Privacy Policy

1. Who We Are

Fairfield Hearing is an independent private audiology practice operating from two clinic locations in Edinburgh, Scotland. We are the data controller responsible for your personal data.

 

Detail	Information
Trading name	Fairfield Hearing
Principal audiologist	Stephen Fairfield BSc (Hons) Clinical Audiology, HCPC HAD00366
West End clinic	2 Stafford Street, Edinburgh, EH3 7AU
Trinity clinic	7 Wardie Avenue, Edinburgh, EH5 2AB
Telephone	0131 378 5800
Email	[email protected]
Regulatory body	Health and Care Professions Council (HCPC)
ICO registration no.	ZB091064

 

2. What Personal Data We Collect

Contact and identity information

• Full name, date of birth, address, telephone number, and email address
• GP details and emergency contact information where provided
• Preferred contact method and communication preferences

Health and audiological information (Special Category data)

• Medical history relevant to your hearing health
• Details of current medications, particularly those with ototoxic risk
• Results of hearing assessments, audiograms, speech discrimination tests, and tympanograms
• Hearing aid prescription data, device settings, and fitting records
• Tinnitus and balance assessment records and management plans
• Referral letters and clinical correspondence with GPs, ENT consultants, and other healthcare providers
• Ear wax removal records and otoscopy findings
• Clinical notes from all appointments

Financial information

• Payment records for hearing aids and private services
• Finance arrangement details where a payment plan is agreed (processed by our third-party finance partner)

Website and technical data

• IP address, browser type, device type, and pages visited (collected via cookies — see our Cookie Policy)
• Form submissions and enquiry content

Data we do not collect

• We do not collect payment card numbers directly — card payments are processed by a PCI-DSS-compliant payment processor
• We do not knowingly collect data from children under 13 without explicit parental consent

 

3. Lawful Basis for Processing

Type of processing	Lawful basis	UK GDPR reference
Providing clinical hearing services	Contract – necessary to perform our services	Article 6(1)(b)
Maintaining clinical records	Legal obligation and legitimate interests	Articles 6(1)(c) and (f)
Marketing communications (where consented)	Consent – you can withdraw at any time	Article 6(1)(a)
Responding to enquiries	Legitimate interests	Article 6(1)(f)
Complying with HCPC professional standards	Legal obligation	Article 6(1)(c)

 

4. Special Category Health Data

Health and audiological information is classified as Special Category personal data under Article 9 of UK GDPR. We process this data under:

• Article 9(2)(h) — processing necessary for the provision of health or social care
• Article 9(2)(b) — processing necessary for employment and social security obligations (applicable to industrial hearing damage assessments)
• Schedule 1, Part 1, DPA 2018, paragraph 2 — health or social care purposes

 

5. How We Use Your Data

• To provide hearing assessments, hearing aid fitting, ear wax removal, and all other clinical services
• To maintain accurate, contemporaneous clinical records in accordance with HCPC standards
• To communicate with you about appointments, results, and follow-up care
• To refer you to other healthcare providers where clinically indicated, with your knowledge
• To send appointment reminders by your preferred contact method
• To send practice newsletters and clinical updates where you have consented
• To comply with our legal and regulatory obligations as an HCPC-registered practice
• To respond to Subject Access Requests and data subject rights requests
• To defend against legal claims where necessary

 

6. Who We Share Your Data With

We do not sell your personal data. We share your data only in the following circumstances:

Recipient	Purpose	Legal basis
Your GP or referring clinician	Clinical referral, reporting, and care coordination	Healthcare provision / legitimate interests
ENT consultants and specialists	Clinical referral where indicated	Healthcare provision
Hearing aid manufacturers	Device registration, warranty claims, remote programming where applicable	Contract performance
IT and software providers	Practice management software, email systems — subject to data processing agreements	Legitimate interests / contract
HCPC and professional regulators	If required for regulatory or fitness to practise purposes	Legal obligation
Solicitors or courts	Defence of legal claims or medico-legal reporting (with your consent)	Legal obligation / legitimate interests
ICO	Data protection regulatory compliance and breach reporting	Legal obligation

 

7. How Long We Keep Your Data

Data category	Retention period	Basis
Adult patient clinical records	8 years from date of last contact	HCPC standards / NHS guidance adopted as best practice / Limitation Act 1980
Children’s clinical records	Until the patient’s 25th birthday, or 8 years from last contact — whichever is longer	NHS / HCPC guidance
Deceased patient records	8 years from date of death	HCPC guidance
Financial records	7 years	HMRC / Companies Act requirements
Marketing consent records	Duration of consent plus 3 years	ICO guidance / limitation periods
Website enquiry records (non-patients)	12 months	Legitimate interests

When data reaches the end of its retention period it is securely deleted or anonymised. Paper records are shredded using a confidential waste service. Digital records are deleted using appropriate secure deletion methods.

 

8. Your Rights

Right	What it means	How to exercise it
Right of access (SAR)	Receive a copy of all personal data we hold about you	Email [email protected] — we respond within one calendar month
Right to rectification	Have inaccurate data corrected	Email or call us
Right to erasure	Request deletion of your data in certain circumstances	Email us — note clinical records must be retained for statutory periods
Right to restrict processing	Ask us to stop using your data in certain ways	Email us
Right to portability	Receive your data in a structured, machine-readable format	Email us
Right to object	Object to processing based on legitimate interests	Email us with the specific processing activity
Right to withdraw consent	Withdraw marketing consent at any time	Email us, use unsubscribe link, or call us

We will not charge a fee for exercising your rights in ordinary circumstances. We will respond within one calendar month.

 

9. Cookies

Our website uses cookies. Full details are in our Cookie Policy.

 

10. How We Protect Your Data

• All digital clinical records are held on secure, UK-based systems with access restricted to authorised staff
• Our website uses HTTPS (TLS encryption) for all data transmission
• Paper records are held in locked, access-controlled environments within our clinics
• Staff who access personal data are bound by professional confidentiality obligations under HCPC standards
• In the event of a personal data breach posing risk to individuals, we will notify the ICO within 72 hours (UK GDPR Article 33)

 

11. International Transfers

Where third-party service providers transfer your data outside the UK or EEA, they are required to ensure adequate protections under UK GDPR Article 46. We seek to use UK or EEA-based providers wherever possible.

 

12. How to Make a Complaint

If you are unhappy with how we have handled your data, contact us first at [email protected]. If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO):

 

13. Changes to This Policy

We review and update this Privacy Policy at least annually and whenever there is a material change in how we process your data, or when required by changes in law or regulatory guidance. Significant changes will be communicated to active patients directly.

14. Contact Us

Last reviewed on 25 April 2026.