Who is responsible for your information
OP CLINIC is operated by MEDICINE BOX (HOLBORN) LTD, the data controller for this website and enquiries made to the clinic. For privacy questions or requests, email contact@opclinic.co.uk or write to the Clinic Manager, OP CLINIC, 77 Southampton Row, London WC1B 4ET.
When you browse
You can read the website without creating an account. Cloudflare hosts and protects the site and processes technical information such as your IP address, browser details, pages requested and the time of a request. We use this information to deliver pages, investigate faults and protect the website against misuse. Our lawful basis is our legitimate interest in providing a reliable, secure website.
When you contact us
If you call, email or message us on WhatsApp or WeChat, we receive the name and contact details you provide, your message and any language or contact preferences you share. We use these to answer your questions and arrange a consultation. Where you ask us to take steps towards a booking, our lawful basis is taking steps at your request before entering a contract. For other enquiries, we rely on our legitimate interest in responding to people who contact the clinic. You choose whether to contact us; without a way to reply, we may be unable to help with your enquiry.
Online contact form
If you use the online form, we collect your name, email address and/or telephone number, any WeChat ID you enter, chosen reply method, preferred contact time, broad enquiry topic, page language, submission time and request reference. You may also add a short optional message. The WeChat ID field is optional unless you select WeChat as your reply method, when it is required. At least one reply channel is required so that we can respond and, where requested, arrange a consultation. The required privacy acknowledgement records that you have read this notice; it is not consent for marketing and is not the lawful basis we use to answer your request. A Cloudflare Worker receives the form to validate and relay it. Cloudflare Turnstile processes technical signals such as IP address and browser, device and site information to distinguish people from automated abuse; the form details are not inputs to that anti-abuse assessment. The Worker passes an accepted request to Google Apps Script, which records it in a Google Sheet restricted to authorised clinic staff. Turnstile does not assess whether a treatment is suitable for you.
Health information
Please use initial enquiries for general questions and appointment arrangements. Do not include medical history, medication details, urgent clinical information or treatment photographs in the online form, or send them by ordinary email, WhatsApp or WeChat. If clinical information is needed, the team will explain how to provide it and how it will be used. For urgent medical help, contact an appropriate urgent or emergency service. This notice covers the website and initial enquiries; the privacy information relevant to clinical records will be provided when those records are collected.
Who may receive information
Enquiries are handled by authorised clinic staff who need the information to respond. Cloudflare hosts and protects the website, provides Turnstile and relays accepted online requests through a Worker. Google Apps Script receives the request and writes it to a Google Sheet whose access is restricted to authorised clinic staff. The Sheet is the master record. Apps Script also sends an alert to the clinic-controlled inbox at contact@opclinic.co.uk. That email displays the submission time, name, email address, telephone or WhatsApp number, WeChat ID, chosen reply method, preferred contact time, broad enquiry topic, page language and optional message submitted through the form, together with the request reference and private Sheet link. This creates an additional copy in the clinic email system, where access is limited to authorised staff. Our email, telephone and messaging providers process information needed to deliver the channels you choose. We may also share relevant information with professional advisers or authorities where necessary to meet a legal obligation or establish, exercise or defend legal claims. We do not sell enquiry details or add you to a marketing list because you contacted us.
External services and international processing
WhatsApp, WeChat and Google Maps are external services you choose to use. Those services have their own privacy notices and may process information outside the UK. Cloudflare and Google operate international services and may process website, security, enquiry or email-delivery information outside the UK, including in the United States. Where UK data protection law requires safeguards for a restricted transfer, their data processing terms provide applicable transfer mechanisms, which may include the UK extension to the EU–US Data Privacy Framework and standard contractual clauses with the UK Addendum. Contact contact@opclinic.co.uk for information about the providers handling your enquiry and a copy of the applicable transfer safeguards.
How long information is kept
The whole online contact request, including any WeChat ID and optional message, is kept in the restricted Google Sheet for up to 365 days from submission and may be deleted sooner when it is no longer needed. The enquiry-detail alert creates an additional copy in the clinic mailbox. That copy is protected by the clinic mailbox access controls, kept only as long as needed to answer the request and complete agreed follow-up, and then deleted from the clinic mailbox. If an enquiry becomes a booking, clinical record, complaint or legal claim, information needed for that purpose may be moved to a separate system and covered by the privacy information and retention period for that record. After deletion from the live Sheet, protected backup or recovery copies may remain until Google’s applicable recovery or backup lifecycle ends; they are not used routinely, and a deletion will be reapplied if a recovery restores the record. We keep other enquiry correspondence only as long as needed to answer the request and complete agreed follow-up. Technical records and alert-delivery records are kept only as needed to operate, secure and troubleshoot the service, taking account of the providers’ retention arrangements. You can ask us about the criteria that apply to your information.
Your information rights
Depending on the circumstances and lawful basis, you may ask to access or correct your information, have it erased, restrict its use, or receive a portable copy. If we rely on consent for a particular use, you can withdraw that consent at any time without affecting earlier lawful use. Contact contact@opclinic.co.uk to make a request. We may need enough information to check your identity before releasing personal information.
Your right to object
You can object to processing based on legitimate interests, including our use of information to handle a general enquiry, for reasons relating to your circumstances. Send your objection to contact@opclinic.co.uk. We will consider it and explain whether we must continue processing for compelling legitimate reasons or legal claims.
If you have a concern
Please contact us if you are unhappy with how your information has been handled. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint.
Decisions and updates
Turnstile may accept or reject an online submission solely to protect the form against automated abuse. It does not decide whether you are suitable for treatment. If the form is unavailable or rejected, you can use another contact channel. We will update this notice when the way we handle website or enquiry information changes. Last updated: 14 September 2026 (version 4).
Contact the Information Commissioner’s Office (ICO) · Cloudflare data processing terms