How Are Your Images and Personal Data Protected?
In the UK, your medical images and personal information count as special category data under UK GDPR. At ScanAlign, standing EOS imaging in Harley Street, we store your images on encrypted systems based in the UK. We share them only with your clear consent, and you have full control over who sees your records. You can read the full legal detail in our privacy policy.
Key points
- Under UK GDPR, health data is "special category" data and gets the highest level of protection.
- Your images are stored on encrypted PACS (picture archiving) systems based in the UK.
- No one outside the clinical team sees your images unless you give written consent.
- You can ask for a copy of your data, ask for corrections, or ask for it to be deleted at any time.
- ScanAlign is the data controller. CoreMed Solutions Ltd is the registered company.
What personal data does ScanAlign collect?
We collect only what we need to do your scan safely and write an accurate report. This includes your name, date of birth, contact details, relevant medical history and the images themselves. Under UK GDPR, medical images and health information are classed as "special category data". This means stricter rules apply to them than to ordinary personal data.
We do not collect your card details ourselves. Payments go through a separate, PCI-compliant payment provider.
Who can see my medical records at ScanAlign?
Only the clinical team directly involved in your scan and report can see your records. This usually means the specialist diagnostic radiographer who does your scan and the reporting clinician who studies the images. Office staff may see some contact details to manage your booking. They cannot see your images or clinical notes.
We will never share your images or report with anyone else, such as the clinician who referred you, an insurer or another hospital, unless you give clear written consent. If you came to us through a referral, we will ask if you would like a copy sent to the clinician who referred you. The choice is always yours.
How long are X-rays and medical images kept?
In the UK, medical images are usually kept in line with NHS and professional body guidance. ScanAlign stores your images on a PACS (Picture Archiving and Communication System) based in the UK. They are encrypted both while being sent and while stored. How long we keep records follows the UK Department of Health records management guidelines. When that period ends, the images and related data are securely deleted.
If you would like to know the exact period that applies to your records, you can contact us at any time.
A note on types of image. EOS shows bones, joints and whole-body alignment. For soft tissue, discs or nerves, MRI is usually the better tool. The same data protection rules apply to both types of image, so the guidance on this page applies whichever scan you have.
What are my patient data rights under UK GDPR?
UK GDPR gives you clear rights over your health data. You can use any of these rights by contacting us directly. We aim to reply promptly and will never charge a fee for a simple request. For full details, see your rights as a patient.
If you are unhappy with how we handle your data, you also have the right to complain to the UK Information Commissioner's Office (ICO).
How does ScanAlign keep medical imaging data safe?
We use several layers of protection: physical security, digital security and staff procedures. Here is how we handle your data, from the moment you book your scan through to long-term storage.
All images and personal data are stored on encrypted servers in the UK. Data is encrypted both while stored and while moving between systems.
Only authorised clinical staff can view your images. Each team member logs in with their own unique details, and all access is checked.
Your images are never sent to anyone else without your clear, written consent. You decide who gets a copy of your report.
When the retention period ends, or if you ask for earlier deletion (where the law allows), data is permanently and securely erased.
ScanAlign is the trading name of CoreMed Solutions Ltd, which acts as the data controller. The clinic operates under The Harley Street Hospital's CQC licence at 19 Harley Street, London.
If you are thinking of starting treatment, or changing the one you are on, it is worth getting a detailed diagnosis first. Knowing whether the cause sits in the pelvis, the legs or the spine changes what will actually help.
Common questions about medical imaging data protection
CoreMed Solutions Ltd (trading as ScanAlign) is the data controller. This means we are legally responsible for how your personal data is collected, used and stored.
No. The same UK GDPR protections apply whether you book yourself or a clinician refers you. Your data is treated in exactly the same way either way.
No. We will only send your images or report to your doctor, or any other clinician, if you give us clear written consent to do so.
We follow UK Department of Health records management guidance on how long records are kept. Contact us if you would like to know the exact period for your records.
Yes. You have the right to ask for a copy of your images and report at any time. We can provide them in a standard digital format.
You can ask for deletion. We will do this unless the law requires us to keep the data for a set period. We will explain clearly if that applies.
Yes. All images and personal data are stored on encrypted servers located in the United Kingdom.
In the unlikely event of a data breach, the law requires us to tell the ICO within 72 hours. If the breach puts you at high risk, we will also tell you directly and promptly.
Only if you clearly consent. We never share data with insurers, employers or anyone else without your written permission.
You can read the full legal document on our privacy policy page on the ScanAlign website.
Questions about your data, or ready to book?
Speak with our team in a free video consultation, with no obligation. We are happy to answer any questions about how your images and data are handled.
Book a free video consultationSources
- Information Commissioner's Office. Guide to the UK General Data Protection Regulation (UK GDPR). ico.org.uk
- Department of Health. Records Management Code of Practice for Health and Social Care 2021. gov.uk
- NHS England. Your health records. nhs.uk/using-the-nhs/about-the-nhs/your-health-records/
Written by Abbas Dhami (Specialist Diagnostic Radiographer)
This page is general information and not a diagnosis.
ScanAlign is the trading name of CoreMed Solutions Ltd and operates under The Harley Street Hospital's CQC licence.