1. What Information We Collect

When you register or receive care from us, we collect:

• Your name, date of birth, and contact details
• Medical history, treatment notes, and test results
• Appointment records and prescriptions
• Billing and payment information
• Emergency contact information

We only collect what’s necessary to provide you with safe, effective care.

2. How We Use Your Information

We use your data to:

• Deliver healthcare services
• Book appointments and manage your care
• Communicate with you about your treatment
• Handle billing and insurance claims
• Meet legal and regulatory requirements

3. Sharing Your Personal Data

We only share your personal data with organisations directly involved in your care-such as your GP-unless we are legally required to share it with another party. Any sharing with external organisations is governed by formal agreements, such as Data Processing Agreements or Data Sharing Agreements, where applicable.

If your data needs to be shared for reasons beyond your direct care, we will inform you- unless we are legally prohibited from informing you. These services may include:

• Sexual Health
• Social Services
• Independent Sexual Violence Advisor (ISVA) Services
• Talking Therapies
• Mental Health Support

Internally, access to personal data – including special category personal data – is strictly limited to individuals who require it to perform their job responsibilities.

Externally, we may share personal data (including special category data) with the following categories of recipients, always with due regard for your privacy and in accordance with applicable laws:

• Healthcare professionals such as your GP or other medical practitioners involved in your care or treatment, but only with your explicit consent or where there is a legitimate concern for your safety or the safety of others.
• Regulatory bodies, law enforcement, intelligence services, and government authorities when legally required to do so.
• Service providers who support our operations, including:
  • Companies managing our IT infrastructure
  • Providers of cloud-based IT systems
  • External advisors such as IT consultants, accountants, and legal professionals
  • Specialist medical service providers, including those conducting blood tests, analysing tissue samples, prescription dispensing, or supporting the operation of our physical clinic

We never sell your data or use it for marketing without your permission.

4. How We Keep Your Data Safe

We take data security seriously. Your information is protected by:

• Secure computer systems and encrypted records
• Access controls-only authorised staff can view your data
• Regular staff training on data protection
• Routine checks to make sure our systems stay secure

5. How Long We Keep Your Information

We retain your records only for as long as necessary:

• Medical records are typically kept for at least 8 years after your last visit, or longer in the case of children. This is in line with Article 5(1)(e) of the UK GDPR.
• Financial records are retained for 6 years to comply with tax and audit obligations.

After these periods, your data is either securely deleted or anonymised, ensuring it can no longer be linked to you.

6. Your Data Protection Rights

The UK GDPR allows various rights for people whose data is being processed. The rights are not absolute and so sometimes do not apply. Where you wish to exercise any of your rights, you may do so free of charge contacting us at [email protected]. We will respond within one month.

Details of the rights within UK GDPR are below. You will be informed if the right is available to you upon application:

To exercise your rights, just contact our team by email [email protected]

Complain to the Information Commissioner’s Office (ICO) if you’re unhappy please visit https://ico.org.uk/make-a-complaint/ or call 0303 123 1113.

7. Questions or Concerns?

If you have any questions about this policy or how your data is handled, please speak to a member of our team or contact us at [email protected]