Privacy Policy
What we do with the information you give us, and the rights you have over it.
Last updated 27 August 2026
Who we are
This website is operated by Leonie Grace Limited, trading as RV Plastic Surgery, the private practice of Mr Roshan Vijayan, Consultant Plastic Surgeon (GMC number 7020524). For the information described below, Leonie Grace Limited is the data controller — the organisation that decides why and how it is used.
If you have a question about this policy, or want to exercise any of the rights set out further down, write to enquiries@vijayan.co.uk or call 01727 221799.
What this policy covers
This policy is about the information collected through this website — principally the enquiry form and the analytics that measure how the site is used.
It does not cover your medical records. If you are seen or treated, your clinical records are created and held by the hospital where that happens — One Hatfield Hospital, One Stop Healthcare, London Skin Clinic or Lister Hospital — under that hospital’s own privacy notice and its own duties of medical confidentiality. Mr Vijayan is bound by the same duty of confidentiality in his own right, and by the General Medical Council’s guidance on confidentiality.
What we collect
- What you tell us
- When you complete the enquiry form or write to us, we receive your name, email address, telephone number, the location you prefer, and whatever you choose to put in your message. You decide what goes in that message. If you describe a symptom, a diagnosis or a procedure you are considering, that is information about your health, and the law treats it as a special category needing extra care. Please share only what you need to in order to be helped — there is no need to set out your medical history before you have spoken to anyone.
- What your browser tells us
- Pages you viewed, roughly where in the world you are, the type of device and browser you used, and how you arrived at the site. This is collected through Google Analytics, loaded by Google Tag Manager, and only if you accept the cookie banner — refuse it and nothing is collected or sent. It is described in our Cookies Policy.
- Correspondence
- If we exchange emails or speak on the telephone, we keep a record of that so we can pick up the conversation where it left off.
We do not ask for payment details through this website, and this website does not take payments.
Why we use it, and on what legal basis
| What for | Lawful basis |
|---|---|
| Answering your enquiry and arranging a consultation | Steps taken at your request before entering into a contract, and our legitimate interest in running the practice |
| Health information you include in an enquiry | Your explicit consent, given by choosing to send it; or, once you are a patient, the provision of healthcare under Article 9(2)(h) of the UK GDPR |
| Keeping a record of correspondence | Our legitimate interest in continuity of care and in defending legal claims |
| Measuring how the website is used | Your consent, given through the cookie banner and withdrawable at any time from Cookie settings at the foot of any page |
| Meeting legal, regulatory and insurance obligations | Compliance with a legal obligation |
Where we rely on consent, you can withdraw it at any time. That does not affect anything done before you withdrew it.
Who else sees it
We do not sell your information, and we do not share it for anyone else’s marketing. It reaches the following organisations, each of which acts on our instructions:
- LeadConnector (HighLevel) — the enquiry form on this site is theirs, and submissions pass through and are stored in their system before reaching us.
- Google — Google Tag Manager and Google Analytics, for the usage measurement described above.
- Vercel — hosts the website and serves its pages.
- Sanity — stores the site’s own content, such as the articles and procedure pages. It holds nothing about you.
If you go on to be treated, information will be shared with the hospital providing your care, with your GP where that is appropriate, and with your insurer if you are using insurance. We will tell you when that happens.
We will also disclose information where the law requires it, or where there is an overriding duty to protect someone.
Where it goes
Some of the organisations above are based in the United States. Where information is transferred outside the United Kingdom, that transfer is made under the safeguards the law provides for it — the UK Government’s adequacy regulations, or the International Data Transfer Addendum to the European Commission’s standard contractual clauses.
How long we keep it
An enquiry that does not lead to a consultation is kept for up to two years, so that we can recognise you if you come back to us, and is then deleted.
Where you become a patient, records relating to your care are retained for the periods set out in the Department of Health and Social Care’s Records Management Code of Practice — for adults, normally eight years after the conclusion of treatment. Analytics data is retained for the period configured in Google Analytics.
Your rights
Over the information we hold about you, you have the right to:
- ask for a copy of it;
- have it corrected if it is wrong;
- ask us to delete it, where there is no continuing reason for us to hold it;
- ask us to restrict what we do with it while a question about it is resolved;
- object to our using it where we rely on legitimate interests;
- ask for it in a portable form, where we hold it by consent or under a contract and process it by automated means; and
- withdraw consent, where consent is what we rely on.
Write to enquiries@vijayan.co.uk and we will respond within one month. There is no charge. We may ask you to confirm who you are before we release anything, which is a protection for you.
No decision about you is made by automated means, and we do not profile you.
Keeping it safe
Information sent through this site travels over an encrypted connection, and access to it is limited to the people in the practice who need it. No system is perfect, and we cannot guarantee the security of information while it is in transit across the internet, but we take the care the law requires of us and expect the same of the organisations listed above.
Cookies
Set out separately, in our Cookies Policy.
Changes to this policy
If this policy changes, the new version appears here and the date at the top changes with it. Where a change materially affects you, we will say so more prominently.
Complaints
If something has gone wrong, please tell us first — most things are resolved quickly that way. You also have the right to complain to the Information Commissioner’s Office, the UK’s supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.
A complaint about clinical care is handled differently: raise it with us, or with the hospital where you were treated, and we will explain the process that applies.