How we use and protect your personal information
This Privacy Policy explains how Professor Richard Keen collects, uses, stores and protects personal information when you use this website, contact the office or arrange a private consultation.
Last updated: June 2026. This page should be reviewed regularly and updated if the practice, website tools, contact processes or data handling arrangements change.
Who is responsible for your information?
This website is operated for the private practice of Professor Richard Keen, Consultant Rheumatologist specialising in osteoporosis, metabolic bone disease, bone fragility and rare bone conditions.
For the purposes of this Privacy Policy, “we”, “us” and “our” refer to Professor Richard Keen and those involved in administering the private practice and website on his behalf.
Information we may collect
We may collect and use personal information when you visit the website, submit an enquiry, contact the office, arrange an appointment or provide information in relation to your care.
- Your name and contact details, including email address, telephone number and address where provided.
- Information submitted through website forms, email correspondence or telephone enquiries.
- Appointment administration details, such as preferred clinic location, appointment dates and correspondence history.
- Relevant medical information provided by you, your GP, another clinician, insurer or hospital where applicable.
- Information about scans, tests, medication, symptoms, fracture history or previous treatment where relevant to your enquiry or care.
- Basic website usage information, such as pages visited, browser type, device information and cookie preferences.
Please do not send urgent medical information through the website. If you need urgent medical help, contact NHS 111, your GP, your treating hospital or emergency services as appropriate.
Why we use personal information
We use personal information only where there is a lawful reason to do so and where it is relevant to your enquiry, appointment, care, administration or the safe operation of the website.
| Purpose | Examples |
|---|---|
| Responding to enquiries | Replying to contact form submissions, emails or telephone messages. |
| Managing appointments | Arranging consultations, confirming clinic locations and communicating appointment details. |
| Clinical administration | Reviewing information needed for appointment preparation, correspondence and care planning. |
| Legal and regulatory obligations | Maintaining appropriate records, responding to complaints or meeting professional obligations. |
| Website operation | Keeping the website secure, improving usability and managing cookie preferences. |
Lawful basis for using your information
Under UK data protection law, we must have a lawful basis for using personal information. The lawful basis may depend on the reason the information is being used.
- Consent: where you choose to contact us, submit information or agree to certain optional website cookies.
- Contract: where information is needed to arrange or provide private consultation services.
- Legal obligation: where information must be kept or shared to comply with legal, regulatory or professional obligations.
- Legitimate interests: where information is used to manage enquiries, run the website, protect security or administer the practice, provided your rights are respected.
- Vital interests: in rare situations where information may need to be used to protect someone’s life or safety.
Special category data and medical information
Health information is classed as special category data under UK data protection law. This means it receives additional protection. We may process health information where it is necessary for medical assessment, clinical care, appointment preparation, professional record keeping or related healthcare administration.
This may include information about symptoms, medical history, scans, test results, medication, fractures, previous treatment, referrals or correspondence from other healthcare professionals.
Medical information is handled confidentially and is only used or shared where necessary for your care, administration, legal obligations or another lawful healthcare purpose.
Who we may share information with
We do not sell your personal information. We may share information only where necessary and appropriate, including with:
- Professor Keen and authorised administrative staff supporting the private practice.
- Hospitals, clinics or healthcare providers involved in your appointment or care.
- Your GP, referring clinician or other healthcare professionals where clinically appropriate.
- Private medical insurers where you ask us to liaise with them or where required for administration.
- Professional advisers, regulators, defence organisations or legal advisers where necessary.
- Website, email, hosting, IT, form processing or security providers who support the operation of the website and practice systems.
- Authorities or organisations where disclosure is required by law, regulation, court order or to protect safety.
Where third party service providers process personal information on our behalf, they are expected to handle it securely and only for the agreed purpose.
International transfers
Some website, email, analytics, hosting or IT providers may process or store information outside the UK. Where this happens, appropriate safeguards should be used so that personal information is protected in line with applicable data protection law.
If the website uses tools such as Google services, analytics tools, security tools or embedded maps, those providers may process technical data in accordance with their own privacy policies and terms.
How long we keep information
We keep personal information only for as long as necessary for the purpose it was collected, including for clinical, administrative, legal, regulatory, accounting or professional record keeping reasons.
| Type of information | Typical retention approach |
|---|---|
| Website enquiries | Kept for as long as needed to respond and manage the enquiry, then deleted or retained if it becomes part of an appointment record. |
| Appointment and clinical records | Kept in line with professional, legal, clinical and insurer requirements. |
| Financial or administrative records | Kept for as long as required for accounting, tax, legal or practice administration purposes. |
| Cookie and website preference data | Kept in line with the website’s cookie settings and relevant provider retention periods. |
How we protect information
We take reasonable steps to protect personal information from unauthorised access, loss, misuse, alteration or disclosure. This may include secure website hosting, access controls, secure email practices, password protection, software updates and appropriate administrative safeguards.
No website or email system can be guaranteed to be completely secure. Please avoid sending highly sensitive or urgent medical information through website forms unless specifically requested.
Your data protection rights
Depending on the circumstances, you may have rights under UK data protection law, including:
- The right to be informed about how your personal information is used.
- The right of access to your personal information.
- The right to ask for inaccurate information to be corrected.
- The right to ask for information to be erased in certain circumstances.
- The right to restrict processing in certain circumstances.
- The right to object to certain uses of your information.
- The right to data portability in certain circumstances.
- The right to withdraw consent where consent is the lawful basis for processing.
These rights are not absolute and may be subject to legal, clinical, regulatory or professional record keeping obligations.
Cookies and website technologies
This website may use cookies and similar technologies to make the site work, improve security, understand website usage and support embedded services such as maps or analytics. Some cookies are essential, while others may require consent.
More detailed information is provided in the Cookie Policy.
Complaints about how your information is used
If you have concerns about how your personal information has been handled, please contact the office first so the concern can be reviewed.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection matters.
Information Commissioner’s Office: ico.org.uk
Contact us about this Privacy Policy
To ask a question about this Privacy Policy, request access to your personal information or raise a privacy concern, please contact the office.
Contact the office if you have a privacy or data protection question
If you have a question about how your information is used, or you would like to exercise your data protection rights, please contact the office.
Contact details
For privacy queries, appointment administration or general enquiries, please contact the office.