Maintaining Privacy and Confidentiality at Lantern Clinic

Privacy Policy

Data Controller Information

Last Updated: 11/09/2026

The data controller responsible for your information is Kitova & John Ltd
ICO Registration Number: ZB392858
Contact: Dr Oommen John
Email: info@lanternclinic.com
Address: Building 41, Newport Road, Cowes, Isle of Wight, PO31 8BX

What Data Do We Hold About Our Patients?

To enable us to provide effective healthcare to you we maintain a secure medical record in ‘Write Up’ (ISO27001:2013 certified). We will hold the following information:

  • Your contact details and details of your NHS healthcare practitioners which you have provided to us.

  • The contents of any important health-related correspondence from you.

  • Test Results (whether provided by you on paper or to us from our partner laboratories).

  • Our assessments and correspondence with you and your other healthcare providers.

Why Do We Hold and Process Your Data?

Your medical record is very important as it is integral to your health care and our ability to offer you medical services. Records must be kept as accurate and up-to-date as possible. Your medical record is held on the computer (except for securely filed paper results awaiting filing to our computer system).

As well as being a chronological record of your health care with us, the computerised records allow us to perform other essential tasks with relative ease. For example, we can use the information to make sure we offer appointments for health reviews at the appropriate time, and for clinical audits, which is a useful tool for continually reviewing and improving the services we provide.

We will use any information submitted to provide you with medical care, administer the provision of appointments and communicate with other health professionals as requested by you.

Lawful Basis for Processing

We process your personal and health data under the following lawful bases in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018:

  • Article 6(1)(e): For the performance of a task carried out in the public interest or in the exercise of official authority (the provision of healthcare).

  • Article 9(2)(h): For the purposes of preventive or occupational medicine, medical diagnosis, and the provision of health or social care.

When Do We Share Your Information?

The practice complies with UK GDPR, the Data Protection Act 2018, and access to medical records legislation. Identifiable information about you will be shared with others in the following circumstances:

  • To request other healthcare and related practitioners to provide further treatment for you.

  • To inform your General Practitioner or other Health Specialist of treatment we have provided to you or of test results while in our care.

  • To help you get other services e.g. from the benefits agency. This requires your consent. When we have a duty to others e.g. in child protection cases.

  • To Care Quality Commission staff upon inspection for them to assess the safety and quality of our services.

Reception and administration staff require access to your medical records to do their jobs. These members of staff are bound by the same rules of confidentiality as the medical staff. Except for the above circumstances, your medical records are not passed on to any third parties.

Separately from your medical records, we use a small number of trusted service providers to run our website, health quizzes, bookings and email communications. These providers process only the information collected through those services — such as your name, email address, quiz answers and result, and your email preferences — never your medical record, and only on our behalf and under our instructions. They are: ScoreApp (health quizzes), Google Workspace (contact records), Apollo and MailerLite (email sending), Squarespace (website), Practice Better (bookings), Zapier (which copies confirmed bookings from Practice Better into our contact records), and Google Analytics and Meta (website analytics and advertising). Some of these providers store data outside the UK; where they do, transfers are protected by safeguards recognised under UK data protection law. Apollo also adds business contact details that pass through its service, such as a name and email address, to its own contact database, which other Apollo customers can use; Apollo's own privacy policy explains how to ask them to remove your details.

Can I See the Information You Hold About Me?

In accordance with the UK General Data Protection Regulation (UK GDPR) and Access to Health Records Act, patients may request to see their medical records. Requests should be made through the Practice Manager.

If you have taken a quiz or signed up to our emails but are not a patient, you can make the same requests by emailing info@lanternclinic.com.

In compliance with UK GDPR, patients have the right to:

  • Access all of their information plus any other content that forms part of the patient record, including notes and expect to be able to read them and understand what they mean without expert medical knowledge.

  • Know if their personal information has been forwarded to a third party (like a fellow healthcare professional, consultant, insurer or school).

  • Have any invalid information we hold about them corrected.

  • Apply to have their personal data deleted.

  • Ask us to refrain from further use (or processing) of their information.

  • Receive their information in an open electronic format.

  • Be notified if critical information about them is inappropriately accessed.

We will respond to all data access requests within one month, in accordance with UK GDPR.

Applications for Data Deletion

For legal purposes, we maintain a record of our contact with patients for 7 years from our last clinic contact (or until the age of 21 years and 3 months in the case of any child in our care). Applications for deletion will be looked at individually and (if there has been minimal or no contact), then the request may be granted at our discretion.

For past patients, who no longer wish to remain on our contacts list and who do not wish their data to be accessed, their data will be stored (for the time specified above), in a secured form away from our patient database. During this time contact details will be removed from our systems and the records will not be accessed for any purpose other than defending a legal claim, should this need arise.

In some cases, medical records may need to be retained longer under regulatory, legal, or insurance obligations.

Website Visitors, Quizzes and Email Sign-Ups

Visitors who take one of the online health quizzes on our website, or who sign up to receive emails from us, are not necessarily patients of the clinic, and the information we hold about them is handled separately from our medical records.

When you complete a quiz we collect your name and email address, your answers and your result, together with a record of when and where you signed up (for example, which quiz or page) and whether you chose to receive emails from us. This information is used to provide you with your result and, where you have ticked the box to say you would like to hear from us, to send you occasional follow-up tips and personal notes from the clinic. We also use it in aggregate to understand how our website and quizzes are being used.

Marketing emails are sent on the basis of your consent, which you may withdraw at any time. As the answers you give in a quiz may include information about your health, those answers are processed on the basis of the explicit consent you give when you submit the quiz to receive your result. Quiz answers remain within the quiz platform and are not added to our contact or marketing records; those records hold only which quiz you took, when you took it and a link to your result, so that we can send it to you.

We retain the details of quiz and email sign-ups for as long as you remain subscribed to hear from us. Contacts who have been inactive for an extended period are reviewed periodically and removed where there is no longer a reason to keep them. Where you unsubscribe, mark one of our emails as spam, or our emails to you cannot be delivered, we keep the minimum record necessary (your email address, what happened and when) to ensure that you are not contacted again. If you ask us to delete your information, we keep only a note of your email address and the date of your request, so that we can show it was carried out.

The rights set out in the section below apply equally to anyone whose information we hold in this way. Requests to access, correct or delete your information, or to withdraw your consent, may be made by email to info@lanternclinic.com and will be applied across our marketing systems as well as any other records we hold.

Contact and Communication

Patients contacting us via the practice email do so at their discretion and provide any such personal details at their own risk. Your personal information is kept private and stored securely until a time it is no longer required or has no use. Every effort has been made to ensure a safe and secure process is available for the email submission of data, but we advise patients that they are responsible for ensuring they transmit their personal details to us in a secure manner.

Please contact us to discuss this before transmitting any sensitive personal data to the clinic.

Should we produce newsletters or wish to promote educational, health-related events and news, you can sign up for this service and can 'opt out' at any time from the emails you may receive from us.

We will only send newsletters or marketing communications where you have provided explicit consent to receive them. You can withdraw this consent at any time by using the unsubscribe link in our emails or by contacting us directly.

Further data protection information can be obtained from theInformation Commissioner's website.

Data Security

All electronic records are stored on encrypted systems with access restricted to authorised clinical and administrative staff only. We take all reasonable technical and organisational measures to safeguard your information.

Cookies and Website Tracking

Our website may use cookies to enhance your browsing experience and to help us understand how visitors use our site. Cookies are small files stored on your device. 

Some cookies are essential for site functionality, while others (such as analytics cookies) help us improve our services. You can adjust your cookie preferences or withdraw consent at any time through your browser settings. For more information, please see our Cookie Policy.