Legal

Privacy policy

This privacy policy explains how I, Miss Sonia Mall, collect, use, store and share your personal information when you use this website or come to me for eye care, and the rights you have under UK data protection law.

Last updated: 30/10/2026

1. Who I am

This website is run for my private practice as Miss Sonia Mall, Consultant Ophthalmic Surgeon (GMC number 6129624). I see patients at Nuffield Health Woking, The Runnymede Hospital, Mount Alvernia Hospital and VISIO Health.

2. What I collect

I collect only what I need to reply to you and to look after your eyes. Depending on how you contact me, this may include:

your name, email address, phone number and postal address
your date of birth and, where relevant, your NHS number
anything you choose to tell me about your eyes or your appointment, and the findings, scans and letters from your consultations
your preferred hospital and whether you are paying for yourself or using insurance, with your insurer and authorisation details
technical details such as your cookie choices, IP address and browser type

Most of this comes from you. I may also receive information from your Optician, GP or another doctor who refers you, and from the hospital where you are seen. Please do not send detailed medical records through the website form;

3. Why I use it

I use your information to reply to your enquiry, arrange and provide your care, write to your GP or optician with your agreement, deal with your insurer, keep proper medical and financial records, and run this website securely.

My lawful basis

Health information is special category data, which UK data protection law protects more strongly. The government’s data protection guide sets out the principles I follow, and Article 9 of the UK GDPR lists the conditions for using health data.

enquiries and appointment requests: steps you ask me to take before a contract, or my legitimate interests
your consultation, tests, treatment and letters: contract, and for health information Article 9(2)(h), which covers medical diagnosis and the provision of health care by a professional bound by confidentiality
keeping medical and financial records: legal obligation
analytics cookies and other optional cookies: your consent, which you can withdraw at any time

4. Who I share it with

I share your information only when your care needs it, when you agree, or when the law requires it. That may include:

the hospital or clinic where you are seen, which keeps its own records under its own privacy notice
your insurer, with your authorisation, so it can approve and pay for treatment
your GP, optician or another doctor involved in your care, with your agreement
regulators, courts or the police, only where the law requires it

5. How long I keep it

Information is kept for no longer than is necessary, one of the data protection principles. My retention periods are:

enquiries that do not lead to an appointment:
medical records: usually 8 years for adult records, in line with the Records Management Code of Practice for Health and Social Care

Under UK data protection law you have the right to:

be told how your information is used, which this page does
get a copy of your information, known as a subject access request
have incorrect information corrected
have information deleted or its use restricted, in some circumstances
object to how it is used, and move it to another service (data portability)
withdraw consent at any time, where I rely on consent

I aim to answer a request within 1 month, which is the usual time limit the ICO describes. Some rights are limited for medical records that must be kept for your ongoing care.

How to complain

If you are unhappy with how I have used your information, please tell me first so I can put it right. You can also complain to the Information Commissioner’s Office on 0303 123 1113 or through the ICO complaints page.

7. Contact

Email enquiries@soniamall.co.uk or call my practice on 07438 437366. I aim to reply within 24 hours.

enquiries@soniamall.co.uk · 07438 437366

8. Changes to this privacy policy

I may update this privacy policy from time to time, and the date at the top shows the latest version. How this website uses cookies is set out in the cookie policy.