How Are Your Images and Personal Data Protected?
Your medical images and personal information are classified as special category data under UK GDPR. At ScanAlign, standing EOS imaging in Harley Street, we store your images on encrypted, UK-based systems, share them only with your explicit consent, and give you full control over who sees your records. You can read the full legal detail in our privacy policy.
Key takeaways
- Health data is "special category" under UK GDPR and receives the highest level of protection.
- Your images are stored on encrypted, UK-based PACS (picture archiving) systems.
- No one outside the clinical team sees your images unless you give written consent.
- You can request a copy of your data, ask for corrections, or request deletion at any time.
- ScanAlign is the data controller. CoreMed Solutions Ltd is the registered company.
What personal data does ScanAlign collect?
We collect only what is needed to carry out your scan safely and produce an accurate report. This includes your name, date of birth, contact details, relevant medical history, and the images themselves. Under UK GDPR, medical images and health information are classed as "special category data," which means they are subject to stricter rules than ordinary personal data.
We do not collect financial card details directly. Payments are handled through a separate, PCI-compliant payment provider.
Who can see my medical records at ScanAlign?
Only the clinical team directly involved in your scan and report can access your records. This typically means the specialist diagnostic radiographer who conducts your scan and the reporting clinician who analyses the images. Administrative staff may see limited contact details to manage your booking, but they do not have access to your images or clinical notes.
We will never share your images or report with a third party, such as a referring clinician, insurer, or another hospital, unless you give explicit written consent. If you arrived through a referral, we will ask whether you would like a copy sent to your referring clinician. The choice is always yours.
How long are X-rays and medical images kept?
Medical images in the UK are typically retained in line with NHS and professional body guidance. ScanAlign stores your images on a UK-based PACS (Picture Archiving and Communication System) with encryption both in transit and at rest. Our retention periods follow Department of Health records management guidelines. When the retention period ends, images and associated data are securely deleted.
If you would like to know the specific retention period that applies to your records, you can contact us at any time.
A note on image types. EOS shows bones, joints and whole-body alignment. For soft tissue, discs or nerves, MRI is usually the better tool. Both types of image are subject to the same data protection rules, so the guidance on this page applies regardless of the imaging method.
What are my patient data rights under UK GDPR?
UK GDPR gives you clear rights over your health data. You can exercise any of these by contacting us directly. We aim to respond promptly and will never charge a fee for a straightforward request. For full details, see your rights as a patient.
If you are unhappy with how we handle your data, you also have the right to complain to the Information Commissioner's Office (ICO).
How does ScanAlign keep medical imaging data safe?
We use multiple layers of protection covering physical security, digital security, and staff procedures. Here is how we handle your data from the moment you book your scan through to long-term storage.
All images and personal data are stored on encrypted servers within the UK. Data is encrypted both at rest and during transfer between systems.
Only authorised clinical staff can view your images. Each team member logs in with unique credentials, and access is audited.
Your images are never sent to a third party without your explicit, written consent. You decide who receives a copy of your report.
When the retention period ends, or if you request earlier deletion (where legally permissible), data is permanently and securely erased.
ScanAlign is the trading name of CoreMed Solutions Ltd, which acts as the data controller. The clinic operates under The Harley Street Hospital's CQC licence at 19 Harley Street, London.
Common questions about medical imaging data protection
CoreMed Solutions Ltd (trading as ScanAlign) is the data controller. This means we are legally responsible for how your personal data is collected, used and stored.
No. The same UK GDPR protections apply whether you self-refer or are referred by a clinician. Your data is treated identically either way.
No. We will only send your images or report to your GP, or any other clinician, if you give us explicit written consent to do so.
We follow Department of Health records management guidance for retention periods. Contact us if you would like to know the exact timescale for your records.
Yes. You have the right to request a copy of your images and report at any time. We can provide them in a standard digital format.
You can request deletion. We will comply unless there is a legal obligation that requires us to retain the data for a set period. We will explain clearly if that applies.
Yes. All images and personal data are stored on encrypted servers located within the United Kingdom.
In the unlikely event of a data breach, we are legally required to notify the ICO within 72 hours. If the breach poses a high risk to you, we will also inform you directly and promptly.
Only if you explicitly consent. We never share data with insurers, employers or any third party without your written permission.
You can read the full legal document at our privacy policy page on the ScanAlign website.
Questions about your data or ready to book?
Speak with our team in a free, no-obligation video consultation. We are happy to answer any questions about how your images and data are handled.
Book a free video consultationSources
- Information Commissioner's Office. Guide to the UK General Data Protection Regulation (UK GDPR). ico.org.uk
- Department of Health. Records Management Code of Practice for Health and Social Care 2021. gov.uk
- NHS England. Your health records. nhs.uk/using-the-nhs/about-the-nhs/your-health-records/
Written by Abbas Dhami (Specialist Diagnostic Radiographer)
This page is general information and not a diagnosis.
ScanAlign is the trading name of CoreMed Solutions Ltd and operates under The Harley Street Hospital's CQC licence.