Privacy Notice

How we process personal & other sensitive data

Name: The Surgical Consortium
Address: Unit 7, Old Park Farm, Main Road, Ford End, CM3 1LN
Phone Number: +44 (0)20 7664 5126
Email: siro@thesurgicalconsortium.com
Date of Privacy Notice Review: 13th January 2026

The type of personal information we collect

We currently collect and process the following information:

  • Patient NHS Number
  • Patient Hospital Number
  • Patient Name
  • Patient Date of Birth
  • Patient Address
  • Patient Clinical Description
  • Patient Referral Letter
  • Other Patient Health Information
  • Medication / Medical Devices
  • Any conditions affecting the ability to attend an appointment or special requirements (e.g., mobility)
  • Patient Mobile Number
  • Patient Other Contact Number
  • Patient Email Address
  • Patient Feedback
  • Comments on satisfaction of overall care
  • Suggestions for improving our services

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you (or by the parent/guardian if the patient is a child, or caregiver if the adult patient is unable to provide the information themself) for one of the following reasons:

  • To validate that we are dealing with the correct person when contacted to make a clinical appointment.
  • To improve the service.
  • To investigate any potential issues or complaints.


We also receive personal information indirectly from the NHS Trust responsible for your care at the start of a project to manage the closure of a surgical patient backlog.

We use the information that you have given us in order to contact you for clinical appointments relating to your treatment and to proceed along the ascribed treatment pathway.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

  • Your consent. You are able to remove your consent at any time. You can do this by contacting The Surgical Consortium.
  • We have a contractual obligation.
  • We have a legitimate interest.

How we store your personal information

Your information is securely stored in the Amazon Web Services secure cloud in the European Union.
We keep any personal data for 6 months following the completion of a project with the NHS Trust responsible for your care. We will then dispose of your information by archiving it from Amazon Web Services.

Additional information on appointment booking data

  • Secure Storage on Monday.com:
    Data used for appointment booking is securely stored on Monday.com, which complies with ISO27001 and other recognised security standards. All data is encrypted both in transit and at rest using TLS 1.3 (minimum TLS 1.2 supported). Access is restricted through private workspaces and role-based permissions.

  • Data Deletion:
    Once your treatment is completed, all booking-related data stored on Monday.com is permanently deleted in accordance with our data retention policy.

  • Data Processing Agreement:
    TSC has a formal Data Processing Agreement in place with Monday.com to ensure compliance with GDPR and UK Data Protection laws. This agreement governs how Monday.com processes personal data solely on behalf of TSC.

  • Monday.com Trust Centre:
    For more details on Monday.com’s security and compliance measures, please visit their https://monday.com/trustcenter/datasecure.

Your right to opt-out

You have the right to opt out of having your personal data used for appointment booking purposes with TSC. If you wish to exercise this right, please contact us using the details provided at the top of this page.

Your data protection rights

Under data protection law, you have rights including:

  • Your right of access – You have the right to ask us for copies of your personal information.
  • Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
  • Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
  • Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
  • Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
  • Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us using the contact details at the top of this page if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us using the details at the top of this page.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk