u/MissionForce20

Given how many complaints are not investigated by the ICO, I anticipated my complaint to be closed. However, does my experience reflect how the ICO achieves their high non-investigation statistics? What closure reasons have people had in their ICO complaints, and has anyone used the local MP approach or alternatives?

---

I complained to the ICO about a private UK sports/healthcare organisation who among several actions and findings:

• Without my consent, accessed health records about external treatment I was receiving to change my treatment with them to this since 'we are better'. I learned about their actions from SARs since they refused to tell me why my treatment suddenly changed and why my care was also terminated.
• Ignored my rectification request and data protection complaint.
• The DPO (who is the Founder, CEO and much more, which I raised a conflict of interest on, and changed/terminated my care) threatened legal action when I contacted to exercise my rights of deletion.

The ICO closed my complaint using a brief remark I had in my complaint...

ICO (after months of waiting since I submitted): An organisation can respond to a SAR on the final day of the deadline.

Me (appeal): Sure, but what about my whole complaint? I had detailed the harm (MRI scans, referrals, diagnoses etc) I attribute to the situation.

ICO: Section 165 of DPA 2018 informs the ICO does not determine the outcome of every concern within a complaint received. The ICO will not respond any further, but you can appeal our decision using your local MP.

I'm in a confusing and concerning situation with a UK private health and fitness company (known as Company A where helpful) that has been ongoing since January 2026. It's difficult to explain and their actions impacted complaints to the ICO and further regulators which they were expecting...

I'm after any advice please from a data perspective.

Background:

• For several months, patient at Company A for upper body injuries since a clinician offered a unique treatment (no other clinician, or even company, offers equivalent at least by description/videos).
• I developed hip/leg injuries in October 2025 and became a patient at another company (Company B) alongside Company A. Company A aware and understood reasons i.e., I had MRIs which Company A doesn't provide and Company A's Physiotherapists work M-F 9-5 which doesn't work for me.
• I asked Company A for further treatment on my upper body.
• Company A performed frankly interesting processing upon my ask that I rejected and then they terminated my care with no duty of care or continuity. Fortunately, I was with Company B still for hip/leg injuries treatment but Company A's actions made me become ill, miss substantial daily rehab, and relapsed my entire injuries (hip/leg/upper body) and now I'm in extended treatment (and more MRIs likely). It's a difficult life...

Processing:

• Company A took health data on my hip/leg injuries and processed it (without my consent and out of basis on how I gave it to them) into a referral to see their Physiotherapists etc., despite knowing my reasons. I polietly rejected this referral but ensured I wanted to increase my treatment on my upper body with them.
• Company A reviewed ('processed') my upcoming upper body treatment with them and changed it to the referral without my consultation or agreement using my unconsented hip/leg injuries data as the reason. They even changed different patient's treatment to do this change to the referral. I cancelled this treatment.
• Company A reviewed ('processed') my entire care and terminated me.

SAR:

• Following termination, I issued 3x SARs to Company A at the same time (a SAR per category, rather than 1 SAR).
• Company A processed and responded to my SARs on deadline day.
• Company A didn't provide all information I requested with no justification or exemptions. Used terms such as "relevant emails". No evidence of searching of Microsoft Teams etc.
• No evidence of reviews conducted and the legal advice they sought when terminating my entire care etc.

Complaints:

• I issued a formal internal complaint which had a point about processing my hip/leg data. They failed to respond by their deadline and at all to date.
• I issued a formal data protection complaint which had points on the handling of SARs etc and for their DPO involvement. They and DPO failed to respond by the deadline and at all to date.
• I think they've blocked me.

Compliance:

• Not registered with the ICO for data protection fees until I told them. Duration is unknown but could be the full 8 years of existence.
• DPO is the Founder, Owner, and Director (aka CEO and more).
• Privacy policy was last updated in January 2018. Is a similar case for their T&Cs. Both are boiler plated.
• Work with NHS and private healthcare insurers who have data protection obligations.
• I question whether they have documented practices - APD, RoPA, DPIA etc - at all or outdated just like privacy policy.