GDPR Compliance

1. Our Commitment to Data Protection

Leinster Acne and Skin Clinic is committed to protecting your personal data and respecting your privacy rights. We comply fully with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the Irish Data Protection Act 2018.

2. Data Controller

Leinster Acne and Skin Clinic is the data controller for the personal data we process. You can contact us at:

3. What Data We Collect

We may collect and process the following categories of personal data:

• Identity Data: Name, date of birth, gender
• Contact Data: Address, email, phone number
• Health Data: Medical history, skin conditions, medications, treatment records (special category data under GDPR)
• Financial Data: Payment and billing information
• Technical Data: IP address, browser information (via website cookies)

4. Legal Basis for Processing

We process your data under the following legal bases:

• Consent: Where you have provided explicit consent for specific purposes
• Contract: To provide medical services as agreed
• Legal Obligation: To comply with medical and legal record-keeping requirements
• Legitimate Interest: For clinic administration and service improvement
• Special Category Data: Health data processed for the provision of healthcare

5. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Correct any inaccurate or incomplete data
• Right to Erasure: Request deletion of your data where there is no lawful reason for continued processing
• Right to Restrict Processing: Limit how we use your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interests
• Rights Regarding Automated Decisions: We do not use automated decision-making or profiling

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Medical records are retained in accordance with Irish Medical Council guidelines and legal requirements, typically for a minimum of 8 years after the last consultation.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. This includes secure storage, access controls, and staff training on data protection.

8. Data Sharing

We will not share your personal data with third parties except:

• With your explicit consent
• When required by law or regulatory obligation
• With healthcare professionals involved in your care (e.g., your GP, with your consent)
• With trusted service providers who process data on our behalf under strict contractual terms

9. Complaints

If you are unhappy with how we handle your data, please contact us first so we can address your concerns. You also have the right to lodge a complaint with the Data Protection Commission (DPC) in Ireland: