Ms Jajini Susan Varghese is committed to protecting the privacy of patients and website visitors. This policy explains what personal data we collect when you interact with us — including when you browse this Website, enquire about treatment, view the Gallery, or become a patient — and how we use, protect, and share it.
Our promises
- Care first: We only use your sensitive personal data to provide safe, informed treatment.
- No marketing with medical data: Your health information, including clinical photographs, is never used for marketing without your specific, separate consent.
- Your choice: We only contact you about things you’ve asked us about, and you can change your mind at any time.
Who we are
This Website and the practice of Ms Jajini Susan Varghese, Consultant Oncoplastic Breast Surgeon, operate from:
The London Breast Institute
HCA Women’s Health Centre, 27–29 Harley Street, London W1G 9QP
Tel: +44 (0)20 7034 5175 · Email: msvarghesespa@hcahealthcare.co.uk
Ms Varghese also treats patients at:
Royal Free Hospital Private Patients Unit, Pond Street, London NW3 2QG — Tel: +44 (0)20 7317 7751
Hadley Wood Hospital, 52 Moxon Street, Barnet EN5 5TS — Tel: +44 (0)20 4502 7125
For data protection purposes, Ms Jajini Susan Varghese is the data controller for enquiries made through this Website and for your clinical care under her direction. Where you are treated at HCA Healthcare UK (London Breast Institute), Royal Free London NHS Foundation Trust, or Hadley Wood Hospital, that organisation is an independent or joint controller for the parts of your record it holds, and its own privacy notice applies alongside this one.
If you have questions about this policy or how your data is handled, contact:
📧 info@jajini.com ·
Your personal and sensitive personal data
Personal Data: information that identifies you or could be used to identify you — name, email, phone number, and similar identifiers.
Sensitive Personal Data (Special Category Data): more sensitive information such as medical records, clinical photographs, genetic information, and health status. We only use this data to provide your care and ensure your safety. We will usually ask for your explicit consent to collect or use it, except where the law permits or requires us to process it without consent (for example, in a medical emergency). We never use your sensitive personal data, including clinical photographs, for marketing without separate, explicit consent given specifically for that purpose.
The legal bases we rely on
- Consent — for example, agreeing to receive updates by email, or consenting to a clinical photograph being published on this Website.
- Contractual necessity — for example, using your contact and payment details to arrange and confirm a consultation.
- Legal obligation — for example, retaining medical records for the period required by law, or verifying ID/age where required.
- Legitimate interests — for example, contacting you about an enquiry you’ve made, or using anonymised, aggregated data to understand which pages and procedures visitors are most interested in.
- Vital interests / provision of healthcare (Article 9(2)(h)) — processing health data as necessary to provide clinical care.
When we collect your data
- When you browse this Website
- When you submit the Contact / “Schedule a Consult” form
- When you call, email, or message the practice
- When you attend a consultation or receive treatment
- When you engage with our social media (Instagram, Facebook, LinkedIn, X)
- When you leave a review on a third-party platform (Google, Doctify, Top Doctors, myhealthspecialist) that we may reference or link to
- When you claim treatment through a medical insurer
What personal data we collect
- Enquiry data: name, email address, phone number, and message content submitted via the Contact/Consult form, including which procedure or condition page prompted your enquiry, where relevant
- Clinical data: medical history, diagnosis, treatment records, referral letters, imaging/scan results
- Clinical photographs: taken as part of your medical record; separately, and only with your specific written consent, used in the Gallery, on Procedures pages, in print, or in media features
- Insurance data: provider and policy details, where treatment is funded privately through an insurer (we work with Aetna, Allianz Care, Aviva, Bupa, The Exeter, WPA, Vitality, Cigna, AXA PPP, and Healix, among others)
- Technical data: IP address, browser/device type, and pages visited, via cookies and analytics
- Age confirmation: this Website presents a site-wide 18+ confirmation step at header level before any page loads, given that Procedures pages and the Gallery contain genuine clinical images. We do not store your name or identity from this step — only that confirmation was given, via a session-based cookie (see Cookies, below)
How and why we use your personal data
- To respond to your enquiry and arrange or manage a consultation
- To provide you with information about your condition and treatment options, so you can make an informed decision
- To deliver your clinical care, including liaising with hospitals, referring clinicians, and your insurer where relevant
- To maintain accurate clinical records, including photographs taken for treatment and monitoring purposes
- With your specific, separate consent, to use clinical photographs in the Gallery, on Procedures pages, in print, or in press/media features
- To send you updates or information you’ve asked to receive
- To understand how visitors use the Website, so we can improve it
- To comply with our legal and professional obligations (GMC, CQC, and applicable record-keeping law)
Clinical photography — tiered consent
Consent to surgery is separate from consent to be photographed, which is separate again from consent to have those photographs published. We use a tiered consent model:
- Level 1 — Clinical record only: Standard for every patient; used solely for your diagnosis, treatment planning, and monitoring.
- Level 2 — Teaching and research: Anonymised or pseudonymised use in surgical training or academic research (including Ms Varghese’s research at UCL), within professional settings only.
- Level 3 — Publication: Use on this Website (Gallery and/or Procedures pages), in print, or in media features. This requires a separate, specific, signed consent form — distinct from your surgical consent — setting out exactly where the image may appear, whether you’re identifiable, how long it may be used, and how to withdraw consent.
Treatment is never conditional on agreeing to Level 3 use. Withdrawing consent stops future use but cannot retract copies already downloaded, screenshotted, printed, or shared elsewhere before withdrawal.
We hold signed, dated records confirming that published before-and-after images are genuine and unaltered (other than routine cropping or background removal), and every such image carries a clear statement that individual results vary, consistent with ASA/CAP Code requirements.
Protecting our clinical images from unauthorised use
The clinical photographs, before-and-after images, and other original content published on this Website — including those in the Gallery and on Procedures pages — are protected by copyright and are published only with the specific, informed consent of the patients shown.
You must not:
- Copy, download, screenshot, scrape, or reproduce any patient photograph from this Website for use elsewhere, including on other websites, social media, forums, marketing material, or apps
- Use any image from this Website to represent it as the work, patient, or result of another practitioner or clinic
- Remove, crop, or alter any image in a way that misrepresents the patient, the procedure, or the outcome shown
- Use automated tools (scraping, crawling, or bulk-downloading software) to extract images or content from this Website
Unauthorised use of these images is a breach of both copyright law and the trust our patients place in us when consenting to Level 3 publication. It may also constitute misuse of another person’s likeness and personal data. We actively monitor for unauthorised reproduction of our clinical images and reserve the right to pursue copyright infringement claims, request takedowns under the relevant hosting platform’s policies, and pursue other legal remedies against any individual or organisation found copying or redistributing this content without permission.
If you believe an image from this Website has been copied, stolen, or is being used elsewhere without authorisation, please report it to us at msvarghesespa@hcahealthcare.co.uk.
How we protect your data
We use appropriate technical and organisational measures — including encrypted storage and restricted access — to protect your data from unauthorised access, loss, or misuse. Sensitive personal data, including clinical photographs, is subject to additional access restrictions and is never used for marketing without your specific consent.
How long we keep your data
- Clinical records: a minimum of 8 years from the end of treatment for adult patients, in line with NHS Records Management Code of Practice benchmarks (longer for certain records, e.g. those relating to minors)
- Contact form enquiries that don’t lead to a booking: retained for up to 12 months, then deleted
- Level 3 (published) clinical photographs: retained until consent is withdrawn or the purpose for which they were published ends
- Analytics data: retained per the relevant tool’s default settings
Cookies & similar technologies
This Website uses cookies and similar technologies. Cookies are small text files stored on your device when you visit a website. We use them to make the Website work and, only with your permission, to understand how it is used and to show embedded content such as videos and maps.
Strictly necessary cookies: these are needed for the Website to work and cannot be switched off. They include the session cookie that remembers your 18+ age confirmation, so you aren’t asked again on every page during your visit, and the cookie that stores your cookie choices. They don’t need your consent.
Analytics cookies: we use Google Analytics (via Google Site Kit) to understand visitor numbers and how the Website is used, so we can improve it. These are only set if you agree.
Embedded content cookies: YouTube videos and Google Maps may set their own cookies when they load. These are only set if you agree. Until then, you will see a placeholder instead of the video or map.
Who we share your data with
We never sell your personal data. We share it only where necessary, with:
- Hospitals and clinical teams involved in your care — HCA Healthcare UK, Royal Free London NHS Foundation Trust, Hadley Wood Hospital
- Your GP and any other referring or treating clinicians
- Your medical insurer, where you are claiming privately
- Website hosting, IT, and analytics providers, acting under contract as data processors
- Regulatory bodies (GMC, CQC), where legally required
- Professional advisers (legal, accountancy), where necessary
What are your rights?
You have the right to:
- Access the personal data we hold about you
- Correct inaccurate or out-of-date data
- Request deletion of your data, where we’re not required to keep it for legal reasons
- Object to or restrict certain processing, including direct marketing
- Withdraw consent at any time, for anything based on consent — including Level 3 photograph use, without affecting the lawfulness of processing carried out before withdrawal
- Request data portability, where feasible
- Complain to the Information Commissioner’s Office (ICO) — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk
To exercise any of these rights, contact us using the details above. We will respond within one month, as required by law.
How to stop marketing messages
- Click “unsubscribe” on any marketing email
- Reply directly to any marketing email asking to be removed
- Contact us directly using the details above
This will not affect essential communications, such as appointment confirmations or clinical follow-up.
Children
We do not knowingly collect personal data from anyone under 18. The Gallery and Procedures pages contain genuine clinical images that may include nudity and are age-gated site-wide, as described above. If you believe we hold data relating to a child, please contact us.
Changes to this policy
We may update this policy from time to time to reflect changes in law or our practices. The “Last updated” date at the top shows when it was last revised.
Complaints
If you’re unhappy with how your data has been handled and our response hasn’t resolved your concern, you can report it to the ICO at ico.org.uk.
Any questions?
Contact Ms Jajini Susan Varghese’s practice at:
📧 info@jajini.com ·
The London Breast Institute, HCA Women’s Health Centre, 27–29 Harley Street, London W1G 9QP