Privacy Policy

Last Updated: April 2026

1. Introduction

North West Sleep Clinic ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website northwestsleepclinic.com, use our services, or otherwise interact with us.

We are a registered company in Ireland (Company Registration No. 804155) operating from Suite 1, River House, Dry Arch Business Park, Dromore, Letterkenny, Co. Donegal, F92 XE6D, Ireland.

This policy is provided in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Data Protection Act 2018 (Ireland), and the ePrivacy Regulations (S.I. No. 336 of 2011) as amended.

2. Data Controller

The data controller responsible for your personal data is:

3. What Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of personal data:

3.1 Information You Provide Directly

• Identity Data: Name, title, date of birth
• Contact Data: Email address, telephone number, postal address
• Health Data: Medical history, sleep study results, diagnoses, treatment records, prescription information, referral letters from GPs or consultants (this is special category data under GDPR Article 9)
• Financial Data: Payment details for services rendered
• Communication Data: Contents of correspondence with us via email, phone, or contact forms

3.2 Information Collected Automatically

• Technical Data: IP address, browser type and version, operating system, device type
• Usage Data: Pages visited, time spent on pages, referring website
• Cookie Data: See Section 9 (Cookies) below

4. How We Use Your Personal Data

We use your personal data for the following purposes:

Purpose	Type of Data	Legal Basis (GDPR Art. 6)
To provide medical consultations and treatment	Identity, Contact, Health	Performance of a contract; Vital interests; Art. 9(2)(h) — provision of healthcare
To manage your patient records	Identity, Contact, Health	Legal obligation; Art. 9(2)(h)
To process payments	Identity, Financial	Performance of a contract
To respond to your enquiries	Identity, Contact, Communication	Legitimate interest
To send appointment reminders	Identity, Contact	Legitimate interest; Consent
To improve our website and services	Technical, Usage	Legitimate interest
To comply with legal and regulatory obligations	All relevant data	Legal obligation

5. Processing of Health Data (Special Category Data)

As a healthcare provider, we process health-related data which is classified as special category data under Article 9 of the GDPR. We process this data on the basis of:

• Article 9(2)(h): Processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care, or the management of health or social care systems and services
• Article 9(2)(a): Where we obtain your explicit consent for specific processing activities

Your health data is processed with appropriate confidentiality safeguards and in accordance with the standards required by Irish medical regulations and the Medical Council guidelines.

6. Who We Share Your Data With

We may share your personal data with the following categories of recipients, only as necessary:

• Your GP or referring consultant: To provide continuity of care and share relevant clinical findings
• Healthcare professionals: Involved in your treatment or care coordination
• Laboratories and diagnostic service providers: For processing sleep study data
• Payment processors: To process your payments securely
• IT service providers: Who help us maintain our systems (under strict data processing agreements)
• Regulatory bodies: Such as the Medical Council, HSE, or HIQA when required by law
• Legal advisors: Where necessary for the establishment, exercise, or defence of legal claims

We do not sell, rent, or trade your personal data to third parties for marketing purposes.

7. How Long We Keep Your Data

We retain your personal data only for as long as is necessary for the purposes for which it was collected:

• Medical records: Retained for a minimum of 8 years from the date of last contact, in line with the Medical Council's guidelines and Irish statute of limitations.
• Financial records: Retained for 6 years as required by Irish Revenue Commissioners
• Website analytics data: Retained for up to 26 months
• Contact form enquiries: Retained for 2 years unless they relate to a patient record

After the applicable retention period, personal data is securely deleted or anonymised.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Access controls limiting data access to authorised personnel only
• Regular security assessments and updates
• Secure storage of physical records in locked facilities
• Staff training on data protection and confidentiality obligations

9. Cookies

Our website uses cookies — small text files placed on your device — to improve your browsing experience. The types of cookies we use include:

9.1 Strictly Necessary Cookies

Essential for the website to function properly. These cannot be disabled.

9.2 Functional Cookies

Help remember your preferences such as language settings.

9.3 Analytics Cookies

Help us understand how visitors interact with our website by collecting anonymous information. We use this data to improve our website.

In accordance with the ePrivacy Regulations (S.I. No. 336 of 2011), we will obtain your consent before placing non-essential cookies on your device.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect website functionality.

10. International Data Transfers

We aim to keep your personal data within the European Economic Area (EEA). If we need to transfer data outside the EEA, we will ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• An adequacy decision by the European Commission for the recipient country

11. Your Rights Under GDPR

Under the GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us at drmikulich@northwestsleepclinic.com or by post at the address above. We will respond to your request within one month of receipt, as required by the GDPR.

12. Right to Lodge a Complaint

If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the supervisory authority:

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Any changes will be posted on this page with an updated "Last Updated" date.

We encourage you to review this page periodically to stay informed about how we protect your personal data.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us: