Clinical privacy notice

Who we are

Project Sherlock is a trading name of Andrew Lockhart, an HCPC-registered physiotherapist, and it is the controller of your information. The service is provided online and remotely; there are no clinic premises.

Correspondence can be sent to Andrew Lockhart at 7 Bowfell Close, Davenham, Northwich, Cheshire, CW9 8XE.

If you have a question about your information, email [email protected].

What this notice covers

This notice covers the clinical service: your assessment, your consultation, your clinical record, the documents you share with us, and your payment.

The public privacy notice covers the rest: the website, the suitability self-check, an initial enquiry, and the Sherlock Notes list. Read that one for the website; read this one once you are a patient.

Your health information is special

Information about your health is special category data under UK data protection law. It is not used for marketing, not sold, and not used to train any artificial intelligence model.

We rely on two lawful bases. To provide the service you have asked for — that is, to assess whether a second opinion is right for you, to carry out the consultation, and to write your opinion — we rely on Article 6(1)(b), the contract between us. For the clinical reasons behind your care, we rely on Article 9(2)(h), which permits health data to be processed for the purposes of medical diagnosis and care.

We also keep some records because the law requires it: invoice and accounting records for six years after the end of the accounting period, and records of complaints or incidents for six years, or eight years where they relate to clinical care.

Where your clinical record is kept

Your clinical record is kept in Cliniko, the clinical record system we use, and Cliniko is where it is authoritative. Your records are held in the United Kingdom, and Cliniko has signed a data processing agreement with us covering the transfer and the sub-processors it uses.

Reading and writing your record happens through your own account, and through the secure document step below. No clinical information is kept on the public pages of this website.

How you share documents with us

After your booking is confirmed you may be sent a personal, time-limited link to a secure upload page. That link is yours: it is tied to your case, it expires, and it must not be passed to anyone else.

What happens to a file you upload:

• it is scanned on our own equipment, with a free local virus scanner, before anything is sent on;
• if the scan is not clean, the upload stops, nothing is attached to your record, and the file is kept for a short time as evidence;
• if it is clean, it is attached to your record in Cliniko, and the temporary copy is removed straight away;
• any temporary copy that is never attached expires after 30 days whether or not you do anything with it.

We keep a record of each attachment: the case reference, your Cliniko patient identifier, the file name, a cryptographic checksum, and the date. That record is kept for six years as audit evidence, and it is not in your clinical record.

The AI tool used to draft consultation notes

We use Clindoc to turn a recording of a consultation into a written note, which we then review and put into your record as a draft for approval. The recording is not kept by the AI providers, and the notes they generate are not used to train their models.

Clindoc is not used with real patient data until its data processing agreement is held. It has been used only with fictional material while the service is being prepared, and we will not put a real consultation through it until that agreement is in place. When it is, this notice will be updated before it is used.

Payment

Payment is taken on a secure payment page operated by Stripe, our payment provider, and the appointment is arranged in Cliniko. Your card and bank details are handled by Stripe and are never held by Project Sherlock.

What we keep about a payment is the payment reference, the amount and the date. That is the accounting record, kept for six years because tax law requires it. We do not keep your card number, and we could not retrieve it if we wanted to.

The Sherlock Review is a service provider, not goods, and by paying for our service, you ask us to begin providing this straight away rather than after a cooling-off period. If that is not what you want, please do not pay, and nothing is charged to your card/account.

Enquiries, and the Sherlock Notes list

If you email us before you are a patient, that correspondence is kept for 12 months after our last contact. Where an enquiry concerns your health and you then become a patient, the relevant part is transferred into your clinical record and removed from the mailbox within 30 days.

If you have asked to receive occasional Sherlock Notes, your email address is kept on that list until you ask to leave. After you leave, a minimal record is kept so that you are not invited again, and it is deleted after three years. That list is not used for anything else, and it is not a clinical record.

How long we keep things

• Your clinical record — eight years after your last clinical contact, which is the benchmark set by the NHS Records Management Code of Practice.
• Enquiry correspondence — 12 months after last contact, or 30 days after it is transferred into your clinical record.
• The attachment audit record — six years.
• Payments and invoices — six years after the end of the accounting period.
• Complaints and incident records — six years, or eight where they relate to clinical care.
• Monitoring reports — 12 months.
• Uploaded files that are never attached — 30 days.
• The Sherlock Notes suppression record — three years after you leave the list.

Who we share your information with

We do not sell your information and we do not use it for advertising. We share it only with the suppliers who run the services we use, each under a written data processing agreement, and only to the extent needed to do their job:

• Cliniko — the clinical record, your attachments and your appointments.
• Cloudflare — the hosting, the temporary upload storage, the security and the website analytics.
• Stripe — your payment, and the fraud and anti-money-laundering checks it carries out.
• Zoho — the mailbox, and the Sherlock Notes list.
• Clindoc — the consultation note, and not real patient data until its agreement is held.
• OpenAI — the wording of a reply to an enquiry, and not clinical information.

We do not disclose your information to anyone else unless the law requires it, or to establish or defend a legal claim, or where it is in the public interest.

Transfers outside the United Kingdom

Some of our suppliers process information outside the UK. Where they do, they rely on the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses with the UK Addendum, or an adequacy decision. We keep a note of the transfer basis for each supplier in our data protection records.

Your clinical record is held in the UK. Your payment is processed by Stripe in the United States, and your enquiry correspondence and the Sherlock Notes list are processed by Zoho, whose account data centre is still to be confirmed with them. The technical processing that keeps the website running happens on Cloudflare's global network.

Your rights

You have the right to see the information we hold about you, to have it corrected, to have it deleted where we are not required to keep it, to restrict or object to how we use it, to have it given to you in a portable form, and to withdraw consent where you gave it. Write to [email protected] and we will deal with it, normally within a month.

Where we hold your clinical record, you have the right to see it and to have it corrected. You can ask for a copy of your record at any time, and you can ask us to correct anything that is wrong in it.

You can complain to the Information Commissioner's Office at ico.org.uk if you think we have got something wrong. We would rather hear from you first, so please write to us.

If you ask us to delete information, we will do it unless we are required to keep it, and we will tell you if that is the case.

What we ask you not to send

Please do not send clinical detail, reports, images or identification by ordinary email. The secure upload step exists for that, and it is safer: a file sent by email can be forwarded, and it sits in a mailbox rather than in a system built for it.

Please do not send anything through the suitability self-check that you would not want us to see. It runs on your own device and nothing you type into it is sent to us.

Changes, and how to reach us

We will update this notice when something changes, and we will tell you if a change affects you. The date below is when it was last reviewed.

Andrew Lockhart
Project Sherlock
7 Bowfell Close, Davenham, Northwich, Cheshire, CW9 8XE
[email protected]

Last reviewed: 21 October 2026. This notice describes the arrangements confirmed at that date. Some supplier agreements were still outstanding at the time of review, and the sections above say where that applies.