Privacy Notice for Bath Pain Management

Last updated: September 2026

1. Introduction

This notice is designed to inform you of the type of information that we collect and hold about you in the course of providing you with private medical care. It will also tell you what we do with the information we collect, how we will look after it and with whom we might share it. It covers information we collect directly from you or which we may receive from other individuals or organisations.

This Privacy Notice also sets out your rights in respect of your personal information, and how to exercise them. You can, for instance, seek access to your medical information, object to particular ways your information may be used and you can request rectification of any information which is inaccurate or the deletion of information which is no longer required (subject to certain exceptions).

This Privacy Notice does not provide exhaustive detail. However, we are happy to provide any additional information or explanation as needed. If you would like further information about any of the matters in this Privacy Notice or have any other questions about how we collect, store or use your personal information, please contact us using the details below.

If you would like this notice in another format, such as Braille, audiotape, large print or another language, please contact us using the contact details on our website and correspondence.

2. Who we are and what we do

In this Privacy Notice the use of "we", "us" or "ours" refers to your treating clinician [Dr Michael Coupe or Dr Paul Watson] and will also include the actions of any Medical Secretary or other staff acting under our instruction including Mrs Delia Foster.

Under the terms of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are known as "Data Controllers" and "Data Processors". This means that we are legally responsible for ensuring that all personal information that we process about you is done in compliance with data protection laws. All Data Controllers must notify the Information Commissioner's Office of all personal information processing activities. Our registration numbers are:

Dr Michael Coupe   ZA348201

Mrs Delia Foster       A8345425

Dr Paul Watson        C2030916

Our entries can be found in the Data Protection Register on the Information Commissioner's Office website.

3. How to contact us regarding data protection issues

If you have any queries or concerns about how we handle your personal information or about the content of this Privacy Notice, please contact us via:

Telephone:  07592 268876

E-mail:  bathpainmanagement@gmail.com

Post:  Bath Pain Management, BMI Bath Clinic, Claverton Down Road, BATH BA2 7BR

4. How we work

We will provide your treatment from Sulis Bath, Peasedown St John and/or BMI Bath Clinic, Bath. Consequently, there may be occasions when it is necessary for those hospitals to also process your personal data (for example, when admitting you to the hospital for treatment or when arranging nursing or additional care and treatment). Your information will only be processed as required by the data protection laws of the UK. Where this does become necessary, those hospitals will become a joint Data Controller in respect of your personal information and they will provide you with a copy of their own Privacy Notice at that point, which sets out how they will manage your personal information.

5. Personal Information we hold about you

When we refer to "personal data" in this policy, this refers to information that can or has the potential to identify you as an individual. When we refer to "processing" your personal information, this covers any use of your personal information, including but not limited to accessing, storing and disseminating information. We may also use "special categories of personal information" about you, which could include information relating to your physical and mental health.

When you request treatment from either Dr Coupe or Dr Watson and become a patient, the personal information we may then need to hold about you may include the following:

• Name

• Contact details, such as postal address, email address and telephone numbers

• Financial information, such as credit card details used to pay us

• Occupation

• NHS Number

• Family details including next of kin

• GP and referral details

• Visual images, for example CCTV images as part of building security

• Responses to surveys or questionnaires

• Correspondence relating to a complaint or claim

• Your specific information requirements

• Audio and transcription data generated during consultations where AI-assisted clinical documentation is used (see Section 9 below)

Special categories of information relating to your medical treatment must be handled even more sensitively than your personal information. The special categories of personal information we may hold and process about you may include the following:

• Details of your current or former physical or mental health. This may include information about any healthcare you have received (both from Dr Coupe or Dr Watson directly and other healthcare providers such as your GP or hospitals (private and/or NHS)) and details of medicines previously and currently taken.

• Details of other services you have received from us

• Details of your lifestyle and social circumstances

• Details of your nationality, race and/or ethnicity

• Details of your religion

• Details of any genetic data or biometric data relating to you

• Data concerning your sex life and/or sexual orientation

6. How we collect your information

There are a number of ways in which we may collect your personal information. It may be collected directly from you when:

• You enter into a contract with Dr Coupe and/or Dr Watson for the provision of healthcare services

• You use those services

• You correspond with Dr Coupe, Dr Watson, Mrs Delia Foster or Bath Pain Management by letter, email, telephone or social media

• You complete enquiry forms on the Bath Pain Management website

• We use an AI-assisted clinical documentation tool during your consultation to capture, transcribe and summarise what is discussed (see Section 9 for full details)

In order to provide you with the best treatment possible, we may need to collect your medical records including information about any diagnosis, clinic and hospital visits and medicines administered. This information may be provided by other individuals and organisations, including:

• GPs

• Hospitals, both NHS and private

• Commissioners of healthcare services

• Other private providers of healthcare (including their medical secretaries)

Information about you may also be provided to Dr Coupe and/or Dr Watson from other sources as relevant to your treatment. These third parties may include:

• Your insurance policy provider

• Your current or former employer

• Your family

• External medical experts

• NHS health service bodies

• Credit reference agencies

• Debt collection agencies

• Government agencies, including the Ministry of Defence, the Home Office and HMRC

7. How we will protect your privacy

We are committed to protecting your privacy and will only process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Human Rights Act 1998 and the common law duty of confidentiality.

All information that we hold about you will be held securely and confidentially. We use clear administrative and technical controls to do this. Both Dr Coupe and Dr Watson, and any staff working for Bath Pain Management, have undertaken appropriate levels of Information Governance training to ensure that we have the correct skills and understanding to look after any information you provide to the highest standards of confidentiality and security. Additionally, all staff at Circle Bath, Sulis Bath and BMI Bath Clinic and any contractors and committee members receive appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures.

We will only ever use the minimum amount of information necessary about you to provide you with treatment and healthcare. Wherever possible, we will use information that does not directly identify you; however, where it is necessary for Dr Coupe or Dr Watson to know or use personal information about you, this will only be done where there is an appropriate legal justification for doing so.

Where our staff or the staff of Sulis Bath and BMI Bath Clinic need to access your clinical record (for example, the Bath Pain Management secretary will need to see your record in the process of typing up correspondence or where medical queries are being followed up) they will only access the necessary information and will follow the strictest rules of confidentiality and data protection.

Dr Coupe and/or Dr Watson will not divulge your record to any other patients or family members, except in the case of children under 12 where applicable, unless you give them permission to do so. You can withdraw this consent at any time but you must let us know immediately if you no longer wish for us to discuss your health with the nominated person.

8. How we will communicate with you

Dr Coupe and/or Dr Watson need to communicate with you in order to provide you with healthcare services. Dr Coupe and/or Dr Watson, or our secretary and/or administrator, may contact you by telephone, SMS, email, and/or post.

In order to provide you with timely updates and reminders in relation to your healthcare, we may communicate with you by telephone, SMS and/or email (where you have provided us with your telephone number and/or email address).

To provide you with your medical information (including test results and other clinical updates) and/or invoicing information, we may communicate with you by email where you have provided your email address and where you have agreed to this form of communication for medical matters.

If you have stated a preference to be communicated with about your healthcare or treatment via a particular method, we will not be relying on your consent to process your data in this way. As set out in Schedule 1 below, the processing of your personal data for these purposes is justified on the basis that it is necessary to fulfil our contract with you for the provision of healthcare services.

9. AI-Assisted Clinical Documentation

Use of Ambient Voice Technology (Heidi Health)

We use an AI-assisted clinical documentation tool called Heidi (provided by Heidi Health Ltd, company no. 15878893, registered in England and Wales) to help create accurate and complete records of your consultations. Heidi is a type of Ambient Voice Technology (AVT): it listens to the conversation during your appointment, produces a transcript, and generates a draft clinical note or letter which your clinician then reviews, edits and approves before it is saved to your clinical record.

What data is processed

During a consultation in which Heidi is used, the following data may be processed:

• Audio captured during the consultation (voice data of clinician and patient)

• A transcript of the consultation generated from that audio

• A draft clinical note, letter or structured summary generated by the AI from the transcript

The finalised clinical note, once reviewed and approved by your clinician, becomes part of your permanent medical record. We use Heidi in a configuration in which audio recordings are not retained: audio is processed solely to generate the draft clinical note and is deleted immediately once that processing is complete. The session record within Heidi (comprising the transcript and draft note) is automatically and permanently deleted after 90 days.

Clinician oversight and accountability

Heidi does not make clinical decisions. All AI-generated draft content is reviewed, edited and approved by your treating clinician before it is incorporated into your clinical record. Clinical responsibility for the accuracy and completeness of your medical record remains with your treating clinician at all times. Heidi is a documentation aid, not a diagnostic or decision-making tool.

Regulatory status

Heidi's consultation transcription and clinical documentation functions are not regulated as medical devices under the UK Medical Devices Regulations 2002. The Medicines and Healthcare products Regulatory Agency (MHRA) has confirmed that AI-enabled ambient voice technologies performing documentation and summarisation functions of this kind do not currently qualify as medical devices. This position is consistent with the MHRA's published guidance on ambient voice technology-enabled products (2026).

Heidi Health as a Data Processor

Heidi Health Ltd acts as a Data Processor on our behalf. This means they only process your personal data on our instructions and in accordance with the UK GDPR. We have a Data Processing Agreement in place with Heidi Health which sets out their obligations to protect your data, maintain appropriate security measures, and not use your data for any purpose other than providing the documentation service to us.

Data hosting and security

Heidi Health Ltd hosts and processes all UK patient data within the United Kingdom. No data processed by Heidi in the course of the clinical documentation service is transferred outside the UK. Heidi holds a range of UK compliance certifications relevant to healthcare data, including DCB0129 (clinical risk management), DTAC (Digital Technology Assessment Criteria), DSPT (Data Security and Protection Toolkit) and Cyber Essentials, and is registered with the Information Commissioner's Office.

Your right to opt out

You have the right to opt out of AI-assisted documentation at any time. If you would prefer that Heidi is not used during your consultation, please inform your clinician before the appointment begins. In that case, clinical notes will be prepared by conventional means and no audio data will be captured or processed by Heidi. Opting out will not affect the quality of care you receive in any way.

Legal basis for processing

The legal basis for processing your personal data (including special category health data) using Heidi is:

• Performance of a contract: the processing is necessary to provide you with healthcare services and to maintain accurate clinical records.

• Legitimate interests: we have a legitimate interest in using efficient and accurate documentation tools to support the quality of your clinical care, and this interest does not override your rights and freedoms given the safeguards described above.

• Substantial public interest (health or social care purposes) under Schedule 1 of the Data Protection Act 2018, for the processing of special category health data in the context of providing medical care.

10. Surveys and Marketing

Currently we do not undertake surveys or marketing. However, if in the future this changes, where you provide us with your mobile number or your email address we may use one or both of these to contact you regarding patient surveys for the purpose of improving our service and monitoring patient outcomes. We will only contact you in this way if you have provided your consent for us to do so. You have a right to decide not to consent to such contact and it will not affect your care should you choose to do so. You will be able to withhold consent from receiving such requests at any time without having to give a reason.

11. With whom we share your information

In certain situations, we may share data about relevant aspects of your healthcare record with other clinicians or with third parties. Specifically, we may disclose your information to the third parties listed below for the purposes described in Schedule 1 of this Privacy Notice. They may include:

• A doctor, nurse or any other healthcare professional involved in your treatment

• Other members of Sulis Bath and/or BMI Bath Clinic staff involved in the delivery of your care, such as receptionists and porters

• Emergency contacts, for example your next of kin or carer

• NHS organisations

• Other private sector healthcare providers

• Your GP

• Another private provider of medical care or treatment to you (including their medical secretaries)

• Third parties who assist in the administration of your healthcare, such as insurance companies

• The Private Healthcare Information Network (see Schedule 1 for more details)

• National and other professional research and audit programmes, as detailed in Schedule 1

• Government bodies, including the Ministry of Defence, the Home Office and HMRC

• Regulators of healthcare such as the Care Quality Commission

• The police and other third parties where reasonably necessary for the prevention or detection of crime

• Our insurers

• Debt collection agencies

• Credit referencing agencies

• Any third party service providers such as IT suppliers, including Heidi Health Ltd acting as a data processor for AI-assisted clinical documentation (see Section 9 above)

• Selected third parties in connection with any sale, transfer or disposal of our business

• Anyone else with whom you ask us to communicate

We may communicate with these third parties in a variety of ways including, but not limited to, email, post, fax and telephone.

In order to help us run an efficient and cost-effective business, we engage certain third party companies to help manage certain business functions (e.g. accountants). We do not share patients' personal data with these third parties.

We will not otherwise share, sell or distribute any of your personal information to any third party without your consent, unless required by law.

12. International data transfers

We may store or process information that we collect about you in countries outside the United Kingdom. Where we make a transfer of your personal information to a country outside the UK, we will take the required steps to ensure that your personal information is protected.

We may transfer your personal data outside of the UK to the following types of third party:

• Data storage and backup providers

Note: Heidi Health Ltd processes all UK patient data within the United Kingdom and does not transfer clinical data outside the UK. If you would like further information regarding the steps we take to safeguard your personal information when it is transferred internationally, please contact us as outlined in Section 3.

13. How long we will keep your personal information

We will only keep your personal information for as long as reasonably necessary to undertake your care and to comply with our legal and regulatory obligations. For data processed via Heidi: audio recordings are not retained and are deleted immediately after the draft clinical note has been generated. The session record within Heidi (transcript and draft note) is automatically and permanently deleted after 90 days. The finalised clinical note, once approved by your clinician and saved to your clinical record, is retained in line with NHS and professional body guidance on medical records retention. If you would like further information regarding the periods for which your personal information will be stored, please contact us as outlined in Section 3.

14. For what purposes we will use your information

We may "process" your information for a number of different purposes. The law requires us to have a legal justification for processing your data. The particular justification will depend on the proposed use of your data. When the information we process is classed as "special category of personal information", we must have a specific additional legal justification in order to process your data.

We will rely on the following legal justifications for processing your personal data:

• Taking steps at your request so that you can enter into a contract with Dr Coupe and/or Dr Watson to receive treatment and/or healthcare services

• For the purposes of providing you with healthcare pursuant to a contract between us

• We have an appropriate business need to process your personal information and such business need does not cause harm to you (under the law this is called a "legitimate interest")

• We have a legal or regulatory obligation to use such personal information

• We need to use your personal information to establish, exercise or defend our legal rights

• You have provided your consent to our use of your personal information

You will find details of the legal justifications for each of our processing activities in Schedule 1 of this Privacy Notice.

15. What rights you have under the law with regard to your personal information

Under data protection law you have certain rights in relation to the personal information that we hold about you. These include the right to know what information we hold about you and how it is used. You may exercise these rights at any time by contacting us as outlined in Section 3.

There will not usually be a charge for handling a request to exercise your rights. If we cannot comply with your request to exercise your rights we will usually tell you why. There are some special rules about how these rights apply to health information as set out in the relevant legislation.

If you make a large number of requests or it is clear that it is not reasonable for us to comply with a request then we do not have to respond or we can charge you for responding.

Your rights include:

The right to access your personal information

You are entitled to a copy of the personal information we hold about you and details about how we use it. Please note that in some cases we may not be able to fully comply with your request, for example if your request involves the personal data of another person and it would not be fair to that person to provide it to you.

The right to restriction of processing

In some circumstances, you can ask us to suspend the use of your personal data. Sometimes we won't be able to comply with your request if it is necessary to keep your information in order to perform tasks which are in the public interest, including public health, or for the purposes of establishing, exercising or defending legal claims.

The right to data portability

You can ask us to transfer your personal information to you or to another individual or organisation. The information must be transferred in an electronic format.

The right to object to processing

You can ask us to stop processing your information where we are relying on legitimate interests as the legal ground for processing.

The right not to be subject to solely automated decisions

You have a right not to be subject to decisions that are made about you by computer alone without any human review. Heidi Health's AI tool generates draft clinical documentation, but all output is reviewed, amended and approved by your treating clinician before it forms part of your clinical record. No automated decision-making that produces a legal or similarly significant effect on you takes place in the course of your care with us.

The right to opt out of AI-assisted documentation

As described in Section 9, you may opt out of Heidi being used during your consultation at any time by informing your clinician before the appointment begins. This is separate from your general data protection rights but equally important to us.

The right to withdraw consent

In some cases we need your consent in order to use your personal information to comply with data protection legislation. Schedule 1 sets out instances where we will rely on your consent for the purpose of processing your personal information. You have the right to withdraw your consent at any time by contacting us as outlined in Section 3.

The right to complain to the Information Commissioner's Office

You can complain to the Information Commissioner's Office if you are unhappy with the way that we have managed any of your rights above, or if you think we have not complied with our legal obligations. More information can be found on the ICO website: https://ico.org.uk/. Making a complaint will not affect any other legal rights or remedies that you have.

16. When this Privacy Notice will be updated

We may update this Privacy Notice from time to time to ensure that it remains accurate. If these changes result from any material difference to the manner in which we process your personal data then we will provide you with an updated copy of the notice. This Privacy Notice was last updated in September 2026 to reflect the introduction of AI-assisted clinical documentation (Heidi Health) and to update references to UK data protection law following the UK's departure from the European Union.

17. How you may make a complaint or enquiry

We aim to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive very seriously. We encourage you to bring concerns to our attention if you think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures. You can contact us regarding any complaints or questions as outlined in Section 3.

​

​​

​

​

​

​

​

​

​

​

​