Privacy notice

How we use your personal information in the private gastroenterology and endoscopy services of Dr Yean Lim.

Last updated November 2026. A printed copy is available from Dr Lim’s secretary.

1. Who we are

Durham Medicals Limited (“DML”, “we”, “us”) provides the private gastroenterology and endoscopy services of Dr Yean Lim. DML is the data controller for the personal information described in this notice. This means we decide how and why your information is used and are responsible for protecting it.

We are not required to appoint a Data Protection Officer because we are a small practice led by an individual consultant. Please send any data protection question or request to the contact above.

When you are treated at a hospital (for example The Duchy Hospital, part of Circle Health Group), that hospital also keeps its own records about you and is a separate data controller for those records. Its own privacy notice explains how it uses your information.

2. What information we hold about you

• Identity and contact details: name, date of birth, address, telephone number, email address.
• Health information: referral letters, your symptoms and medical history, medication, examination findings, test and endoscopy results, pathology reports, clinic letters and treatment plans.
• Insurance and payment details: your insurer, membership and authorisation numbers, invoices and payment records. We do not store card numbers.
• Correspondence: emails, letters and notes of telephone calls with you or about you.
• Other people involved in your care: your GP and referring clinician, and a next of kin or someone you have asked us to speak to.

Health information is “special category data” under UK data protection law and receives extra protection.

3. Where we get your information

• From you, when you contact us, book an appointment or attend a consultation.
• From your GP or another clinician who refers you to us.
• From your insurer, for example to confirm authorisation for treatment.
• From hospitals, laboratories and other clinicians involved in your care, for example test results and pathology reports.
• From The Duchy Hospital (Circle Health Group), which sends us clinic lists with your contact, insurance and appointment details so that we can register you and book your appointment.

4. Why we use your information and our legal basis

Data protection law requires us to have a lawful basis for each use of your information, and an additional condition when we use health information.

We do not rely on your consent as the main basis for using your health information to care for you. We will ask for your consent separately where the law requires it, for example before sharing your information for a purpose unrelated to your care.

5. Use of technology, including AI-assisted administration

We use secure IT services to run the practice. These include email, a practice management system and an artificial intelligence (AI) assistant that helps our administrative team to: sort incoming emails and draft replies about appointments, invoices and insurance; enter registration and appointment details from hospital clinic lists into our practice management system; and prepare invoices, insurance claims and payment records.

• The AI assistant is Claude, provided by Anthropic. It is used for administrative tasks only and does not make decisions about your care.
• A member of our team supervises the AI and checks its work. Every email reply is checked and sent by a person; every registration and booking is checked against the clinic list; every insurance claim is checked and submitted by a person. The AI does not send messages or submit claims itself, and it does not use any symptoms you write on hospital booking forms.
• Anthropic acts only on our instructions under a data processing agreement and is contractually prohibited from using your information to train its AI models.
• We do not use automated decision-making or profiling that has legal or similarly significant effects on you.

6. Who we share your information with

Organisations involved in your care or payment. These organisations use your information for their own purposes and are responsible for it in their own right:

• Your GP and referring clinician.
• Hospitals where you are seen or treated (for example The Duchy Hospital, Circle Health Group).
• Laboratories and pathology services that analyse samples taken during your care.
• Other clinicians, if we refer you on with your agreement.
• Your medical insurer (for example Bupa, AXA Health or Vitality), if your treatment is insured. We send them the details needed to claim under your policy: your name, date of birth, membership and authorisation numbers, treatment dates, procedure codes and fees, and diagnosis codes where the insurer requires them.
• Regulators, our medical indemnity provider, or courts, where the law requires it.

Service providers who process information on our behalf. These “processors” act only on our instructions, under written contracts that require them to keep your information secure and confidential:

We never sell your information and never use it for marketing.

7. Transfers outside the UK

Some of our IT providers, including Google, Anthropic and Cloudflare, may process information in the United States or other countries outside the UK. When this happens we make sure your information is protected by safeguards approved under UK law. These are the UK International Data Transfer Addendum to the standard contractual clauses or, where the provider is certified, the UK Extension to the EU–US Data Privacy Framework. You can ask us for details of these safeguards.

8. How long we keep your information

We follow the retention periods in the Records Management Code of Practice for health and social care, which we apply to our private records:

We may keep records for longer if they are needed for a complaint, legal claim or regulatory investigation.

9. Your rights

You have the right to:

• Access a copy of the information we hold about you (a “subject access request”).
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete information. We may be unable to do so where the law requires us to keep medical records.
• Ask us to restrict how we use your information in certain circumstances.
• Ask us to transfer information you have given us to another organisation, where the processing is based on a contract with you and carried out by automated means.

Your right to object: where we rely on legitimate interests, you have the right to object to how we use your information. We will stop unless we have compelling legitimate grounds, for example where the information is needed for your safe care or to meet our legal obligations.

To exercise any of these rights, email drylim.secretary@harrogategastroenterologist.com. We will respond within one month. There is normally no charge.

You need to give us accurate information so we can provide safe care. If you do not provide it, we may not be able to treat you.

10. How to complain

Please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner’s Office (ICO):

11. Changes to this notice

We review this notice at least once a year and whenever our services or systems change. The latest version is always on this website.