Privacy Notice

Last updated: August 2026

1. Who we are

TSC Skin ("we", "us") provides consultant-led dermatology, laser and aesthetic care. This notice explains how we handle personal information collected through this website.

Data controller: TSC Skin Limited (company number 16983631), c/o Rus & Co, 1192 Stratford Road, Hall Green, Birmingham, West Midlands B28 8AB.
ICO registration number: ZC211762
Contact for data protection queries: enquiry@tscskin.com

Care is provided by Dr Tanveer Chohan, GMC 7130038.

Where you are seen at one of our clinic locations — Midland Skin (Birmingham), BUPA Health Centre (Solihull) or St Michael's Clinic (Shrewsbury) — that clinic is the data controller for your full patient record held on its systems, and operates its own privacy notice, which you should also read. We are a separate data controller for the information you send us through this website, and for the records we hold in connection with the care Dr Chohan provides to you.

The clinics listed above are registered with the Care Quality Commission for the services provided at their premises.

Please also read the privacy notice of the clinic you attend. Because that clinic is the controller for your patient record, its notice explains how your clinical information is stored, shared and retained there. This notice covers only the information held by TSC Skin.

Midland Skin, Birmingham — midlandskin.co.uk
BUPA Health Centre, Solihull — bupa.co.uk
St Michael's Clinic, Shrewsbury — stmichaelsclinic.co.uk

2. What information we collect

Through the enquiry form on this website we collect:

Your title, first name and last name
The patient's age
Your email address and contact telephone number, and your contact preference
Which clinic location you wish to attend
Your reason for enquiry and any information you choose to write in the message box
How you intend to fund your care, and your insurer where applicable
Whether you have accepted our terms and whether you have opted in to marketing
Where the patient is under 18: whether you are the patient or enquiring on their behalf, and if so your name and relationship to the patient

Information about your skin, hair or nail concern is health data, which UK GDPR treats as a special category requiring additional protection. This includes clinical photographs, which are routinely taken in dermatology to record and monitor a condition and which form part of your medical record.

If you go on to book an appointment, we will also collect the information needed to provide care safely, which normally includes your address and date of birth, your GP's details, details of any referral, your medical history, details of any private medical insurance, and an emergency contact. Some of this — for example information about your ethnicity where it is relevant to diagnosis — is also special category data.

Where we obtain information from

From you, or someone enquiring or acting on your behalf
From your GP, another specialist, or another NHS or private healthcare provider, where you are referred to us or where information is needed for your safe care
From the clinic where your appointment takes place
From your private medical insurer, where you are funding care through insurance

We also collect limited technical information automatically, such as your device type and approximate location, through our hosting provider's standard logs.

3. Why we use it, and our lawful basis

What we do	Lawful basis (Article 6)	Condition for health data (Article 9)
Respond to your enquiry and arrange a consultation	Steps taken at your request prior to entering a contract	Provision of health care and treatment (Art 9(2)(h))
Provide clinical care and keep medical records	Contract; legal obligation	Provision of health care and treatment (Art 9(2)(h))
Bill you or your insurer	Contract; legal obligation	Provision of health care (Art 9(2)(h))
Send you skin care tips, news and offers	Your consent	Not applicable — marketing does not include health data
Website analytics, where you have accepted cookies	Your consent	Not applicable — no health data is used for analytics
Clinical audit and service quality review	Legal obligation; legitimate interests	Management of health care services (Art 9(2)(h))
Meet our legal, regulatory and insurance obligations	Legal obligation; legitimate interests	Provision of health care; establishment of legal claims

You are never required to consent to marketing in order to receive care, and you may withdraw that consent at any time.

4. Children's information

We provide paediatric dermatology, so we may hold information about patients under 18. Where an enquiry concerns a child, we ask who is making it and their relationship to the patient, so that we can be satisfied the enquiry is made appropriately. We handle children's information with particular care and share it only as set out in this notice. Patients under 16 must be accompanied by a person with parental responsibility, who provides consent on their behalf unless the young person is assessed as competent to consent for themselves.

Where an enquiry appears to come from a patient under 13, we do not correspond with the child; we ask that a parent or guardian contacts us directly. We do not send marketing communications to anyone identified as under 18. Our full approach is set out in our consent policy for young patients, which is available on request.

5. How we will communicate with you

We will need to contact you about your care. Depending on what you have told us you prefer, we may do so by telephone, SMS, email or post.

Appointment confirmations and reminders are normally sent by email or SMS
Clinical updates, results and letters are sent by post or secure email, or discussed by telephone where that is more appropriate
Letters to your GP or another clinician are normally sent by post or secure email

We may occasionally ask for feedback on your experience. This is to help us improve the service, is entirely voluntary, and is not marketing. You can opt out of these requests at any time.

If you have asked us not to contact you by a particular method, we will use another — though where clinically urgent information must reach you, we may need to telephone.

6. Who we share it with

The clinic where your appointment takes place, for scheduling, clinical care and their patient record, as described in section 1
Your GP or other clinicians, where clinically appropriate and normally with your knowledge
Other clinicians asked for a second opinion — dermatology colleagues, pathologists, surgeons, or a multidisciplinary team meeting. This may include clinical photographs and relevant parts of your record, shared securely and limited to what is needed for the opinion sought. Everyone involved is bound by the same duty of confidentiality
Your insurer, where you are funding care through insurance
Laboratories and pathology services, where samples are taken
Our service providers, who process data on our instructions only: Formspree (enquiry form handling), Netlify (website hosting), Google (website analytics, where you have consented), and our email and practice management providers
A medical secretary or administrative support, for correspondence, booking and results, under confidentiality obligations
Anyone you ask us to communicate with as your representative
Regulators and statutory bodies, including the Care Quality Commission and the Private Healthcare Information Network, where we are required to do so
Our insurers and legal advisers, where necessary to establish, exercise or defend legal claims

We do not sell your information, and we do not share it with advertisers.

Transfers outside the UK

Some of our service providers are based outside the UK, or store data on servers outside the UK. This applies to:

Netlify, which hosts this website. Netlify's data processing agreement incorporates the European Commission's standard contractual clauses and the UK International Data Transfer Addendum.
Google, which provides website analytics where you have consented. Google may process this data outside the UK under its own standard contractual clauses and UK addendum.
Formspree, which handles submissions from our enquiry form. Formspree processes data on Amazon Web Services infrastructure in the United States, encrypts it in transit and at rest, and relies on standard contractual clauses as a data processor.

Where information is transferred outside the UK, we rely on appropriate safeguards under Article 46 of the UK GDPR — normally the UK International Data Transfer Addendum to the European Commission's standard contractual clauses — so that your information continues to receive a level of protection equivalent to that required in the UK. We review these arrangements when we appoint a provider and periodically thereafter.

Clinical records held on the patient record system of the clinic where you are seen are subject to that clinic's own arrangements, set out in its privacy notice.

7. How long we keep it

Enquiries that do not lead to an appointment are kept for 12 months and then deleted.

Where you become a patient, clinical records held by us are retained in line with the Records Management Code of Practice: 10 years from the date of the last entry for adults, and for patients seen as children, until their 25th birthday (or their 26th, where the last entry was made when they were 17). Records relating to the clinic's own patient record are retained by that clinic under its own policy.

Marketing consent records are kept for as long as you remain subscribed, plus a short period afterwards to evidence your preference.

8. How we protect it

Enquiries are transmitted over an encrypted connection (TLS) and are stored encrypted at rest by our form provider, which holds SOC 2 Type 2 certification. They are accessible only to those who need them in order to respond to you. Clinical records are held on secure, access-controlled systems with audit trails.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and will tell you directly where the risk to you is high.

9. Your rights

Under UK GDPR you have the right to:

Ask for a copy of the information we hold about you
Ask us to correct anything that is inaccurate
Ask us to delete information, where we are not required to keep it
Ask us to restrict or object to how we use it
Withdraw consent to marketing at any time, using the unsubscribe link in any email or by contacting us
Ask for your information in a portable format

To exercise any of these, email enquiry@tscskin.com. We will respond within one month.

If you are unhappy with how we have handled your information you may complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

10. Cookies

A cookie is a small file placed on your device by a website. We use them only to understand how visitors use our site, so that we can improve it.

Analytics cookies

We use Google Analytics to see how many people visit the site, which pages they read and how they found us. This tells us, for example, which treatment information is most useful. The reports we see are aggregated and we do not use analytics to identify individual visitors. IP addresses are anonymised.

These cookies are set only if you accept them. When you first visit, a banner asks whether you consent. Until you accept, analytics cookies are not set — this is enforced using Google Consent Mode. If you decline, the site works exactly as it otherwise would.

Changing your mind

You can withdraw or change your choice at any time by clearing your browser's cookies and site data for this website, after which the banner will appear again. You can also block or delete cookies through your browser settings.

Other cookies

Patient reviews are displayed using a widget provided by Doctify, which may set its own cookies; please see Doctify's privacy notice for details. We do not use advertising or cross-site tracking cookies.

11. If our business changes hands

If TSC Skin Limited is sold, merged or reorganised, your information may transfer to the new owner. It would remain subject to this notice and to the preferences you have given us, and we would tell you if the change affected how your information is used.

12. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last revised.

← Back to TSC Skin