Privacy policy
1. Introduction
Surgical Institute Dublin ("SID", "we", "our", or "us") is committed to protecting and respecting your privacy and ensuring that your personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Data Protection Act 2018, and other applicable data protection laws.
This Privacy Notice explains how SID collects, uses, stores, shares, and protects personal data obtained through our healthcare services, website, online forms, patient portals, recruitment activities, and other interactions with us.
This Privacy Notice does not apply to third-party websites, services, or organisations that SID does not own or control.
2. Data controller
Surgical Institute Dublin is the Data Controller responsible for the processing of your personal data.
Contact details:
Surgical Institute Dublin
Embassy House, Herbert Park Lane, Ballsbridge, Dublin, Ireland, D04 H6Y0
Email: dpo@surgicalinstitute.ie
2.1 Joint controllers
For certain healthcare services, Surgical Institute Dublin and the Consultant responsible for your care act as Joint Controllers of your personal data in accordance with Article 26 GDPR.
3. Categories of personal data we collect
Depending on your relationship with SID, we may collect and process the following categories of personal data.
3.1 Personal data
Personal Data means any information relating to an identified or identifiable individual, including:
- Name and title
- Date of birth
- Address
- Telephone number
- Email address
- PPSN (where required)
- Correspondence and communications
- Information contained in application, referral, proposal, or claim forms
3.2 Special category data (health data)
As a healthcare provider, SID processes special category personal data where necessary for the provision of healthcare services.
This may include:
- Medical history
- Physical and mental health information
- Treatment records
- Diagnostic information
- Clinical notes
- Test results
- Appointment information
- Referral information
- Information contained in pre-assessment or screening questionnaires
- Biometric or genetic information where relevant to treatment
In limited circumstances, special category data may also include information relating to:
- Racial or ethnic origin
- Religious beliefs where relevant to care
- Sexual orientation or gender identity where relevant to treatment
3.3 Financial information
Where necessary for billing and payment administration, SID may process:
- Credit card details
- Debit card details
- Bank account details
- Insurance information
- Payment transaction information
To protect your privacy, payment card and financial account details are processed using secure payment systems and tokenisation technologies designed to minimise exposure of financial information.
4. How we collect personal data
We may collect personal data from a variety of sources.
4.1 Directly from you
Information may be collected when you:
- Register as a patient
- Attend consultations
- Complete forms
- Use our website or patient portal
- Contact us by telephone, email, or post
- Participate in surveys or feedback exercises
4.2 From healthcare professionals
We may receive information from:
- General Practitioners (GPs)
- Consultants
- Diagnostic laboratories
- Other healthcare providers involved in your care
where such disclosure is lawful and necessary for the provision of healthcare services.
4.3 Offline collection
Information may also be collected through:
- Telephone conversations
- Face-to-face meetings
- Correspondence
- Administrative interactions
- From a parent or guardian if the individual is under 18 years of age
5. How we use your personal information
Surgical Institute Dublin processes personal data for a variety of purposes depending on the nature of our relationship with you. We process personal data only where a lawful basis exists under Article 6 GDPR and, where applicable, a condition for processing special category data under Article 9 GDPR.
The principal purposes for which we process personal data are:
- To provide, manage, and coordinate healthcare services, including consultations, diagnosis, treatment, referrals, procedures, and follow-up care.
- To maintain accurate patient records and administer healthcare services.
- To communicate with patients regarding appointments, treatment plans, test results, and other healthcare-related matters.
- To process payments, billing arrangements, and insurance claims.
- To administer and improve our healthcare services, systems, and operational processes.
- To conduct audits, quality assurance reviews, risk assessments, and service improvement activities.
- To manage and protect our information systems, networks, website, and business operations.
- To comply with legal, regulatory, professional, and public health obligations.
- To investigate complaints, incidents, and legal claims.
- To provide information regarding our services and, where permitted by law, to send marketing communications in accordance with your preferences.
The table below sets out the principal purposes for which we process personal data and the legal bases we rely upon.
| Purpose of processing | Categories of data | Lawful basis (Article 6 GDPR) | Special category condition (Article 9 GDPR, where applicable) |
|---|---|---|---|
| Provision of healthcare services, diagnosis, treatment, referrals and patient care | Personal Data, Health Data | Article 6(1)(b) – Performance of a contract | Article 9(2)(h) healthcare provision |
| Maintenance of medical records and patient administration | Personal Data, Health Data | Article 6(1)(b) – Performance of a contract | Article 9(2)(h) healthcare provision |
| Appointment management and patient communications | Personal Data, Health Data | Article 6(1)(b) – Performance of a contract | Article 9(2)(h) healthcare provision |
| Submission of insurance claims and billing administration | Personal Data, Health Data, Financial Data | Article 6(1)(b) – Performance of a contract | Article 9(2)(h) healthcare provision |
| Financial management and payment processing | Personal Data, Financial Data | Article 6(1)(b) – Performance of a contract or Article 6(1)(f) Legitimate Interests | Not applicable |
| Quality assurance, clinical audit, service improvement and risk management | Personal Data, Health Data | Article 6(1)(c) – Legal Obligation | Article 9(2)(h) healthcare provision |
| Compliance with legal, regulatory, safeguarding and public health obligations | Personal Data, Health Data | Article 6(1)(c) Legal Obligation | Article 9(2)(g), 9(2)(h), or 9(2)(i) as applicable |
| Marketing communications relating to Surgical Institute Dublin’s services | Personal Data, Contact Details | Article 6(1)(a) Consent (where required) or Article 6(1)(f) Legitimate Interests | Not applicable |
6. Lawful basis for processing
SID processes personal data only where a lawful basis exists under Article 6 GDPR and, where health information is involved, an additional condition under Article 9 GDPR.
The principal legal bases relied upon include:
Article 6 GDPR
- Compliance with legal obligations
- Performance of a contract
- Legitimate interests
- Consent (where required)
Article 9 GDPR
Special category health data is processed primarily under:
- Article 9(2)(h) – provision of health or social care
- Article 9(2)(i) – public interest in the area of public health
- Article 9(2)(f) – establishment, exercise or defence of legal claims
- Explicit consent where required
Further details regarding specific legal bases are available upon request.
7. Purposes for processing personal data
SID processes personal data for the following purposes:
Healthcare services
- Providing healthcare services
- Managing patient care
- Maintaining medical records
- Coordinating referrals and treatment
Communications
- Appointment management
- Clinical communications
- Patient support
- Service updates
Financial administration
- Billing
- Payment processing
- Insurance administration
- Debt recovery where necessary
Business operations
- Quality assurance
- Clinical audits
- Service improvement
- Statistical analysis
- Risk management
Legal and regulatory compliance
- Meeting legal obligations
- Regulatory reporting
- Safeguarding requirements
- Public health obligations
8. Sharing personal data
SID may share personal data with:
Healthcare providers
- General Practitioners
- Consultants
- Laboratories
- Other treating clinicians
Service providers and data processors
- IT service providers
- Electronic health record providers
- Payment processors
- Professional advisers
- Cloud hosting providers
Public authorities
- Regulators
- Government agencies
- Law enforcement bodies
- Public health authorities
where disclosure is required or permitted by law.
All third parties are subject to appropriate contractual and confidentiality obligations.
Data processors and service providers
Surgical Institute Dublin engages carefully selected third-party service providers ("Data Processors") to process personal data on our behalf and under our instructions. These providers assist us in delivering healthcare services, operating our business, maintaining our information systems, processing payments, and meeting our legal and regulatory obligations.
Where we engage Data Processors, we ensure that appropriate Data Processing Agreements are in place in accordance with Article 28 of the GDPR. These agreements require processors to implement appropriate technical and organisational security measures and to process personal data only on our documented instructions.
The categories of Data Processors used by SID include:
| Data processor | Collected data | Reason |
|---|---|---|
| Street Heaver / CompuCare | Identity data: Name, date of birth, patient identifiers, address, email, telephone number. Health data (special category data): e.g. medical records, diagnoses, treatments, medications, and clinical notes. Administrative data: e.g. appointments, referrals, admissions, and discharge information. | To support the delivery and administration of healthcare services, including maintaining patient records, managing appointments and clinical workflows, supporting diagnosis and treatment, facilitating communication between healthcare professionals, processing billing and administrative activities, ensuring continuity of patient care, and protecting personal data through secure system access and audit logging. |
| Diagnexia Lab | Identity data: Name, date of birth, patient identifier or medical record number. Health data (special category data): e.g. laboratory test requests, specimen information, pathology results, and relevant clinical information. Healthcare provider data: e.g. referring clinician or practice details. | To provide diagnostic pathology services, including the receipt and analysis of laboratory samples, generation and delivery of test results, support for patient care, operation and management of laboratory services. |
| Medosync | Personal data: Identity and Contact, Device Data. Special category data: Medical Information, Personally Identifiable Information (Gender, Race, etc.). | Information is required for the completion, submission, tracking and reconciliation of health insurance claims. |
| PXP | Personal data: Identity and Contact, Transaction Data, Payment Data, Communications Data, Marketing Data, Device Data, KYC/AML Data. | All data is collected with consent for the performance of a contract between PXP and the user or to be transferred, processed, maintained and treated lawfully for strict processing purposes. It is PXP's responsibility to keep information confidential and secure. |
| HSE | Personal data: Identity and Contact. Special category data: Medical Information, Health Data, Appointment Scheduling. | When we receive referrals from GPs and send referral responses back to your GP, we process your personal data to facilitate secure clinical communication and coordination of your care between healthcare providers. This enables the timely sharing of relevant medical information to support diagnosis, treatment, and ongoing care management. Secure transmission of these communications is supported by the Health Service Executive HealthLink national messaging service, which acts as a data processor and processes the data solely on our instructions and does not use it for any other purpose. |
| Microsoft | Personal data: Identity and Contact, Account Data, Communications Data, Marketing Data, Device Data, Service Usage Data, Uploaded Content. | Microsoft uses the collected data to improve and secure its products, personalise products based on user preferences, and provide advertising and marketing offers for promotional communications. Microsoft also uses the data to operate their business, which includes analysing performance, meeting legal obligations, developing their workforce, and doing research. Provided data may also be used to train AI learning models. |
| Viatel | Service delivery (connectivity, telecoms, IT services). Network/system management. Technical support. Customer account management. Billing/invoicing. Security monitoring (cybersecurity, threat detection). Legal/regulatory compliance. | Viatel Technology Group may process personal information for the following purposes: to provide and manage telecommunications and IT services (e.g., connectivity, hosting, and secure communications); to maintain, monitor, and support network and system infrastructure; to deliver technical support and respond to service requests or incidents; to manage customer accounts, service agreements, and billing; to ensure system and information security, including preventing, detecting, and investigating cyber threats or unauthorised access; to comply with legal, regulatory, and contractual obligations. |
9. International transfers
Your personal data may occasionally be transferred outside the European Economic Area (EEA) or the United Kingdom, where necessary for the provision of services.
Where such transfers occur, SID will ensure appropriate safeguards are implemented, including:
- Standard Contractual Clauses (SCCs);
- Other safeguards permitted under GDPR.
Information regarding these safeguards is available upon request.
10. Security of personal data
SID implements appropriate technical and organisational measures to protect personal data against:
- Unauthorised access;
- Accidental loss;
- Destruction;
- Alteration;
- Disclosure;
- Misuse.
Security measures include access controls, encryption, secure storage, staff training, monitoring, and information governance controls.
11. Retention of personal data
SID retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including:
- Provision of healthcare services;
- Compliance with legal obligations;
- Protection of patient safety;
- Management of complaints;
- Establishment, exercise, or defence of legal claims.
Retention periods are governed by SID's Data Retention Policy and applicable legal requirements.
Where personal data is no longer required, it will be securely deleted, anonymised, or destroyed.
12. Automated decision-making and profiling
SID does not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significant effects on individuals.
13. Your rights under GDPR
Subject to applicable law, you have the right to:
- Access your personal data;
- Rectify inaccurate data;
- Erase personal data ("Right to be Forgotten");
- Restrict processing;
- Object to processing;
- Data portability;
- Withdraw consent at any time;
- Object to direct marketing;
- Request human review of automated decision-making where applicable.
These rights are not absolute and may be subject to legal exemptions.
14. Exercising your rights
To exercise any of your data protection rights, please contact:
Email: dpo@surgicalinstitute.ie
SID may request proof of identity before processing your request.
Requests will be handled in accordance with GDPR requirements.
Your right to lodge a complaint
SID is committed to addressing privacy concerns promptly, fairly, and transparently.
If you have concerns regarding how your personal data has been processed, you are encouraged to contact SID in the first instance. All complaints will be investigated by an appropriate member of staff, and reasonable efforts will be made to resolve any issue in a timely and efficient manner.
You may also have the right to lodge a complaint with the competent supervisory authority if you believe that the processing of your personal data infringes applicable data protection legislation.
In Ireland, the supervisory authority is:
Data Protection Commission (DPC)
6 Pembroke Row
Dublin 2
D02 X963
Ireland
Telephone: +353 (0)57 868 4800
LoCall: 1800 437 737
Website: www.dataprotection.ie
Email: info@dataprotection.ie
The right to lodge a complaint with the Data Protection Commission does not affect any other administrative or judicial remedy available to you.
Contact us
Your privacy is important to us. If you have any questions, concerns, or complaints regarding this privacy policy, the way we collect and handle your information, please contact:
Email: dpo@surgicalinstitute.ie
Because email communications are not always secure, please do not include bank account information or other sensitive (special categories of personal data) information in your emails to us.
Changes to this privacy notice
SID may update this Privacy Notice from time to time to reflect changes in legal, regulatory, operational, or technological requirements.
Where material changes are made, SID will take reasonable steps to inform affected individuals where appropriate. The "Last Updated" date displayed at the end of this Privacy Notice indicates when it was most recently revised.
Individuals are encouraged to review this Privacy Notice periodically to remain informed about how their personal data is processed and protected.
Last updated: 27 July 2027