This privacy policy explains how Quit Smoking Clinic Ladywood ("we", "us", "our") collects, uses, stores and protects your personal information when you use our service or visit our website at www.bhamquitsmoking.co.uk.
We take your privacy seriously. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all related guidance from the Information Commissioner's Office (ICO) and the NHS.
1. Who we are
Quit Smoking Clinic Ladywood is a stop-smoking service based at 212 St Vincent Street West, Ladywood, Birmingham B16 8RP. We operate in partnership with Birmingham City Council as part of its public health stop-smoking offer.
The service is operated by a UK private limited company registered at Companies House:
- Company number: 14984336
- VAT registration number: 461326018
- Registered office: 212 St Vincent Street West, Ladywood, Birmingham B16 8RP
For data protection purposes, we are the data controller for personal data you give us directly. We are registered with the UK Information Commissioner's Office (ICO):
- ICO registration reference: ZB746930
Where you are referred via Birmingham City Council or another NHS partner, both parties may act as joint controllers in respect of certain information.
2. What information we collect
To deliver our service safely and effectively, we collect the following types of information:
Personal details
- Name, date of birth, address, postcode
- Phone number and email address
- NHS number (where provided)
- GP practice details
- Demographic information such as ethnicity and gender (for monitoring and reporting to Birmingham City Council and the NHS)
Health and lifestyle information
- Smoking history (how long you've smoked, how many a day, previous quit attempts)
- Relevant medical conditions and current medication
- Pregnancy status (where relevant)
- Mental health history (only where relevant to your quit plan)
- Carbon monoxide (CO) readings taken during your appointments
- The Nicotine Replacement Therapy products we supply you
- Your fortnightly progress notes
Website information
- Information you submit through our contact form: your name, phone number, email address, preferred way to be contacted (phone, text or email), preferred appointment style (in person, telephone or online video), any message you choose to include, and your consent to us holding and using these details to contact you.
- Basic, anonymised analytics about how visitors use our website (page views, device type, approximate location). We do not use this information to identify individual visitors.
3. How we use your information
We use your information for the following purposes:
- To deliver your quit-smoking programme — booking appointments, building your personalised plan, supplying suitable NRT, monitoring your progress, and keeping you safe.
- To contact you about your appointments, missed sessions, or follow-up.
- To meet our reporting duties — we are required to share anonymised, aggregated data with Birmingham City Council and the NHS to monitor the effectiveness of stop-smoking services. This reporting cannot identify you personally.
- To liaise with your GP or other clinicians — where it's necessary for your safe care (for example, if you're on medication that interacts with your quit-smoking NRT).
- To respond to your enquiries through the website or by phone or email.
- To meet our legal obligations, including safeguarding duties and our records-management requirements.
4. Our legal basis for processing your data
Under UK GDPR, we rely on the following legal bases:
- Public task (Article 6(1)(e)) — the provision of NHS-aligned public health services for Birmingham residents.
- Consent (Article 6(1)(a)) — where you've agreed to us contacting you in a particular way.
- Contract (Article 6(1)(b)) — for delivering the programme you've signed up to.
- Vital interests (Article 6(1)(d)) — in an emergency where your life or someone else's may be at risk.
For special-category health data, we additionally rely on Article 9(2)(h) — provision of health and social care.
5. Who we share your information with
We share your information only where it's necessary, lawful, and proportionate. The main organisations we may share information with are:
- Birmingham City Council Public Health team — for service monitoring and reporting (in anonymised, aggregated form wherever possible).
- Your GP or healthcare team — where it affects your safe care.
- NHS Digital / National Stop-Smoking Services records — for national reporting requirements.
- Our IT and clinical-systems providers — who process data on our behalf under strict data-processing agreements (UK-based wherever possible).
- Regulators, law enforcement or safeguarding bodies — where we are required to do so by law.
We do not sell your data, share it for marketing purposes, or pass it to any third party not involved in your care or our reporting duties.
6. How long we keep your information
We retain your clinical records in line with the NHS Records Management Code of Practice (typically 8 years from your last contact for adult records, or longer in specific circumstances such as records relating to pregnancy or children).
Website enquiry data is held for up to 12 months unless you become a member of our programme, in which case it joins your clinical record.
7. How we protect your information
We use appropriate technical and organisational measures to keep your information safe, including:
- Secure, access-controlled clinical systems
- Encryption of data in transit and at rest
- Staff training in confidentiality and data protection
- Locked physical storage for any paper records
- Multi-factor authentication on systems handling personal data
8. Your rights
Under UK GDPR you have a number of rights regarding your personal information. These include the right to:
- Be informed about how we use your data (which is what this policy is for)
- Access your data — request a copy of what we hold about you
- Rectify inaccurate or incomplete data
- Erase your data in certain circumstances (note: this is limited for clinical records we are required to retain)
- Restrict our processing of your data
- Object to certain types of processing
- Withdraw consent at any time where we are processing on that basis
- Complain to the Information Commissioner's Office
To exercise any of these rights, please contact us using the details below. We will respond within one month.
9. Cookies and analytics
Our website uses a minimal set of cookies necessary for the site to function (for example, remembering your form inputs during a session). We do not use third-party advertising cookies. We may use privacy-preserving analytics to understand how the site is used in aggregate — this does not identify individual visitors.
10. Children's privacy
Our service is for adults aged 12 and over. For under-18s, we will involve a parent, guardian or appropriate adult where clinically appropriate, and follow safeguarding guidance.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top will always reflect the current version. Significant changes will be communicated to members of our service.
12. How to contact us
If you have any questions about this policy, want to exercise your rights, or wish to make a complaint, please contact us:
- By post: Data Protection, Quit Smoking Clinic Ladywood, 212 St Vincent Street West, Ladywood, Birmingham B16 8RP
- By email: ladywoodquitsmokingclinic@gmail.com
- By phone: 07874 911 292
13. Complaints to the regulator
If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
This privacy policy is provided in good faith and represents our current data-handling practices. It is not a substitute for individual legal advice. If you have specific concerns, please get in touch.