Privacy notice
Dr Gohar Shah — Independent Medical Practitioner
This notice explains how your personal information is handled when you enquire about, book, or receive any of Dr Gohar Shah's independent medical services. At present these are focused shockwave therapy for erectile dysfunction and assessment and treatment of excessive sweating. These services are provided by Dr Gohar Shah personally, as an independent medical practitioner (GMC 6127983), consulting at 18 Victoria Park Square, Bethnal Green, London E2 9PB. For these services, Dr Shah is the data controller, registered with the Information Commissioner's Office (registration C1985672). These services are separate from the aesthetic and skin-medicine services of Victoria Park Clinic, which are provided by GS Medical Services Ltd under its own privacy policy.
What information is collected
Contact and identity details (name, date of birth, phone, email); appointment and booking details; medical information you provide or that arises from your care — screening questionnaires, medical history, examination findings, blood test results, treatment records, consent forms, and clinical photographs of the treated area where these are part of your care (for excessive sweating, the starch–iodine map of the underarm taken before treatment); and limited payment administration details (payments are processed by Stripe — Dr Shah does not see or store your card numbers).
Why it is used, and the legal basis
Your information is used to assess whether treatment is suitable for you, to provide and record your care safely, to communicate with you about appointments, and to meet legal and professional record-keeping obligations. The legal bases are: performance of a contract with you (UK GDPR Article 6(1)(b)); compliance with legal obligations (Article 6(1)(c)); legitimate interests in running the practice (Article 6(1)(f)); and, for medical information, the provision of health care by a registered professional subject to a duty of confidentiality (Article 9(2)(h)).
Confidentiality
Your care is confidential. Nothing is shared with anyone outside the practice without your agreement, except where the law requires it or in rare circumstances where there is a serious risk to you or others. A clinical letter for your NHS GP is offered at the end of treatment; whether it is sent is your choice. Card statements show only a company name; the nature of the treatment never appears.
Where your records are kept
Clinical records are held in a secure practice-management system. The systems used for clinical records and payments (the Pabau practice-management platform, Google Workspace for email and Stripe for payments) are made available under a written data processing agreement with GS Medical Services Ltd, which acts strictly on Dr Shah's instructions as controller. Online booking is provided by Cal.com under a data processing agreement held directly by Dr Shah, with booking data hosted in the EU. Access to your records is restricted to Dr Shah.
How long records are kept
Clinical records are retained for 8 years from your last treatment, in line with standard UK medical record retention guidance, then securely deleted. Booking and enquiry details that never lead to treatment are deleted within 12 months.
Your rights
You can ask for a copy of your records, ask for inaccurate information to be corrected, and — subject to the legal limits that apply to medical records — ask for information to be deleted or for its use to be restricted. To exercise any of these rights, contact Dr Shah at drgohar@victoriaparkclinic.co.uk. If you are unhappy with how your information has been handled, you can complain to the Information Commissioner's Office (ico.org.uk / 0303 123 1113).
Last updated: September 2026. Previously published at /shockwave/privacy/.