MMS Clinic Privacy Notice
Version 1.1 · Effective date: 25 September 2026 · Next scheduled review: September 2027
Privacy at a glance•
Who we are: MMS Clinic is the trading name of Tokhi Medical Care and Supplies Ltd (company number 12546953). Our clinical services are provided under the CQC registration of 65 Medical Ltd.•
Who is responsible: 65 Medical Ltd is the data controller for your clinical care and clinical records. Tokhi Medical Care and Supplies Ltd is the data controller for website enquiries, bookings, payments and marketing. Section 2 explains this.•
What we collect: your contact details, health information, clinical photographs, appointment and payment records, and limited website data.•
Why: to provide safe healthcare, keep accurate records, run the clinic and meet our legal and professional duties.• Sharing: only where needed, for example with your GP, laboratories, pharmacies and our secure service providers. We never sell your information.•
Your rights: you can ask for a copy of your records, ask us to correct them, object to some uses and complain to the Information Commissioner's Office (ICO).•
Contact: enquiries@mmsclinic.co.uk or 07770 474443.1. About this privacy noticeMMS Clinic respects your privacy and is committed to keeping your personal and medical information safe. This notice explains what information we collect, why we collect it, how we use and protect it, who we share it with, how long we keep it and your rights.It applies when you:• visit the MMS Clinic website, including pages previously published at mmsclinic.co.uk;• submit an online enquiry or free assessment, or upload photographs for clinical assessment;• book or attend an appointment;• have a telephone, video or face-to-face consultation;• receive treatment, prescribing, minor surgery or follow-up care from us; or• contact us by telephone, email, text message, WhatsApp or other supported channels.This notice should be read alongside any specific information given to you when you use a particular service.2. Who is responsible for your informationMMS Clinic provides its CQC-regulated clinical services under the registration of 65 Medical Ltd. Responsibility for your information is divided as follows.OrganisationRoleWhat it covers65 Medical Ltd, company number 15728801 registered office 7 Vincent Court, Weald Road Brentwood CM14 4TLData controllerYour clinical care and clinical records: consultations, assessments, clinical photographs, consent, procedures, prescriptions, test and histology results, referrals, follow-up, clinical governance, incidents and clinical complaintsTokhi Medical Care and Supplies Ltd, trading as MMS Clinic, company number 12546953, registered office 110 Elmsdale Avenue CV6 6EU CoventryDelivers the clinical service on behalf of 65 Medical LtdHandles clinical information on 65 Medical Ltd's behalf, under a written agreement and 65 Medical Ltd's governance arrangementsTokhi Medical Care and Supplies LtdData controllerWebsite enquiries, appointment booking and administration, payments and invoicing, website analytics and advertising, and marketingYou do not need to work out which organisation holds a particular piece of information. For any question, request or concern about your information, contact MMS Clinic first. We will deal with it directly or pass it to 65 Medical Ltd where needed.Neither organisation has appointed a Data Protection Officer, as neither is required to. Our contacts for privacy matters are below.ContactDetailsMMS ClinicCoventry Osteopathic & Sports Injury Clinic, 312A Charter Avenue, Coventry CV4 8DA · 07770 474443 · enquiries@mmsclinic.co.uk65 Medical LtdPaul Lomas, Registered Manager, 7 Vincent Court, Weald Road
Brentwood CM14 4TL Paul.lomas@65studios.co.uk If any of your earlier care from MMS Clinic was provided under another provider's CQC registration, contact us and we will tell you which organisation holds those records.3. Services covered by this notice• Free online photo assessments for lumps, bumps, skin lesions, ingrown toenails and other suitable conditions• Private GP consultations by telephone, video or face to face• Minor surgery and skin-lesion procedures, including ingrown toenail procedures• Joint and soft-tissue steroid injections• Medical weight-management, men's health and hair-loss services• Blood tests, investigations, scans and specialist referrals• Prescribing and prescription-related services• Wound reviews, post-procedure care and clinical follow-upThe Coventry clinic is appointment-only and operates from a clinical room within Coventry Osteopathic & Sports Injury Clinic. That clinic is a separate business. It has no access to MMS Clinic patient records, and we do not share your clinical information with it.4. What information we collectWe collect only what is reasonably necessary to provide safe healthcare, communicate with you and run our service.CategoryExamplesIdentity and contactName, date of birth, sex, address, telephone, email, NHS number where provided, emergency contact or next of kin where appropriateYour NHS GPGP name, practice and contact detailsHealth informationSymptoms, medical history, diagnoses, allergies, current and previous medicines (including anticoagulants), examination findings, treatment plans, prescriptionsClinical photographsPhotographs you send for assessment; photographs taken before, during or after treatment and for wound follow-upProcedure recordsConsent, assessment, operation notes, anaesthetic used, specimen details, sutures and dressings, aftercare advice, complications, follow-upTests and investigationsHistology, blood tests, imaging reports, specialist letters, referral correspondenceWeight managementHeight, weight, BMI, relevant history and measurements needed to assess suitability and safetyAppointments and paymentsAppointment history and type, fees, deposits, refunds, cancellations, invoices, payment statusCommunicationsEmails, text and WhatsApp messages, online forms, photographs you send, notes of telephone calls and our repliesWebsite dataIP address, browser and device details, pages visited, referral source, cookie and similar data (see section 13)[We do not record telephone calls.] Card payments are processed by our payment provider; we do not store your full card number.Health information is special category personal data and has extra legal protection.5. How we collect your informationWe collect information:• directly from you, through online forms, uploaded photographs, consultations, bookings and messages;• from your NHS GP or other healthcare professionals involved in your care;• from hospitals, laboratories, pharmacies and other healthcare organisations;• from our clinical and booking systems and our payment provider; and• automatically through our website, subject to your cookie choices.6. How we use your informationProviding healthcare. To assess your health, make clinical decisions, treat and prescribe where appropriate, arrange investigations, perform procedures and provide follow-up care.Free online photo assessments. A qualified clinician reviews your answers and photographs and advises on the next step. This may be that treatment may be suitable, that a face-to-face assessment is needed, that you should contact your NHS GP, or that you need urgent care. A photo assessment is provisional:• a diagnosis and treatment plan can only be confirmed at a face-to-face assessment;• if you do not respond within 4 weeks of our advice, the photo assessment is no longer valid and a new assessment is needed; and• in the meantime, you should see your own GP urgently if the lesion changes in any way.Where a clinician has given you advice, your submission and our advice form part of your clinical record (see section 18).Keeping clinical records. For continuity of care, patient safety, and legal, professional and regulatory purposes.Communicating with you. About appointments, treatment, prescriptions, results, histology, referrals, follow-up and administration.Communicating with other healthcare professionals. With your GP, hospital, specialist, pharmacy or laboratory where appropriate and lawful.Payments and administration. To take payments, issue invoices, handle refunds and cancellations and keep financial records.Legal, regulatory and safeguarding duties. To meet legal, professional, regulatory, safeguarding and accounting obligations, and to protect anyone at risk of serious harm.Complaints, incidents and claims. To investigate and respond to complaints, clinical incidents, insurance matters, legal claims and regulatory enquiries.Quality and safety. For clinical audit, governance and service improvement, using anonymised or minimised information wherever possible.Website and advertising. To run our website, understand how it is used and measure our advertising, subject to your cookie choices (section 13).7. Our lawful bases for using your informationUK GDPR requires a lawful basis under Article 6 for every use of personal information. Health information also needs a condition under Article 9, together with the Data Protection Act 2018 (DPA 2018) where relevant.PurposeArticle 6 basisArticle 9 condition for health informationAssessing, treating and prescribing, including free photo assessments6(1)(b) contract, or steps you ask us to take before one9(2)(h) health care, with DPA 2018 Schedule 1 paragraph 2Keeping clinical records6(1)(c) legal obligation; 6(1)(b) contract9(2)(h) health careSharing with your GP and other professionals involved in your care6(1)(b) contract; 6(1)(f) legitimate interests9(2)(h) health careSafeguarding6(1)(c) legal obligation; 6(1)(d) vital interests; 6(1)(f) legitimate interestsDPA 2018 Schedule 1 paragraph 18; 9(2)(c) vital interestsPublic health reporting6(1)(c) legal obligation9(2)(i) public healthComplaints, incidents, claims and regulatory enquiries6(1)(c) legal obligation; 6(1)(f) legitimate interests9(2)(f) legal claims; 9(2)(h) health careClinical audit and quality improvement6(1)(f) legitimate interests9(2)(h) health carePayments, invoicing and accounts6(1)(b) contract; 6(1)(c) legal obligationNot applicableAppointment administration and service messages6(1)(b) contract9(2)(h) health care, where health information is involvedUsing identifiable photographs for publicity or teaching6(1)(a) consent9(2)(a) explicit consentMarketing messages6(1)(a) consent, or 6(1)(f) legitimate interests where the law permits (section 12)Not applicableNon-essential cookies, analytics and advertising6(1)(a) consentNot applicableOur legitimate interests are: running a safe and efficient clinic; coordinating your care with other professionals; checking and improving the quality of our care; preventing fraud and misuse of our services; and establishing, exercising or defending legal claims. We only rely on these where they are not overridden by your rights.We do not rely on consent for most uses of health information. Where we must use information to treat you, keep records or meet a legal duty, another lawful basis applies.If you do not provide information. Giving us your medical history, medicines, allergies and contact details is needed to treat you safely. If you do not provide them, we may be unable to assess, treat or prescribe for you. Providing information for optional uses, such as marketing or publicity, is entirely your choice and does not affect your care.8. Confidentiality Healthcare information is confidential. As well as data-protection law, our clinicians are bound by professional confidentiality duties and the common law duty of confidentiality.These are separate from data-protection law. Having a lawful basis to use information for your care does not mean it can be disclosed to anyone. We only disclose confidential information where there is a proper legal, clinical or other recognised justification, and we share the minimum reasonably necessary.9. Clinical photographs
Photographs you send us. A clinician reviews them to assess your condition and advise on the next step. Please avoid including your face, tattoos or other identifying features unless they are clinically relevant. For conditions in an intimate area, do not send us photos, we may ask you to attend in person instead.
Photographs taken during your care. Where clinically appropriate, we take photographs before, during or after treatment. They form part of your clinical record and help with diagnosis, treatment planning, documenting procedures, correlating with histology, and wound follow-up.
Publicity, teaching and marketing. Photographs taken for your care are never used for marketing simply because they were taken. With your separate, explicit, written consent, we may publish suitable before-and-after photographs on our website, social media or in teaching or promotional material. We will explain exactly how an image will be used before you decide.This is optional. Saying no, or withdrawing consent later, will not affect your care. If you withdraw consent, we will stop future use and remove images from channels we control where reasonably possible. We cannot guarantee removal of copies already printed or shared by others.10. Your NHS GP and other healthcare professionalsWe encourage good communication with your GP. With your agreement, we may send your GP or other professionals involved in your care information such as:• consultation summaries and diagnoses;• treatment and procedure details;• prescriptions;• test, investigation and histology results; and• follow-up arrangements.Here "agreement" refers to your consent under the duty of confidentiality. It is not the lawful basis for processing under data-protection law (see section 7).If you do not want us to contact your GP, tell us. We will consider your request and explain any effect on your care. For some treatments and prescriptions, including certain weight-management medicines, it may not be safe to proceed without informing your GP. If so, we will explain this before treatment.
Access to NHS records. Where our systems and approvals allow, a clinician may view relevant NHS information, such as your Summary Care Record, to check your medicines and allergies. We only do this with your permission or another lawful basis.
Sharing without consent. We may share information without your consent where the law requires or permits it. Examples include a serious risk of harm, a safeguarding concern, a court order, a public health requirement, or a request from a regulator or other lawful authority. We will normally tell you, unless doing so would be unlawful or could increase the risk of harm.11. Who may receive your informationWe share information only where there is a proper reason, and only the minimum reasonably necessary.RecipientWhy65 Medical LtdAs data controller for your clinical care: governance, audit, incidents, complaints and regulatory oversightYour NHS GP and other healthcare professionalsContinuity, coordination and safety of your carePathology laboratoriesTo examine tissue removed during procedures; identifying and clinical details go with the specimenBlood-test, imaging and diagnostic providers, and specialistsInvestigations, scans, opinions and referralsPharmaciesTo dispense prescriptionsClinicians working with MMS Clinic, including nurses and assistantsTo provide your care; all are bound by confidentialityTechnology and service providersClinical records, booking (Cliniko), website hosting, secure messaging, payments, email and SMS, IT support and specimen transport. They act on our instructions under written contractsMedical defence organisations, insurers and legal advisersComplaints, claims, incidents and professional obligationsRegulators and public authoritiesWhere legally required or permitted: for example the CQC, GMC, NMC, ICO, UK Health Security Agency, courts and policeWe never sell your personal or medical information.
Artificial intelligence and software tools. We may use software, including AI-assisted tools, to help with administration, drafting correspondence or clinical documentation. We only enter identifiable patient information into tools covered by a written data-protection agreement with appropriate security. These tools do not make decisions about your care; every clinical decision is made by a qualified clinician (see section 19).12. MarketingWe will only send you marketing by email or text if you have agreed to receive it. [If you are an existing patient, we may also send information about similar services we offer, provided you were given the chance to opt out when you gave us your details.]Every marketing message includes a simple way to unsubscribe. You can also opt out at any time by contacting us. Opting out does not affect your care or the messages we need to send about it.We never use your medical record or health information to target advertising at you.13. Website, cookies and online advertisingOur website uses essential cookies that it needs to work. With your consent, we also use:ToolProviderPurposeGoogle AnalyticsGoogle Ireland Ltd and Google LLCUnderstanding how visitors use our websiteGoogle Ads conversion trackingGoogle Ireland Ltd and Google LLCMeasuring whether our adverts lead to enquiries or bookingsThese tools only run if you accept them in our cookie banner. You can change your choice at any time via mmsclinic.co.uk.We take the following steps to protect health information:• the content of our assessment and contact forms, including health details and photographs, is not sent to Google or any other analytics or advertising platform;• we do not build advertising audiences from visits to pages about particular conditions or treatments; and• advertising and analytics providers have no access to your clinical record.14. WhatsApp, email, text and telephoneWe may use telephone, email, text message or WhatsApp for appointments, administration, enquiries and, where appropriate, your care.• WhatsApp encrypts message content end to end. It is run by WhatsApp (part of Meta), which may process account, device and usage information under its own terms.• Ordinary email may be less secure than dedicated clinical systems.•
Clinical information you send us by any channel, such as a photograph or symptoms, may be added to your clinical record. We then delete it from the messaging device once it is safely stored.If you would rather not receive clinical information by a particular method, tell us and we will offer an alternative where reasonably possible.Our channels are not monitored continuously and are not an emergency service. For urgent medical problems, contact NHS 111. In an emergency, call 999.15. Keeping your information secureWe use technical and organisational measures to protect information from unauthorised access, loss, disclosure, alteration or destruction. Depending on the system, these include individual user accounts, access controls, multi-factor authentication, encryption, secure cloud systems, device security, staff confidentiality agreements, information-governance training, and backups.Only people with a legitimate need can access clinical information. No system is completely secure, so we review our arrangements regularly.16. Personal data breachesIf a breach occurs, we assess its nature and risk and act to contain and remedy it. Where a breach must be reported, we notify the ICO without undue delay and, where feasible, within 72 hours. Where a breach is likely to cause a high risk to you, we tell you without undue delay.Where a breach involves clinical records, we work with 65 Medical Ltd as data controller. We keep a record of all breaches and the action taken.17. International transfersSome of our service providers process information outside the UK. For example:• Google (Analytics and Ads) and WhatsApp (Meta) may process data in the United States; and• [other suppliers that process data outside the UK, e.g. booking, records, email or payment systems].We only transfer information where it is protected by a lawful safeguard. These include UK adequacy regulations (such as the UK–US Data Bridge for certified US companies), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard that applies.18. How long we keep your informationWe keep information only as long as necessary, following UK health-record retention guidance, including the Records Management Code of Practice for Health and Social Care.Type of informationNormal retention periodAdult clinical records, including photographs, consent and histology8 years after the last treatmentRecords relating to a cancer diagnosis30 years from diagnosis, or 8 years after death if soonerRecords of patients treated under 18Until the patient's 25th birthday (26th if they were 17 when treatment ended), or 8 years after death if soonerFree photo assessments where a clinician gave adviceAs adult clinical records: 8 years after the adviceFree assessment submissions not reviewed or withdrawn before adviceUp to 12 monthsPayment and accounting records6 years after the end of the relevant financial yearComplaint records10 years after the complaint is closedMarketing preferencesUntil you withdraw consent or ask us to stopWebsite analytics data[e.g. 14 months, as set in Google Analytics]We may keep records longer where there is:• an ongoing complaint, legal claim or insurance matter;• a regulatory, safeguarding or incident investigation; or• another legal or professional requirement.When information is no longer needed, we securely delete, destroy or anonymise it.19. Your data-protection rights•
Access: ask for a copy of the information we hold about you, including your clinical record (section 20).•
Correction: ask us to correct inaccurate or incomplete information. A clinician's professional opinion will not necessarily be changed because you disagree with it, but we can record your view in your notes.• Restriction: in some circumstances, ask us to limit how we use your information.• Objection: object to uses based on legitimate interests, and to direct marketing at any time.•
Deletion: in some circumstances, ask us to delete your information. This right is limited for healthcare records, which we must usually keep.•
Portability: where the law allows, receive certain information in a machine-readable format or have it sent to another organisation.•
Withdrawing consent: where we rely on consent, withdraw it at any time. This does not affect anything done lawfully before.• Automated decisions: we do not make decisions about your diagnosis, prescribing or treatment solely by automated means. A qualified clinician makes every clinical decision.20. Subject access requestsYou can ask for a copy of your information in writing or verbally, by emailing enquiries@mmsclinic.co.uk or calling 07770 474443. We may need to confirm your identity first.We will respond without undue delay and within one month of receiving a valid request. For complex or multiple requests, this can be extended by up to two further months; we will tell you if so, and why. Requests are normally free, though a reasonable fee may apply in limited cases permitted by law.In rare cases, the law allows us to withhold health information if releasing it would be likely to cause serious harm to your or another person's physical or mental health.21. Children and young peopleWe provide care to patients aged 0 and over. Some services, including weight management and certain minor surgical procedures, are only available to adultsWhere we treat a child or young person, we follow healthcare confidentiality, safeguarding and data-protection rules. Depending on their age, maturity and understanding, a young person may control access to their own health information. Where a parent or guardian is involved, we consider their legal authority alongside the young person's confidentiality and best interests.We may share information without parental consent where the law requires or permits, including to protect a child or another person from serious harm.22. SafeguardingIf we identify a safeguarding concern about a child or an adult at risk, we may share relevant information with healthcare, safeguarding or other authorities. We share only what is necessary. Where possible and safe, we will tell you what we are sharing and why.23. NHS national data opt-outThe NHS national data opt-out does not automatically apply to privately funded care from MMS Clinic. If you have concerns about how we use your information, please contact us.24. Complaints about your informationIf you are unhappy with how we have handled your information, please contact MMS Clinic first and we will investigate. Concerns about clinical records may also be escalated to 65 Medical Ltd as data controller, using the contact details in section 2.You also have the right to complain to the Information Commissioner's Office:• website: ico.org.uk/make-a-complaint• telephone: 0303 123 1113• post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF25. Changes to this noticeWe review this notice at least once a year, and sooner if our services, systems, suppliers, the law, or our CQC arrangements change. The latest version is always on the MMS Clinic website. If a change significantly affects existing patients, we will take reasonable steps to tell them.26. Contact details MMS Clinic65 Medical LtdLegal entityTokhi Medical Care and Supplies Ltd, company number 1254695365 Medical Ltd, company number 15728801Registered office110 Elmsdale Avenue , CV6 6EU Coventry7 Vincent Court, Weald Road
Brentwood CM14 4TLClinic addressCoventry Osteopathic & Sports Injury Clinic, 312A Charter Avenue, Coventry CV4 8DA7 Vincent Court, Weald Road
Brentwood CM14 4TLTelephone07770 474443020 7252 3333Emailenquiries@mmsclinic.co.ukPaul.lomas@65studios.co.uk ICO registrationZC255165ZB701447Contact personDr Ayaz TokhiPaul Lomas, Registered ManagerPrivacy notice version 1.1 · Effective date: 25 September 2026 · Next scheduled review: September 2027
