Medvance Obesity & Weight Management Clinic  |  Medvance Solutions Ltd

Privacy Notice

For patients and people enquiring about Medvance care  |  Issued 25 September 2026

1. Who we are and how to contact us

Medvance Obesity & Weight Management Clinic is a private, doctor-led service for adults (18+). The legal provider and data controller for this service is Medvance Solutions Ltd (company number 13762738). Dr Sachin Khunti is the company director, proposed Registered Manager and clinical lead. The clinic provides appointments from Wigston Central Surgery, Two Steeples Medical Centre, 10 Abington Close, Wigston, LE18 2EW, and secure remote consultations when clinically appropriate.

Privacy and data-rights enquiries: sachin_101@hotmail.co.uk. Please use this address to request a secure method for sending medical records or identity documents rather than sending sensitive attachments by ordinary email. The clinic will update this notice if a dedicated privacy contact is introduced. If you need to write rather than email, please request the confirmed postal correspondence arrangement from Medvance before sending confidential information to the hosted premises.

This notice explains how Medvance Solutions Ltd handles information for Medvance care. It does not cover unrelated NHS consultations or records held independently by your own NHS GP. It is given when information is collected and made available before your first consultation.

2. The information we collect

• Identification and contact details: name, date of birth, address, contact details, NHS number where relevant, and the fact and method of identity/age verification. We do not routinely keep copies of photographic ID when a verification record is sufficient.

• Clinical information: current and previous health conditions, medicines, allergies, family history, weight history, height, weight, BMI, blood pressure, laboratory results, relevant specialist/GP correspondence and previous obesity treatment.

• Questionnaire and consultation data: eating behaviours, physical activity, nutrition, mood and other screening responses; consultation notes, consent choices, treatment plans, prescriptions, monitoring, follow-up and safety-netting.

• Service records: appointments, payment/administrative information, communications, complaints, incidents, safeguarding concerns where relevant and evidence required for safe clinical governance.

We collect the minimum information reasonably needed for each purpose. Sensitive information is treated as confidential clinical data and accessed only by authorised people with a legitimate role.

3. Why we use information and our legal bases

We use your data to answer enquiries, arrange care, assess whether treatment is suitable, prescribe and monitor where appropriate, maintain accurate medical records, communicate with you and relevant healthcare professionals, meet regulatory and professional duties, and manage complaints, incidents and clinical audit. The UK GDPR legal bases depend on the actual purpose:

For legitimate interests, these are the interests of keeping the clinic secure, safe and accountable, improving care and responding to genuine quality concerns without unnecessary interference with your privacy. Clinical records are not based solely on data-protection consent: the clinic has separate legal and professional reasons to create and retain them. The common-law duty of confidentiality and any permissions required for particular disclosures continue to apply.

4. Where the information comes from

Most information comes directly from you. With your agreement where appropriate, we may also receive relevant information from your NHS GP, other clinicians, hospitals, registered pharmacies, diagnostic laboratories or reliable records you share (for example, NHS App medication information). Medvance does not assume that being hosted at a GP practice gives it unrestricted access to your NHS record or to the NHS Summary Care Record; any access must be expressly authorised and lawful. Where essential information cannot be verified safely, prescribing may be delayed or declined.

5. Who may receive information

• Your NHS GP or relevant specialist service where you agree to routine care communication, or where another lawful safeguarding, legal or overriding safety justification permits disclosure. A clinical summary may include medicines and monitoring responsibilities.

• Registered pharmacies and laboratories where necessary for a prescription or investigation; urgent healthcare services where required for your safety.

• Safeguarding teams, regulators, the police, courts, professional advisers or insurers where there is an appropriate legal, professional or safety basis.

• Approved hosting/IT, secure communications, booking and clinical-record suppliers acting in a documented role with access and contractual safeguards.

• A suitably authorised independent clinical reviewer for a proportionate peer audit, serious incident or complaint, and an authorised temporary covering clinician for continuity of care if the agreed arrangements are in place. Access is limited to what is required for the particular task.

We do not sell medical information. Your patient record is not automatically transferred into your NHS GP record just because Medvance uses SystmOne. We document the basis and content of relevant clinical disclosures, and will not treat a refusal to consent to routine GP letters as an automatic reason to refuse all care; where sharing is essential for safe prescribing, your clinician will explain the implications.

6. Electronic records, security and remote consultations

The intended primary record system is SystmOne within the agreed host-practice environment. Medvance will confirm lawful access permissions, controller/processor roles, secure separation/identification of private care and available backup and restoration assurances before using the configuration for live care. Named user accounts, appropriate authentication, restricted access and system audit capability are required. We do not keep a separate uncontrolled clinical database or routinely download full clinical records to personal devices.

Secure video and approved electronic communication may be used for suitable consultations and follow-up. Remote consultations document identity verification, your physical location, clinically relevant measurements, assessment limitations and care decisions. Please do not send confidential material through unapproved messaging channels.

7. Optional AI-assisted consultation notes

Medvance may introduce an AI-assisted documentation tool to produce a draft of clinical notes. No identifiable patient information will be processed by such a tool until a named supplier has passed a supplier-specific data protection impact assessment, privacy/security checks, contractual review and approval for the actual workflow. A suitable patient information and choice process must also be in place.

If the tool is introduced, we will tell you before it is used and record your separate choice. You can decline AI-assisted documentation without losing access to Medvance care: your clinician will take notes manually. AI will not independently diagnose, select your treatment, prescribe medicines or make decisions with legal or similarly significant effects. Dr Khunti reviews and approves any draft before it becomes part of your clinical record.

The selected supplier, whether temporary audio or transcripts are involved, their location and retention, and any overseas transfers will be disclosed before live use. We will not permit unapproved use of identifiable consultation content to train general AI models or for unrelated secondary purposes.

8. International processing and transfers

Medvance checks where approved suppliers and their sub-processors process data. Any transfer outside the UK must have an applicable UK adequacy regulation or a suitable recognised transfer safeguard, such as the UK International Data Transfer Agreement or UK Addendum where appropriate, with an assessment of transfer risks where required. The actual AI supplier and any relevant transfer arrangements are not yet selected and must be added to the live version of this notice before the AI service is used. You can request further details of applicable safeguards.

9. Retention and secure disposal

The clinic adopts an adult clinical-record retention baseline of eight years after the last treatment or entry, subject to any longer period required for the individual record, ongoing care, an active complaint, claim, investigation, safeguarding matter or other legal duty. Records are reviewed at the end of their retention period and securely disposed of where appropriate. Administrative, financial and supplier-related records follow the relevant category-specific schedule. A future AI supplier's temporary audio/transcript retention must be documented and kept to the minimum required before approval; draft audio is not automatically retained as part of the clinical record.

If the service closes, changes provider or changes record systems, Medvance Solutions Ltd remains responsible for lawful record custody, continuity of care, secure transfer where justified, and patient access during the relevant retention periods.

10. Your rights and choices

• Request access to information held about you; we ordinarily respond without undue delay and within one calendar month, subject to relevant legal provisions and any permitted extension.

• Request rectification of inaccurate or incomplete information. Clinical entries are corrected transparently without improperly deleting the historical record.

• Where applicable, request erasure, restriction, objection or data portability. These rights depend on the particular lawful basis and can be limited by healthcare record-keeping and other obligations.

• You have a distinct right to object where we rely on legitimate interests. We will assess your objection under the applicable legal test rather than treating it as an automatic deletion request.

• Withdraw your agreement to optional AI documentation or routine NHS GP communication. This does not undo earlier lawful processing or normally require deletion of medical records that must be retained.

You may ask how your information has been used or make a data-rights request using the contact in section 1. We take reasonable steps to verify identity before releasing records to prevent disclosure to the wrong person.

11. Incidents, concerns and complaints

Any suspected inappropriate disclosure, data loss or unauthorised access is contained, assessed, recorded and investigated. We notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of awareness if a breach is likely to risk people's rights and freedoms; affected people are told without undue delay where a high risk is likely. Our clinical incident processes operate alongside data-breach management when patient safety is affected.

Please raise any concern about your information directly with Medvance using the section 1 contact. You may also complain to the ICO (www.ico.org.uk; telephone 0303 123 1113). The ICO is the UK data-protection regulator. You do not have to contact us before using your right to complain to the ICO.

12. Changes to this notice

We review this notice at least annually and before material changes to our clinical-record configuration, suppliers, AI processing, information sharing or overseas transfers. We will explain material changes and provide revised information before introducing a new processing purpose where required.