Privacy
Privacy policy
How the practice looks after the personal information you share, and the rights you have over it.
Who is responsible for your information
The practice is run by Meridian Medical Consulting Ltd, trading as The Hertfordshire Endocrine & Metabolic Clinic, registered in England and Wales with company number 17300898. Meridian Medical Consulting Ltd is the data controller for the records the practice creates, and is registered with the Information Commissioner's Office (registration ZC192962). Dr Ioannis Spiliotis (GMC 7044495) is the practice's consultant. You can contact the practice about any privacy question at secretary@hertsendocrinology.co.uk. The hospitals where clinics are held keep their own records and are responsible for those separately.
The information collected
This includes your contact details; the clinical information you provide and that arises from your care, such as your history, examination findings, test results and correspondence; and, where relevant, payment or insurance details. Much of this is health information, which the law treats as special category data.
How your information is used
Your information is used to provide and manage your care: arranging appointments, assessing and treating you, organising investigations, writing to your GP with your consent, billing, and keeping accurate records. Under UK data protection law, the bases for this are providing the care you have asked for (UK GDPR Article 6(1)(b)), meeting legal and professional record-keeping obligations (Article 6(1)(c)), and the provision of health care by a regulated professional under a duty of confidentiality (Article 9(2)(h)). If you send an enquiry, your details are used to reply to it, as a step you have asked for before any appointment (Article 6(1)(b)). No decisions about you are made by automated means alone.
AI transcription of consultations
Dr Spiliotis uses AI transcription software in consultations. It processes the conversation to produce a transcript and a draft letter, which he checks before anything is added to your record. The audio is not stored. You will be told when the software is in use, and you can ask for it not to be used, before or during the consultation, without any effect on your care. Transcripts are held for up to six months and then deleted, unless one is needed to deal with a query, complaint or claim about the consultation, in which case it is kept until the matter has been dealt with. The basis for keeping a transcript for that purpose is the practice's legitimate interest in being able to respond to such matters (UK GDPR Article 6(1)(f)) and the establishment or defence of legal claims (Article 9(2)(f)). You can ask for a copy of your transcript while it is held.
When information is shared
With your agreement, a summary is sent to your GP. Information is also shared, as needed for your care, with the hospital and the laboratory and imaging providers involved; with the pharmacy that dispenses your prescription, which is responsible for its own records; and, where you are claiming, with your insurer. If a query, complaint or claim arises, relevant information may also be shared with the practice's professional advisers, its indemnity insurer or a complaints body. It may be shared where the law requires it, or where there is a serious risk to someone's safety. Your information is not sold, and it is not used for advertising.
Service providers
The practice uses service providers that handle personal information on its behalf: secretarial and billing support; practice management and clinical records software; clinical dictation and AI transcription software; insurance billing services; card payment processing; email; website hosting; and the service that delivers the website enquiry form. A list of the current providers is available on request. Some providers may process information outside the UK; where they do, this is done under the safeguards UK data protection law requires.
How long it is kept
Clinical records are kept for at least 10 years after your last contact with the practice, or longer where professional guidance requires, and then securely destroyed. Consultation transcripts are kept for a shorter period, as described above. Enquiries that do not lead to an appointment are deleted once they are no longer needed.
Your rights
You have the right to ask for a copy of your information and to have inaccurate information corrected. In some circumstances you can also ask for it to be erased, restrict or object to its use, or ask for it to be transferred to you or another organisation. To make a request, contact the practice. If you are unhappy with how your information has been handled, please raise it with the practice first; you can also complain to the Information Commissioner's Office (ico.org.uk).
This website
This website is for information. It is hosted by Lovable, which, like any web host, processes technical information such as your IP address when your browser requests a page. The content of the enquiry form goes directly from your browser to Web3Forms, which delivers it to the practice by email; the web host does not receive it, and no clinical records are held on the website. The site does not use analytics, advertising or tracking cookies. Links to other websites, such as Google Maps for directions or patient organisations, take you to sites covered by their own privacy policies.
Last updated 16 September 2026. Questions about your information? Contact secretary@hertsendocrinology.co.uk.