SkinHealth.Clinic

Privacy

Privacy policy

Last updated 5 November 2026

Who we are

SkinHealth.Clinic is the private dermatology practice of Dr Ting Seng Tang, Consultant Dermatologist (GMC 7020502). For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), Dr Ting Seng Tang is the data controller for information collected through this website and the SkinHealth.Clinic patient app. Contact us about privacy at info@skinhealth.clinic.

This website

This website does not use advertising or tracking cookies and does not ask you to log in. We use privacy-friendly, cookie-free visitor statistics (Cloudflare Web Analytics) that count page views without identifying you. The site is hosted by Cloudflare, which processes basic technical data such as IP addresses to deliver pages securely.

When you contact us or book

  • Email: if you email us, we use your message and contact details to reply and, where relevant, to arrange your care.
  • Online consultations are booked through TidyCal, and face-to-face appointments are booked directly with Spire Nottingham or Nottingham Road Clinic. Each of these organisations handles the information you give them under its own privacy policy.

Mole Check / Rash Review and the patient app

When you use the SkinHealth.Clinic patient app, we collect the information needed to provide your care: your name and contact details, date of birth, medical history and answers to clinical questions, photographs of your skin, and records of your consultation and any prescription or letter. Payments are processed by Stripe; we do not store your card details.

We process this health information to provide medical care (UK GDPR Article 6(1)(b) contract, and Article 9(2)(h) health care). Patient data is stored securely in the United Kingdom (Google Cloud, London region), encrypted in transit and at rest, and is only accessible to the clinicians and staff involved in your care.

We share information only where needed for your care or where the law requires it: for example with your GP (with your consent), a pharmacy dispensing a prescription, or your health insurer if you are using insurance.

How long we keep information

Medical records are kept in line with UK professional guidance on health records retention. Records for adults are typically kept for 8 years after the last contact, and children's records until their 25th birthday (or 26th if they were 17 at the end of treatment), or longer where clinically necessary.

Your rights

You have the right to access the information we hold about you, to ask us to correct it, and in some circumstances to ask us to delete or restrict it, or to object to how we use it. To make a request, email info@skinhealth.clinic. We will respond within one month.

If you are unhappy with how we have handled your information, please contact us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Patient portal

This section explains how we use your information in our online patient portal. It is about the portal only and sits alongside the rest of this privacy policy.

Controller: SkinHealth Clinic, a trading name of Mustard Seed Global Ltd, run by Dr Ting Seng Tang, Consultant Dermatologist. Address: 195 Nottingham Road, Mansfield, Nottinghamshire NG18 4AA. Telephone: 0115 871 2055. ICO registration number: ZA790747. Data protection officer: Dr Ting Seng Tang, kyle@skinhealth.clinic, telephone 0115 871 2055.

What the portal is

The portal is a private website where you can: read letters and other documents we have released to you; send us photos, test results or a message; and see receipts for payments you have made to us.

The portal is only for patients of our private clinics (Spire Nottingham and Nottingham Road Clinic). Letters from NHS clinics, including Queen’s Medical Centre (QMC), are never put on the portal.

What information we use

  • Your name, date of birth and email address (to check it is you and to send you emails).
  • The letters and documents we release to you (these are about your health).
  • Photos, test results and messages you send us through the portal.
  • Payment receipts.
  • A record of when you sign in, what you open, and what we send to you. We keep this to keep the portal safe and to show who did what.
  • We do not put your name or any health details in the emails we send about the portal.

Why we are allowed to use it

  • Providing the portal as part of your private care: this is needed for the agreement between you and the clinic (UK GDPR Article 6(1)(b)).
  • Health information: we use it to provide and manage your health care (Article 9(2)(h) and Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018). It is handled by, or under the responsibility of, a doctor who is bound by a duty of confidentiality.
  • Emails from the portal: we only send these if you agree. See “Emails: only if you opt in” below.

What you can see and when

A letter to you is released to the portal about 24 hours after the doctor publishes it. The doctor can hold a letter back or take it down.

You will not be able to see a letter on the portal 3 months after it was released. It stays safely in your clinical record at the clinic. If you need it again, please ask us.

Emails: only if you opt in

We will only email you about the portal if you have told us you want that, and we have recorded it. Until then we send nothing.

If you opt in, we may send: a sign-in link (it works for 14 days); and a message saying there is a new document, or a reply to your message, waiting for you.

These emails never contain your health information or your name, and the “new document” email does not contain a sign-in link. They link to the portal page, where you can ask for a new sign-in link.

To opt in: ask the clinic. We record who recorded your agreement and when. Your agreement is for the email address you gave us. If your email address changes, we stop sending portal emails until you have agreed again for the new address.

To stop emails: tell the clinic by email or phone at any time. You can also opt out of the portal altogether. We will record this and stop straight away. Stopping does not affect your care.

Who else handles your information

We use these companies to run the portal. They act on our instructions.

Google (Firebase and Google Cloud): hosts the portal, stores the data and runs the programs. Your data is stored in Europe: the database, the portal website and the programs run in London (europe-west2).

Email service (the Firebase Trigger Email extension and its email provider): sends the emails. The part that sends the emails runs in the United States (us-central1), so your email address and the content of the email are processed there. The email content does not include your name or any health details; it contains a link to the portal page, and the sign-in email contains your personal sign-in link. We use approved safeguards for this transfer.

We do not sell your information. We do not use it for advertising.

How long we keep portal information

  • Letters on the portal: a letter is hidden from the portal 3 months after it was released. It is only hidden: the letter itself stays in your clinical record at the clinic and is not deleted.
  • Messages on the portal: a conversation is hidden from you 3 months after its last message. Our system then deletes it, once the clinic has switched that deletion on, unless the doctor saved it to your record because it is part of your care (a conversation saved to your record is hidden from you but not deleted).
  • Portal emails: copies of the portal emails in our email queue are set to expire and be removed 3 months after they are queued.
  • Your clinical record: letters, photos and documents you send us are part of your medical record. We keep these in line with the NHS Records Management Code of Practice: for adults, 8 years after your last treatment; for children, until their 25th birthday (or their 26th birthday if they were 17 at the end of treatment). This is separate from the portal.
  • Sign-in links and sessions: expire automatically (links after 14 days; a signed-in session after 30 minutes of inactivity, and at most 4 hours).

Keeping the portal secure

To sign in you need the emailed link and your date of birth. A date of birth is not secret, so please keep your link private and do not forward it. After several wrong dates of birth the link is paused. If you think someone else has your link, tell us and we will cancel it.

Your rights for the portal

You can ask us to: show you the information we hold about you; correct anything that is wrong; in some cases, delete or limit how we use it (medical records often have to be kept); stop using it for the portal, and stop portal emails (opt out); or move it to someone else in some cases.

To use your rights, email kyle@skinhealth.clinic. We will normally reply within one month.

Please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO): www.ico.org.uk, telephone 0303 123 1113.

Changes

We may update this policy from time to time. The date at the top shows when it was last changed.