Privacy notice

This notice explains what Thread does with information about you. It covers the website and the practice. It is written to be read, not to be survived — if anything in it is unclear, ask and it will be explained in plain terms.

Who the data controller is

Thread Practice Ltd, trading as Thread, is the data controller for the information described here. Dr Laura Gastaldi MD, MRCGP is the point of contact for all data protection matters and acts as the practice's data protection lead.

Contact: laura@threadpractice.co.uk.

The practice is registering with the Information Commissioner's Office as a data controller. The registration number is published here once issued.

What information is collected

When you use this website

This site sets no advertising cookies, runs no third-party trackers, and does not build a profile of you. Fonts are served from this site's own domain rather than a font provider, so visiting a page does not disclose your visit to anyone else.

The site is hosted on Cloudflare Pages. Cloudflare processes technical request data — IP address, browser type, the page requested, and the time — to serve the page and to protect the site from attack. This is aggregate, security-purpose processing and is not used to identify you.

When you make an enquiry

The enquiry form collects your name, email address, an optional telephone number, your relationship to the patient, what you are looking for, and anything you choose to write in the message field. The form deliberately does not ask for clinical detail, and you are asked not to volunteer it — a web form is not a secure or appropriate place for a medical history.

When you become a patient

From the first consultation, the practice holds a clinical record: your medical history, diagnosis, treatment regimen, medication, test and imaging results, correspondence with your oncologist and NHS GP, consultation notes, care plans, and billing records. This is special category data under UK GDPR — the most strictly protected category — and it is treated accordingly.

Why it is held, and the lawful basis

• To answer your enquiry. Lawful basis: legitimate interests — you contacted the practice and expect a reply.
• To provide medical care. Lawful basis: Article 6(1)(b) — performance of a contract — together with Article 9(2)(h), processing necessary for the provision of health care by a professional bound by the obligation of professional secrecy.
• To meet legal and regulatory obligations. Record-keeping under GMC standards, indemnity requirements, and HMRC obligations. Lawful basis: legal obligation.
• To bill you, or your insurer. Lawful basis: performance of a contract.

The practice does not use your information for marketing, does not sell it, and does not share it with any commercial partner. The Trusted Partners network operates by introduction with your explicit agreement, never by passing your details on unasked.

Who it is shared with

• Your treating clinicians. With your consent, correspondence goes to your oncologist, your treatment centre, and your NHS GP, so that your record stays complete. This is the point of the practice, and consent is asked for explicitly.
• Laboratories and hospitals where tests or procedures are arranged for you.
• Your insurer, where you are claiming, and only to the extent needed for the claim.
• The practice's electronic medical record provider, which is UK-hosted and registered with the ICO, acting as a processor under a written agreement.
• The practice's indemnifier and professional advisers, where a clinical or legal question requires it.

Information is disclosed without your consent only where the law requires it, or where there is a risk of serious harm — the same duties that apply to any UK doctor.

Where it is held

Clinical records are held in a UK-hosted electronic medical record. Email is held on business services within the UK or the European Economic Area. Where any processor operates outside the UK, transfers rely on UK adequacy regulations or the International Data Transfer Addendum.

How long it is kept

• Enquiries that do not become consultations: deleted after twelve months.
• Adult clinical records: retained for a minimum of eight years after the last consultation, in line with UK professional record-keeping guidance. Records relating to a deceased patient are kept for a minimum of eight years after death.
• Financial records: six years, as HMRC requires.

Your rights

Under UK GDPR you have the right to:

• be told what is held about you, and be given a copy — a subject access request, answered within one month and free of charge;
• have inaccurate information corrected;
• have information erased, where no legal or clinical obligation requires it to be kept — clinical records generally must be kept;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw consent at any time, where processing rests on consent.

Write to laura@threadpractice.co.uk to exercise any of these. If you are unhappy with the response, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. The practice would rather you raised it directly first, and will take it seriously.

Changes to this notice

This notice is updated when the practice's processing changes — notably when the electronic medical record is selected and when ICO registration completes. The date at the top of the page shows the current version.