Last updated: 14 October 2026
This policy explains how we collect, use and protect your personal information when you use bunionsurgeon.co.uk, contact us or book a consultation with Mr Kaser Nazir. We are committed to keeping your information safe and to handling it in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Bunion Surgeon is the bunion surgery practice of Mr Kaser Nazir, Consultant Podiatric Surgeon, provided by The London Foot And Ankle Surgery Limited, 17 Harley Street, London W1G 9QH. We are the data controller for the personal information described in this policy. Mr Kaser Nazir is our Information Governance Lead.
For any question about your data, or to use any of your rights, email contact@bunionsurgeon.co.uk, call 020 7459 4326 or write to us at the address above.
The information we collect
- Enquiry forms: your name, email address, phone number and anything you choose to tell us in your message, which may include details about your feet or health.
- Online chat: the messages you type into the chat window and any contact details you choose to share.
- Phone and email: the details you give us when you call or email.
- Online booking: appointments are booked through Carebit, our patient booking and records system. Carebit collects the details needed to book and manage your appointment.
- Website use: with your permission, cookies and similar technologies record how you use the site, such as the pages you visit and the device and browser you use. See “Cookies” below.
- As a patient: if you become a patient, we keep clinical records, including your medical history, X-rays, treatment notes and correspondence with your GP, insurer or hospital.
Please do not send us detailed medical information through the website unless you are happy for us to use it to respond to your enquiry. You can always share it at your consultation instead.
How we use your information
- To reply to your enquiry and give you the information you asked for.
- To arrange, provide and follow up your consultation, treatment and aftercare.
- To communicate with your GP, insurer, hospital and other professionals involved in your care, where needed.
- To manage payments, insurance claims and our accounts.
- To understand how our website is used and improve it, and to measure our advertising, only with your consent.
- To meet our legal and regulatory duties.
We do not sell your information, and we do not use it for marketing emails unless you have asked us to.
Our legal basis
- Your enquiry and booking: taking steps at your request before providing care, and our legitimate interest in responding to people who contact us.
- Your care: providing health care (UK GDPR Article 6(1)(b) and Article 9(2)(h)).
- Health details you send us before you become a patient: your explicit consent, which you give by choosing to send them (Article 9(2)(a)). You can withdraw it at any time by contacting us.
- Analytics and advertising cookies: your consent, given through our cookie banner.
- Records we must keep: compliance with our legal obligations.
Who we share it with
We share only what is needed, and only with:
- Health professionals and hospitals involved in your care, including The Weymouth Street Hospital, and your GP where appropriate.
- Your private medical insurer, if you are using insurance.
- Service providers who process data for us under contract and only on our instructions: Carebit (booking and patient records), our website host, our email provider, Pikul Agency (website and online chat), and Google, Meta and CookieYes for the website services described under “Cookies”.
- Regulators, courts or authorities, where the law requires it.
Some of these providers may store data outside the UK. Where they do, we make sure your information is protected by an adequacy decision or the UK International Data Transfer Agreement or Addendum.
Cookies
When you first visit, our cookie banner (provided by CookieYes) lets you accept or reject non-essential cookies. Strictly necessary cookies keep the site working and secure. With your consent, we use Google Analytics to understand how the site is used, and Google Ads and Meta to measure our advertising. Google reCAPTCHA protects our forms from spam. Embedded YouTube videos and Google Maps may set their own cookies when you play or use them. You can change your choice at any time using the cookie icon at the bottom of each page.
How long we keep it
- Enquiries that do not lead to an appointment: up to 2 years, then deleted.
- Patient records: at least 8 years after your last appointment, in line with health records guidance.
- Financial records: 6 years, as required by tax law.
How we keep it safe
Our website uses an encrypted connection (HTTPS). Access to personal information is limited to the people who need it, and our service providers are bound by contracts to keep it secure and confidential.
Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct anything that is wrong;
- ask us to delete your information, where we are not required to keep it;
- ask us to restrict or stop using your information, or object to how we use it;
- ask for your information to be passed to another provider;
- withdraw your consent at any time, where we rely on it.
To use any of these rights, contact us using the details above. We will reply within one month and there is normally no charge.
Complaints
If you are unhappy with how we have handled your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.