1.1Definitions:
Affiliate: in relation to a party, any entity that directly or indirectly controls, is controlled by, or is under common control with that party from time to time.
Applicable Laws: all applicable laws, statutes, regulations and codes from time to time in force.
Business Day: a day other than a Saturday, Sunday or public holiday in England, when banks in London are open for business.
Charges: the charges payable by the Patient for the supply of the Services by the GP Health Hub Ltd, as set out in the Contract Details and Schedule
Conditions: these terms and conditions set out in clause 1 to clause 10 (inclusive).
Confidential Information: all information (however recorded or preserved) that one party discloses or makes available to the other party (recipient) in connection with the Contract and which would be regarded as confidential by a reasonable business person. It includes any information of a confidential nature relating to the Charges or the operations, products or Patients of the GP Health Hub Ltd It does not include information that is or becomes generally available to the public through no fault of the recipient; is independently developed by or for the recipient; or was, is or becomes available to the recipient on a non-confidential basis from a person who, to the recipient's knowledge, is under no confidentiality obligation with respect to that information.
Contract: the contract between the Patient and the GP Health Hub Ltd for the supply of the Services comprising the Contract and any Schedules specified in the Contract.
Control: has the meaning given in section 1124 of the Corporation Tax Act 2010, and controls and controlled shall be interpreted accordingly.
Patient Materials: all documents and information, items and materials (whether owned by the Patient or a third party), which are provided by the Patient to the GP Health Hub Ltd in connection with the Services.
Effective Date: as set out in the Contract Details.
Intellectual Property Rights: patents, utility models, rights to inventions, copyright and related rights, moral rights, trademarks and service marks, business names and domain names, rights in get-up and trade dress, goodwill and the right to sue for passing off or unfair competition, rights in designs, rights in computer software, database rights, rights to use, and protect the confidentiality of, confidential information (including know-how and trade secrets) and all other intellectual property rights, in each case whether registered or unregistered and including all applications and rights to apply for and be granted renewals or extensions of, and rights to claim priority from, those rights and all similar or equivalent rights or forms of protection which subsist or will subsist now or in the future in any part of the world.
Losses: all liabilities, damages, losses (including loss of profits, loss of business, loss of reputation, loss of savings and loss of opportunity), fines, expenses and costs (including all interest, penalties, legal costs (calculated on a full indemnity basis) and reasonable professional costs and expenses).
Services: the services, set out in the Contract and Schedule 1.
Schedules : the Schedules which form part of this Agreement
1.2Interpretation:
1.2.1A person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality).
1.2.2Unless expressly provided otherwise in the Contract, a reference to legislation or a legislative provision:
1.2.2.1is a reference to it as amended, extended or re-enacted from time to time and
1.2.2.2Includes all subordinate legislation made [from time to time under that legislation or legislative provision.
1.2.3Any words following the terms including, include, in particular, for example or any similar expression shall be interpreted as illustrative and shall not limit the sense of the words preceding those terms.
1.2.4A reference to writing or written excludes fax but not email.
The Contract starts on the Effective Date and continues, unless terminated earlier in accordance with its terms.
3.1The GP Health Hub Ltd shall supply the Services to the Patient from the Effective Date in accordance with the Contract as set out in Schedules 1 and 2.
3.2In supplying the Services, the GP Health Hub Ltd shall:
3.2.1perform the Services with reasonable care and skill in accordance with the generally recognised standards and practices in the medical profession.
3.2.2use all reasonable endeavours to meet any performance dates specified in the Contract. Time is not of the essence for the performance of any of the GP Health Hub Ltd.’s obligations in the Contract;
3.2.3comply with:
3.2.3.1all Applicable Laws
provided that the GP Health Hub Ltd shall not be liable under the Contract if, as a result of this compliance, it is in breach of any of its other obligations under the Contract; and
3.2.4use reasonable endeavours to ensure its staff observe all reasonable health and safety and security requirements that apply at any of the Patient's premises they access and have been communicated to the GP Health Hub Ltd in advance in writing. The GP Health Hub Ltd shall not be liable under the Contract if, as a result of observing these requirements, it is in breach of any of its other obligations under the Contract.
4.1The Patient shall:
4.1.1co-operate with the GP Health Hub Ltd in all matters relating to the Services ;
4.1.2provide the GP Health Hub Ltd, in a timely manner, with all information and materials as the GP Health Hub Ltd may reasonably require to provide the Services and ensure that they are accurate and complete in all material respects;
4.1.3The Patient agrees to provide details of their General Practitioner and consent to the sharing of information regarding investigations, results, and treatments.
4.1.4Accurately disclose complete medical history, including family history, medication history, past medical history, and current prescriptions.
4.1.5Actively participate in sessions and work on agreed-upon actions, understanding that progress may take time and can be emotionally challenging.
4.1.6 Attend follow-up blood tests as needed for monitoring and safety.
4.1.7The Patient accepts that outcomes from treatment can vary in degrees of success, and that their desired outcomes might also change from when they initially engage with the GP Health Hub Ltd. GP Health Hub Ltd will perform the duties of engagement to a reasonable standard and endeavour to enable the Patient to make positive changes in their health behaviours, as well as offer medical advice and monitoring of the medical conditions agreed with the Patient. The Patient accepts that positive health behaviour changes and any resulting physical health improvement that are desired by the Patient and strived for by the GP Health Hub Ltd are not guaranteed. GP Health Hub Ltd will not be held responsible for lack of progress or negative changes, except for under circumstances considered by law to be medically negligent.
Each party shall comply with its data protection obligations set out in Schedule. GP Health Hub Limited will be using a system called Semble for operational activities and prescribing. Semble is a private practise software management company which is fully compliant with the UK GDPR and Data Protection Act 2018, with a registered Data Protection Officer (DPO).
6.1The GP Health Hub Ltd and its licensors shall retain ownership of all Intellectual Property Rights in the Deliverables, excluding any Patient Materials contained within them.
6.2The GP Health Hub Ltd receiving payment of all Charges attributable to the Contract the GP Health Hub Ltd grants to the Patient a non-exclusive, royalty-free, non-transferable, licence during the term of the Contract to use, copy and modify the Deliverables for the purpose of receiving and using the Services and Deliverables.
7.1In consideration for the provision of the Services, the Patient shall pay the GP Health Hub Ltd the Charges in accordance with Schedule 3.
7.2All sums payable by the Patient exclude amounts in respect of value added tax (VAT) if applicable. The Patient shall, on receipt of a valid VAT invoice from the GP Health Hub Ltd, pay to the GP Health Hub Ltd any additional amounts in respect of VAT if applicable as are chargeable on those sums.
7.3All sums payable must be paid prior to the treatment taking place.
7.4Without prejudice to any other right or remedy that the GP Health Hub Ltd may have, if the Patient fails to pay any sum due to the GP Health Hub Ltd under the Contract by the due date:
7.4.1the Patient shall pay interest on the overdue sum from the due date until payment of the overdue sum, whether before or after judgment. Interest under this clause will accrue each day at 4% a year above the Bank of England's base rate from time to time, but at 4% a year for any period when that base rate is below 0%; and
7.4.2the GP Health Hub Ltd may suspend all or part of the Services until payment has been made in full.
7.5All amounts due under the Contract from the Patient to the GP Health Hub Ltd shall be paid in full without any set-off, counterclaim, deduction or withholding (other than any deduction or withholding of tax as required by law).
7.6Payment Timing: Payments are due in accordance with the payment schedule specified within the client quotation and prior to any treatment.
7.7Payment Method: All payments to be made online via secure transfer to GP Health Hub Ltd.
7.8Confirmation: Treatment begins once GP Health Hub Ltd confirms receipt of payment.
7.9Late or Declined Payment: If payment fails or is delayed, GP Health Hub Ltd may postpone or cancel scheduled appointments until payment is received.
8.1The following definitions apply in this clause 8:
8.1.1contract year: each 12-month period starting on the Effective Date or an anniversary of it;
8.1.2default: any act or omission resulting in one party incurring liability to the other; and
8.1.3liability: every kind of liability arising under or in connection with the Contract including liability in contract, tort (including negligence) or otherwise.
8.2Nothing in the Contract limits or excludes:
8.2.1liability for deliberate default;
8.2.2liability for death or personal injury caused by negligence to the extent preserved by section 2(1) of the Unfair Contract Terms Act 1977;
8.2.3liability for fraud or fraudulent misrepresentation;
8.2.4liability for breach of the terms implied by section 2 of the Supply of Goods and Services Act 1982;
8.2.5any liability that cannot legally be limited;
8.2.6the Patient's liability for its payment obligations under the Contract;
8.3Subject to clause 8.2 the GP Health Hub Ltd's total liability:
8.3.1for breaches occurring in any contract year shall not exceed the amount of Professional Indemnity cover in place on behalf of the GP Health Hub Ltd in that contract year.
8.3.2and for all other loss or damage arising from defaults occurring within any contract year shall not exceed the amount of the Charges paid or payable to the GP Health Hub Ltd under the Contract in that contract year.
8.4Subject to clause 8.2 neither party shall have any liability for:
8.4.1loss of profits (including loss of anticipated savings);
8.4.2loss of business or business opportunity;
8.4.3loss of use or corruption of software, data or information;
8.4.4loss of or damage to goodwill; or
8.4.5indirect or consequential loss.
8.5Subject to clause 8.2 all conditions, warranties, representations or other terms that might otherwise be implied into this agreement by statute, common law or otherwise are excluded from the Contract.
9.1Without affecting any other right or remedy available to it, either party to the Contract may terminate it with immediate effect by notifying the other party if:
9.1.1the other party commits a material breach of any term of the Contract which :
9.1.1.1is not capable of remedy; or
9.1.1.2if capable of remedy, is not remedied within a period of 30 days by the other party after being notified to do so;
9.2Unilateral Termination: If the service is terminated due to irreconcilable differences, no refund will be offered.
9.3Decision to extend treatment will be discussed on an individual basis during the final review meeting of the treatment block.
9.4Any provision of the Contract that expressly or by implication is intended to come into or continue in force on or after termination of the Contract shall remain in full force and effect.
9.5Termination of the Contract shall not affect any of the rights, remedies, obligations or liabilities of the parties that have accrued up to the date of termination, including the right to claim damages in respect of any breach of the Contract which existed at or before the date of termination.
10.1Force majeure. Neither party shall be liable for any delay or failure in performing any of its obligations for so long as and to the extent that the delay or failure results from events, circumstances or causes beyond its reasonable control.
10.2Confidentiality.
10.2.1Each party undertakes that it shall not at any time disclose to any person any Confidential Information of the other party except as permitted by clause 10.2(b)
10.2.2Each party may disclose the other party's Confidential Information:
10.2.2.1to those of its [and its employees, officers, representatives, contractors, subcontractors or advisers who need to know that information for the purposes of exercising its rights or carrying out its obligations under the Contract (Representatives). Each party shall ensure that its Representatives comply with confidentiality obligations which are substantially equivalent to those set out in this clause 10.2 and
10.2.2.2as may be required by law, a court of competent jurisdiction or any governmental or regulatory authority.
10.2.3Neither party may use the other party's Confidential Information for any purpose other than to exercise its rights and perform its obligations under the Contract.
10.3Entire agreement.
10.3.1The Contract constitutes the entire agreement between the parties and supersedes and extinguishes all previous agreements, promises, assurances and understandings between them, whether written or oral, relating to its subject matter.
10.3.2Each party acknowledges that in entering into the Contract it does not rely on and shall have no remedies in respect of any statement, representation, assurance or warranty (whether made innocently or negligently) that is not set out in the Contract. Each party agrees that it shall have no claim for innocent or negligent misrepresentation or negligent misstatement based on any statement in the Contract.
10.4Variation. No variation of the Contract shall be effective unless it is in writing and signed by the parties (or their authorised representatives).
10.5Waiver.
10.5.1A waiver of any right or remedy is only effective if given in writing and shall not be deemed a waiver of any subsequent right or remedy.
10.5.2A delay or failure to exercise, or the single or partial exercise of, any right or remedy does not waive that or any other right or remedy, nor does it prevent or restrict the further exercise of that or any other right or remedy.
10.6Severance. If any provision or part-provision of the Contract is or becomes invalid, illegal or unenforceable, it shall be deemed deleted, but that shall not affect the validity and enforceability of the rest of the Contract.
10.7Third party rights.
10.7.1Unless it expressly states otherwise, the Contract does not give rise to any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of the Contract.
10.7.2The rights of the parties to rescind or vary the Contract are not subject to the consent of any other person.
10.8Governing law. The Contract, and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it or its subject matter or formation, shall be governed by and construed in accordance with the law of England and Wales.
10.9Jurisdiction. Each party irrevocably agrees that the courts of England and Wales shall have exclusive jurisdiction to settle any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with the Contract or its subject matter or formation.
This schedule is set out in full in our Men’s Health Medication Prescribing Policy.
This schedule is set out in full in our Weight Loss Medication Prescribing Policy.
This schedule is set out in full in our Pricing, Billing and Refund Policy.
Our standards and procedures for prescribing and handling medicines are set out in full in our Medicines Management Policy.
1.1Applicable Data Protection Laws: all Applicable Laws relating to the protection of personal data and the privacy of individuals, including the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426).
1.2Commissioner, controller, data subject, personal data, personal data breach, processor and processing: as defined in Applicable Data Protection Law.
1.3Patient Personal Data: any personal data which the GP Health Hub Ltd processes in connection with the Contract on behalf of the Patient in the capacity of a processor.
1.4Shared Personal Data: any personal data which the GP Health Hub Ltd receives from the Patient, or otherwise collects, in connection with the Contract and processes in the capacity of a controller.
1.5UK GDPR: has the meaning given in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.
GP Health Hub Limited will be using Semble for its operational and prescribing activities. Patient data will be stored in Semble system and Semble would be responsible for patient data security and privacy for the data stored in Semble. Please see the link to the Semble privacy policy. Privacy Policy
2.1Each party shall comply with all Applicable Data Protection Laws in its processing of personal data under or in connection with the Contract. This Schedule 2 is in addition to, and does not relieve, remove or replace, a party's obligations or rights under Applicable Data Protection Laws.
2.2Without prejudice to paragraph 2.1, the Patient shall ensure that it has all necessary consents and notices in place to enable the Shared Personal Data and Patient Personal Data to be lawfully transferred to or collected by the GP Health Hub Ltd, and further processed by the GP Health Hub Ltd, in connection with the performance of the Contract.
2.3The GP Health Hub Ltd, Semble and Patient shall act as independent controllers in respect of the following personal data and processing activities:
2.3.1The names and contact details of staff which are shared by the parties and processed for the purposes of contract management and maintaining a business relationship between them.
2.4In relation to the Patient Personal Data, the scope, nature, purpose and duration of processing by the GP Health Hub Ltd and the types of personal data and categories of data subject are set out Schedule 2 A “Data Retention Schedule”, Schedule 2 B “Data Protection Policy” and Schedule 2 C “Your Health Edit Privacy Notice” below.
2.5Without prejudice to paragraph 2.1 the GP Health Hub Ltd shall, in relation to Patient Personal Data:
2.5.1process that Patient Personal Data on the basis as set out in this Schedule 4 (Purpose), unless the GP Health Hub Ltd is required by Applicable Laws to otherwise process that Patient Personal Data. Where the GP Health Hub Ltd is relying on Applicable Laws as the basis for processing Patient Personal Data, the GP Health Hub Ltd shall notify the Patient of this before performing the processing unless prohibited from doing so by those Applicable Laws. If the GP Health Hub Ltd believes that any instruction received from the Patient is likely to infringe Applicable Data Protection Laws, the GP Health Hub Ltd shall inform the Patient and may suspend the provision of the Services until the parties have agreed revised instructions which are not infringing;
2.5.2ensure that it has in place appropriate technical and organisational measures to protect against unauthorised or unlawful processing of Patient Personal Data and against accidental loss or destruction of, or damage to, Patient Personal Data[. The Patient acknowledges that it has reviewed the technical and organisational measures set out in this Contract and confirms they are appropriate to the harm that might result from the unauthorised or unlawful processing or accidental loss or destruction of, or damage to, the Patient Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing of Patient Personal Data as well as the risks to individuals;
2.5.3subject to its duty that details of the Patients treatment are passed on to the Patient’s GP to ensure that any personnel engaged and authorised by the GP Health Hub Ltd to process Patient Personal Data are obliged to keep that personal data confidential;
2.5.4assist the Patient insofar as this is possible (taking into account the nature of the processing and the information available to the GP Health Hub Ltd), and at the Patient's cost and written request, in responding to any request from a data subject and in ensuring the Patient's compliance with its obligations under Applicable Data Protection Laws with respect to security, breach notifications, impact assessments and consultations with the Commissioner or other regulators;
2.5.5notify the Patient without undue delay on becoming aware of a personal data breach;
2.5.6at the written direction of the Patient, delete or return to the Patient all Patient Personal Data on termination of the Contract unless the GP Health Hub Ltd is required by Applicable Law to continue to process that Patient Personal Data. For the purposes of this paragraph 2.5(f) Patient Personal Data shall be considered deleted where it is put beyond further use by the GP Health Hub Ltd; and
2.5.7make available information to the Patient to demonstrate its compliance with this Contract.
2.6The Patient provides its prior, general authorisation for the GP Health Hub Ltd to:
2.6.1appoint processors to process the Patient Personal Data, provided that the GP Health Hub Ltd:
2.6.1.1ensures that the terms on which it appoints any processor comply with Applicable Data Protection Laws and are consistent with the obligations imposed on the GP Health Hub Ltd in this Contract.
2.6.1.2remains responsible for the acts and omissions of any processor as if they were the acts and omissions of the GP Health Hub Ltd; and
2.6.1.3informs the Patient of any intended changes concerning the addition or replacement of processors after the Effective Date, giving the Patient the opportunity to object to changes provided that if the Patient objects to a change and cannot demonstrate, to the GP Health Hub Ltd's reasonable satisfaction, that the objection is due to an actual or likely breach of Applicable Data Protection Law, the Patient shall indemnify the GP Health Hub Ltd for any Losses incurred by the GP Health Hub Ltd in accommodating the objection.
2.6.2transfer Patient Personal Data outside of the UK as required for the Purpose, provided that the GP Health Hub Ltd shall ensure that all transfers are affected in accordance with Applicable Data Protection Laws. For these purposes, the Patient shall promptly comply with any reasonable request of the GP Health Hub Ltd, including any request to enter into standard data protection clauses adopted by the Commissioner (where the UK GDPR applies to the transfer) or any other applicable data protection regulator.
2.7The processors engaged by the GP Health Hub Ltd at the Effective Date are
(i) in respect of blood tests Healthy Human Labs trading as Vitall
2.8 (ii) in respect of the issuing of prescriptions Coud Rx operated by Vulcan Two Ltd
Organisation Name: GP Health Hub Ltd
Data Management Lead: Wewage Anthony Dep
Date Created: 05/08/2026
Review Date: 05/08/2027
| Record Type | Retention Period | Legal/Regulatory Basis |
|---|---|---|
| Adult patient medical records | 8 years after last contact | NHS Code of Practice; BMA guidance |
| Deceased patient records | 8 years after death | NHS Code of Practice |
| Prescriptions and medication records | 8 years | Clinical relevance; aligns with medical record retention |
| Blood test results | 8 years | Stored as part of clinical record |
| Appointment logs | 2 years | Operational use; not clinically sensitive |
| Patient consent forms | 8 years or as long as relevant | ICO guidance; linked to clinical record |
| Complaints and incident reports | 10 years | Legal risk management; NHS guidance |
| Staff employment records | 6 years after employment ends | Limitation Act 1980; HMRC requirements |
| Safeguarding records | 100 years or indefinitely | NHS guidance; due to potential future relevance |
| Financial records (invoices, billing) | 6 years | HMRC requirements |
| Marketing communications consent | Until consent is withdrawn or 2 years | ICO guidance; reviewed regularly |
Key Notes:
Review Periods: All records should be reviewed periodically (e.g., annually) to ensure they are still needed.
Secure Disposal: When retention periods expire, data must be securely deleted or destroyed (e.g., certified shredding, secure digital erasure).
Anonymisation: Where possible, data may be anonymised for research or audit purposes beyond the retention period.
Documentation: Keep a log of disposed records, including date and method of disposal.
Organisation Name: GP Health Hub Ltd
Policy Lead: Wewage Anthony Dep
Date Created: 05/08/2026
Review Date: 05/08/2027
Purpose
This protocol outlines how GP Health Hub Ltd ensures the lawful, fair, and transparent processing of personal data, particularly special category data related to health, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Scope
This protocol applies to all employees who handle personal data on behalf of GP Health Hub Ltd. It covers data collection, storage, access, sharing, and disposal.
Data Categories Processed
Personal Data: Name, address, date of birth, contact details
Special Category Data: Medical history, demographics, clinical notes, test results, prescriptions – please see our Privacy Policy for detailed information
Other: Appointment records, billing information
Legal Basis for Processing
We process personal data under the following legal bases:
Consent: For services or communications
Contract: To deliver medical services to patients
Legal Obligation: Compliance with regulatory requirements
Vital Interests: In emergency medical situations
Public Task: Where applicable for safeguarding purposes
Special Category Data: Processed under Article 9(2)(h) – provision of health care
Third-Party Data Processors
We engage third-party processors for:
Clinical note storage
Blood test requests
Prescription issuance
Each processor is vetted and bound by a Data Processing Agreement (DPA) for their service.
Data Security Measures
Encryption: All data stored and transmitted is encrypted
Access Controls: Role-based access, strong, multi-factor authentication, audit trails
Physical Security: Secure premises, locked filing systems and use of safe
Regular Audits: Internal and external reviews of data handling practices annually or when any significant event is raised
Staff Training: Mandatory GDPR and data protection training for all staff
Data Sharing
Data is only shared:
With patient consent
With authorised healthcare providers
As required by law or regulatory bodies
Under strict data sharing agreements
Data Retention & Disposal
Clinical records are retained in accordance with our data retention schedule
Data is securely deleted or anonymised when no longer required
Disposal of physical records is done via certified shredding services
Data Breach Protocol
In the event of a data breach:
The Data Protection Lead is notified immediately
A breach assessment is conducted within 72 hours
The ICO and affected individuals are informed if required
Remedial actions are documented and implemented
Data Subject Rights
Patients have the right to:
Access their data
Rectify inaccuracies
Erase data (where applicable)
Restrict or object to processing
Data portability
Lodge complaints with the ICO
Requests are handled within one calendar month, free of charge unless manifestly unfounded or excessive.
Registered name: GP Health Hub Ltd
We are the controller of your personal data. For more information on controllers and their responsibilities please see our guidance on data protection principles, definitions, and key terms.
This privacy notice tells you what to expect us to do with your personal information.
Contact details
What information we collect, use, and why
Lawful bases and data protection rights
Where we get personal information from
How long we keep information
Who we share information with
How to complain
Contact details
Post – GP Health-Hub Private Limited, 5 Brayford Square, London. E1 OSG
Email – office@gphealthhub.com
What information we collect, use, and why
We collect or use the following information to provide patient care, services, pharmaceutical products and other goods:
Name, address and contact details
Gender
Pronoun preferences
Date of birth
NHS/HSC/CHI number
Next of Kin details including any support networks
Emergency contact details
Health information (including medical conditions, allergies, medical requirements and medical history)
Information about care needs (including disabilities, home conditions, medication and dietary requirements and general care provisions)
Test results (including psychological evaluations, scans, bloods, x-rays, tissue tests and genetic tests)
Payment details (including card or bank information for transfers and direct debits)
Records of meetings and decisions
Call recordings
We also collect the following special category information to provide patient care, services, pharmaceutical products and other goods. This information is subject to additional protection due to its sensitive nature:
Racial or ethnic origin
Religious or philosophical beliefs
Health information
Sex life information
Sexual orientation information
We collect or use the following information for safeguarding or public protection reasons:
Name, address and contact details
NHS/HSC/CHI number
Health information (including medical conditions, allergies, medical requirements and medical history)
Information about care needs (including disabilities, home conditions, dietary requirements and general care provisions)
Records of meetings and decisions
We also collect the following special category information for safeguarding or public protection reasons. This information is subject to additional protection due to its sensitive nature:
Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Health information
Sexual orientation information
We collect or use the following personal information for patient app or portal functionality:
Names and contact details
Medical history
Payment details
Account information, including registration details
Information used for security purposes
Marketing preferences
We also collect the following special category information for patient app or portal functionality.
This information is subject to additional protection due to its sensitive nature:
Health information
We collect or use the following personal information to comply with legal requirements:
Name
Contact information
Health and safety information
Any other personal information required to comply with legal obligations
Safeguarding information
We also collect the following special category information to comply with legal requirements. This information is subject to additional protection due to its sensitive nature:
Health information
We collect or use the following personal information for information updates, marketing or market research purposes:
Names and contact details
Addresses
Marketing preferences
Website and app user journey information
Personal information used for administration of the research
Personal information used for the purpose of research
Personal information used for medical investigations
Records of consent, where appropriate
We also collect the following special category information for information updates, marketing or market research purposes. This information is subject to additional protection due to its sensitive nature:
Health information
We collect or use the following personal information for dealing with queries, complaints or claims:
Names and contact details
Addresses
Account information
Purchase or service history
Call recordings
Relevant information from previous investigations
Customer or client accounts and records
Financial transaction information
Information relating to health and safety (including incident investigation details and reports and accident book records)
Correspondence
We also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:
Health information
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure - You have the right to ask us to delete your personal information.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information.
Your right to object to processing - You have the right to object to the processing of your personal data.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide patient care, services, pharmaceutical products and other goods are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Legitimate interests - we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
Collecting data to ensure that quality of care and quality of outcomes can be reviewed and the services offered adapted and clarified for the client and future clients, with the aim to improve the standard of care and successful outcomes for clients.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Our lawful bases for collecting or using personal information for safeguarding or public protection reasons are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Our lawful bases for collecting or using personal information for patient app or portal functionality are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
GP Health Hub Ltd collects this information so that quality of care and quality of outcomes can be reviewed and the services offered adapted and clarified for the client and future clients, with the aim to improve the standard of care and successful outcomes for clients.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Our lawful bases for collecting or using personal information to comply with legal requirements are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Vital interests – collecting or using the information is needed when someone’s physical or mental health or wellbeing is at urgent or serious risk. This includes an urgent need for life sustaining food, water, clothing or shelter. All of your data protection rights may apply, except the right to object and the right to portability.
Our lawful bases for collecting or using personal information for information updates, marketing or market research purposes are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Where we get personal information from
Directly from you
Other health and care providers
Client\'s other doctors e.g. GP or consultant
Allied Health Professionals providing care to the client
How long we keep information
| Record Type | Retention Period | Legal/Regulatory Basis |
|---|---|---|
| Adult patient medical records | 8 years after last contact | NHS Code of Practice; BMA guidance |
| Deceased patient records | 8 years after death | NHS Code of Practice |
| Prescriptions and medication records | 8 years | Clinical relevance; aligns with medical record retention |
| Blood test results | 8 years | Stored as part of clinical record |
| Appointment logs | 2 years | Operational use; not clinically sensitive |
| Patient consent forms | 8 years or as long as relevant | ICO guidance; linked to clinical record |
| Complaints and incident reports | 10 years | Legal risk management; NHS guidance |
| Staff employment records | 6 years after employment ends | Limitation Act 1980; HMRC requirements |
| Safeguarding records | 100 years or indefinitely | NHS guidance; due to potential future relevance |
| Financial records (invoices, billing) | 6 years | HMRC requirements |
| Marketing communications consent | Until consent is withdrawn or 2 years | ICO guidance; reviewed regularly |
For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.
Who we share information with
Other health providers (eg GPs and consultants)
Organisations we need to share information with for safeguarding reasons
Organisations we’re legally obliged to share personal information with
0.1Suppliers and service providers (including The processors engaged by the GP Health Hub Ltd at the Effective Date are in respect of blood tests Healthy Human Labs trading as Vitall and in respect of the issuing of prescriptions Coud Rx operated by Vulcan Two Ltd
Duty of confidentiality
We are subject to a common law duty of confidentiality. However, there are circumstances where we will share relevant health and care information. These are where:
you’ve provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses);
we have a legal requirement (including court orders) to collect, share or use the data; on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime);
If in England or Wales – the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied; or
If in Scotland – we have the authority to share provided by the Chief Medical Officer for Scotland, the Chief Executive of NHS Scotland, the Public Benefit and Privacy Panel for Health and Social Care or other similar governance and scrutiny process.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane Wilmslow
Cheshire SK9 5AF
Helpline number: 0303 123 1113
GP Health Hub will transform your healthcare experience with GP led remote consultations.
