisational measures to safeguard personal data, including encryption, secure hosting, and role-based access controls.
10.2 Access to patient data is restricted to authorised clinicians and staff only. Our clinic mailbox, which receives website bookings and requests, can only be opened by staff who handle bookings, each signing in with two-step verification.
10.3 Information sent through our website is encrypted in transit. Website forms are protected against automated misuse, and our website database cannot be read from the internet.
11. International data transfers
11.1 We primarily store and process data within the UK. Our website database (Supabase) is hosted in the UK, and notification emails are sent from the EU (Ireland).
11.2 Some of our providers, including Cloudflare, Supabase, Resend and Google, are companies based in the United States, and Cloudflare’s network operates worldwide. Where data is transferred outside the UK, we ensure appropriate safeguards, such as UK adequacy regulations or Standard Contractual Clauses with the UK Addendum, which are included in these providers’ data processing agreements.
- Online booking. When you book on our website, your name, date of birth, contact details and reason for booking are sent securely to Semble, where your appointment is created. Our clinic team receives an email with the same details. No payment details are collected on our website.
- MRI, CT and X-ray requests. These are requests, not bookings. Your details, reason and preferred days and times are stored in our website database (Supabase) and emailed to our clinic team, who will contact you to arrange a time.
- Enquiries, callback requests and blood test requests. Your details and message are stored in our website database (Supabase) and emailed to our clinic team.
- Please do not include detailed medical information in free-text messages unless we ask for it; we will discuss it with you directly.
13. Updates to this policy
We may update this Privacy Policy from time to time to reflect changes in law, practice, or services. Updates will be posted on our website with the date of revision.
