Privacy Policy
Last updated 30 July 2026
This policy explains what personal information I hold about you, why I hold it, how long I keep it, and what you can do about it. It applies to everyone who contacts the practice, and to everyone who becomes a patient.
Who I am
Dr Ben Ingram is the data controller for the information described here. The practice is a CQC-registered independent practice. I am registered with the Information Commissioner's Office under registration number ZB747907.
You can contact me about anything in this policy by writing to 10 Carnation Crescent, Sittingbourne, Kent, ME10 4RY, by emailing contact@drbeningram.com, or by calling 01795 358853.
What information I collect
If you send an enquiry through this website, I collect your name, email address, phone number, and whatever you choose to tell me in the message. That form is processed by Netlify, which hosts this site.
If you become a patient, I collect and create a clinical record. That includes your medical history, family history, the findings of any examination, test results, correspondence with other clinicians, prescriptions issued, and notes of every consultation. Health information is a special category of personal data and it is treated accordingly.
If you pay the practice, Stripe handles your card details as my payment provider. I never see or store them.
Why I am allowed to hold it
Under UK GDPR I rely on the following lawful bases. For your enquiry, I rely on my legitimate interest in responding to people who contact the practice, and on taking steps at your request before entering a contract. For your clinical care, I rely on the contract between us, and, for the health information itself, on Article 9(2)(h), which permits the processing of health data for the provision of health care by a professional bound by a duty of confidentiality.
Where I am required to keep records by law, or where I need to establish or defend a legal claim, I rely on legal obligation and legitimate interests respectively.
For website analytics and advertising measurement I rely on your consent, given through the banner. That is the only basis I use for it, and if you don't give it, none of it is collected.
Who I share your clinical information with
Your medical record does not leave the practice except where your care needs it or the law requires it. It is never shared for marketing, never sold, and never sent to any advertising or analytics company.
I share it with laboratories, when I send a sample; imaging providers and consultants, when I refer you; pharmacies, when I issue a prescription; Semble, my clinical records system, which stores your record securely on my behalf; my medical defence organisation and legal advisers, if a claim or complaint is made; and your NHS GP, only with your consent, unless there is a serious risk to you or someone else.
Rarely, the law requires disclosure without your consent, for example a court order or a duty to report certain infectious diseases. Where that happens I will tell you, unless doing so would defeat the purpose of the disclosure.
Who I share website information with
This is a separate matter and it involves separate information. If you allow it, Google receives data about how this website is used: which pages were viewed, roughly where in the country the visit came from, and which advert or search brought you here.
Your clinical record is not part of this and never reaches Google. It lives in Semble. The two systems are not connected, and no analytics or advertising code runs anywhere near your record.
Where your information is held
Your clinical record is held within the United Kingdom or the European Economic Area. Where any processor transfers data outside those areas, that transfer is covered by UK adequacy regulations or by the International Data Transfer Addendum.
Website analytics is different. If you allow it, that data goes to Google in the United States, under the UK extension to the EU-US Data Privacy Framework, to which Google is certified. This applies only to website usage data. It does not apply to your clinical record, which stays in the UK or the EEA.
How long I keep it
Clinical records for adults are kept for ten years after your last contact with the practice. Records for children are kept until their twenty-fifth birthday, or their twenty-sixth if they were seventeen at the time of the last entry. Enquiries that do not become patients are deleted after twelve months. Financial records are kept for six years, as tax law requires.
Your rights
You have the right to a copy of the information I hold about you, and I will provide it within one month and without charge in almost every case. You can ask me to correct anything factually wrong, though I cannot remove a clinical opinion that was properly recorded at the time. You can object to processing, ask for it to be restricted, or withdraw consent where consent is the basis I relied on.
The right to erasure is limited where I hold your record for the provision of health care, because I am required to retain it for the periods set out above.
Where I rely on your consent, as I do for website analytics and advertising measurement, you can withdraw it at any time from the Cookie choices link, and withdrawing it is as easy as giving it was.
To exercise any of these rights, write to me at the address above.
Cookies and how the site is measured
Nothing is stored on your device until you choose it. When you first arrive you get a banner with two separate choices, both switched off, and no Google tag loads until you turn one on. If you ignore the banner or close it, nothing is stored and nothing is measured. You can change your mind at any time from the Cookie choices link at the foot of every page, including turning something back off.
One thing is stored whatever you choose. Your answer is kept in your browser's local storage under bi-consent-v2, so the banner doesn't ask again on every page. It holds your two answers and a version number, and nothing else. The version number is there so that an answer given under an older banner is never read as agreement to something you were never asked about.
If you allow measurement of how the site is used, Google Analytics sets two cookies. _ga tells one browser from another and lasts two years. _ga_G-91WEFZTTXG holds the state of your visit to this site and lasts two years.
If you allow measurement of which adverts brought people here, Google sets _gcl_au, which connects an advert click to what happened afterwards and lasts 90 days.
Those three are the only cookies I ask you for, and they are the only ones that record anything about how you use the site. Netlify, which hosts the site, may set one of its own to keep the site working, for example to hold you on one version of a page while I test a change. That kind of cookie carries no advertising data and doesn't follow you to other websites. Nothing here is used to build a profile of you, and none of it is sold. If you find something on this site that isn't on this list, tell me and I'll either explain it or take it out.
Changing your mind
Every page has a Cookie choices link at the foot. It reopens the banner with your current answers showing, and you can change either one, including switching off something you allowed before.
Turning something off stops any further collection from that point. It doesn't reach back and erase what was already collected. None of that carries your name. The cookies themselves expire on the timings above, 90 days for the advertising one and two years for the analytics ones, and Google deletes the records behind them when the retention period set on the account runs out. If you want something gone sooner, write to me and I'll tell you what it takes, because the only thing tying those visits together is a code held in your own browser rather than anything I hold.
If you are unhappy
Tell me first, and I will try to put it right. If you remain unhappy with how I have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. You can complain to the ICO without contacting me first.