Last updated 9 August 2026
Privacy Notice
This notice explains how Dr Rob Greig collects and uses personal information through this website and the private practice, including information relating to appointments, enquiries and repeat-prescription requests.
Dr Rob Greig, Jersey Care Commission registration JMR/132, practising at Castle Quay Medical Practice, Rue de L’Etau, St Helier, Jersey. General privacy enquiries: feedback@batcastlequay.com.
Information collected
- Identity and contact details such as name, date of birth, postal address, telephone number and email address.
- Appointment information, correspondence, deposit/payment status and service requested.
- Health and medicines information supplied for clinical care or a repeat-prescription request. Health information is special-category data.
- Information created during care, including clinical notes, prescriptions, consent records and relevant photographs.
- Limited technical and security information generated when the website or booking system is used, such as device/browser information and server logs.
Why information is used and the lawful basis
| Purpose | Lawful basis under Jersey law |
|---|---|
| Responding to enquiries and arranging appointments | Taking steps at your request, performing the service contract and legitimate interests in administering the practice. |
| Providing medical assessment, treatment, follow-up, prescribing and medicines safety | Performance of the service contract and the medical-purposes condition in Schedule 2, paragraph 15 of the Data Protection (Jersey) Law 2018, with professional confidentiality safeguards. |
| Taking and reconciling deposits and payments | Performance of the service contract, accounting obligations and legitimate administrative interests. |
| Professional, legal, regulatory, insurance and patient-safety duties | Compliance with legal obligations, legitimate interests, medical purposes and, where relevant, establishing or defending legal rights. |
| Website security, fraud prevention and essential operation | Legitimate interests in operating a safe and reliable service. |
| Optional analytics or non-essential cookies, if enabled | Consent where required. Consent may be withdrawn through the available cookie controls. |
Where explicit consent is used for a specific optional purpose, you may withdraw it without affecting processing that was lawful before withdrawal. The practice does not use patient contact information for marketing emails.
Where information comes from
Most information comes directly from you through the website, booking system, email, telephone/WhatsApp contact or consultation. Relevant information may also come from a parent or representative, another health professional, a pharmacy, a payment provider or a regulator where appropriate and lawful. Clinical information is also created as part of assessment and care.
Who may receive information
Information is shared only where necessary and proportionate. Recipients or processors can include:
- Krystal for website hosting and WordPress technical services.
- SimplyBook.me for appointment booking and related communications.
- SBPay.me and SumUp for deposits and payments. Full card details are handled by the payment provider and are not stored in WordPress.
- Microsoft 365 (currently supplied through GoDaddy) for practice email.
- Pharmacies and other health professionals involved in your care, where necessary.
- Professional advisers, indemnity providers, regulators, courts or public authorities where disclosure is required or justified.
WhatsApp, embedded maps, social-media links and external patient-information sites operate under their own privacy notices when you choose to use them.
International processing
Some technology providers and their approved subprocessors may process information outside Jersey. Appropriate contractual, adequacy or other lawful safeguards must be used for those transfers. You may ask for further information about the relevant safeguards using the contact address above.
Retention
- General website enquiries and digital contact information are normally retained for up to five years after the last meaningful contact, unless there is a clear reason to keep them longer or delete them sooner.
- Booking, payment and accounting information is retained for the period required by contractual, tax and regulatory obligations.
- Repeat-prescription requests, prescriptions, clinical correspondence and other health information may form part of the clinical record and can be retained for longer in accordance with professional, legal, insurance and patient-safety requirements.
- Technical and security logs are retained only for as long as reasonably necessary for security, troubleshooting and legal obligations.
Your rights
Depending on the circumstances, your rights include being informed, access to your personal data, rectification, erasure, restriction, data portability, objection and rights concerning automated decision-making. Some rights are limited where information must be retained for clinical, legal, regulatory or public-interest reasons. Requests can be made to feedback@batcastlequay.com; identity may need to be verified.
Automated decisions and the BMI checker
The BMI and waist-to-height checker performs a calculation in your own browser. The measurements and result are not sent to Dr Greig or stored by the website. It does not make a treatment or prescribing decision, and Dr Greig does not use solely automated decisions to determine care.
Cookies and external services
Necessary cookies support security, administration and core website functions. The SimplyBook.me booking site provides its own cookie and personal-data controls. Non-essential analytics or embedded-service cookies should be used only with consent where required. Following an external link may allow that provider to collect information under its own notice.
Security
Appropriate technical and organisational measures are used to protect information, including controlled access and protected website administration. No internet service is completely risk-free; please avoid sending urgent clinical information through general email. Paper clinical records are kept onsite in locked storage.
Questions and complaints
Please contact Dr Greig first if you have a privacy concern so it can be investigated promptly. You may also complain directly to the Jersey Office of the Information Commissioner (JOIC), 2nd Floor, 5 Castle Street, St Helier, Jersey, JE2 3BT; telephone 01534 716530; email enquiries@jerseyoic.org; jerseyoic.org.
Changes and accessible copies
This notice will be reviewed when services or providers change. The updated date will be shown at the top. A printed or alternative-format copy can be requested through the contact page.
Prepared with reference to the Data Protection (Jersey) Law 2018 and the Jersey Office of the Information Commissioner’s November 2025 privacy-notice checklist. This notice describes the current intended data flow and should be reviewed whenever hosting, email, booking or payment providers change.