PRIVACY POLICY

This page constitutes our privacy notice, and explains how we look after your personal information. We kindly request that you read this notice carefully.

1. This document explains how Wessex Private General Practice Limited (hereafter referred to as ‘WPGP’, ‘we’ or ‘us’) manages your personal information. We are dedicated to protecting your privacy and the information you share with us. You may receive additional privacy notices when sharing specific information with us, this is designed to supplement these, not supplant them.

2. For the purpose of this notice, The terms ‘personal information’ and ‘personal data’ are considered equivalent and may be used interchangeably.

About Wessex Private GP

3. We are a limited company, registered in England and Wales (company number 09719337, ICO Registration number: ZB381277). Our registered address is 5th Floor 25 King Street, Bristol, United Kingdom, BS1 4PB. We are a data controller, responsible for determining how your personal information is obtained, stored, and used.

4. We recognise the utmost importance of the confidentiality of your medical information and adhere strictly to UK data protection law (Data Protection Act 2018) and professional guidelines from (but not limited to) the General Medical Council and British Medical Association.

Scope of This Notice

5. This Privacy Notice applies to everyone who receives healthcare services from WPGP, regardless of how you interact with us (in person, via email, through our website, by phone, etc.).

6. It also applies to anyone who shares personal information with us via this website.

What Personal Information We Collect

7. The personal information we collect may include basic information such as:

Name, address, date of birth, and contact details
Emergency contact details (including next of kin)
Financial information (including credit card details)
Occupation

8. We also collect sensitive personal information (special category data) related to your physical and mental health such as:

Details of your current or former physical or mental health, including past and planned healthcare services from us and other providers (GPs, dentists, hospitals, clinics both private and NHS, both national and international)
Details of care you have received from us, including any images taken or shared
Nationality, race, and/or ethnicity
Religion
Examination/test results, including genetic or biometric data
Data concerning sex life and/or sexual orientation

Other People’s Personal Information

9. If you provide personal information about another person, please ensure you inform them of this privacy notice.

Why We Process Your Personal Information

10. We process your personal information with the following justifications:

Contract: to provide healthcare and services as agreed with you.
Legitimate interests: for quality assurance, record maintenance, service improvement, and medical research.
Legal obligation: to comply with relevant regulations.
Legal claims: to establish, exercise, or defend legal claims.
Consent: in accordance with your explicit consent (e.g. for marketing). You may withdraw your consent at any time, however this will not change any of the other justifications explained above regarding why we process your personal information.

How We Process Your Personal Information

11. Processing your information involves collecting, changing, storing, retaining, and sharing it,

12. Collecting: We may collect your personal information from a number of sources. This will always be in accordance with the justifications explained in paragraph 10.

Directly from you: you may give us data when you enter into a contract, use our services, have consultations, complete forms, send inquiries, correspond with us (whether electronically or otherwise), call us (calls may be recorded), or choose to participate in marketing activities. Information may also be shared without your explicit intent, simply by visiting our website, however in general this will be aggregate data which cannot be used to identify you, and as such is not regarded as personal information. Please see paragraph 21 for more explanation.
From other healthcare providers: we may collect data from any organization involved in your care, such as your NHS GP, hospitals or clinics (private or NHS). This information may include (but not be limited to) consultation notes, examination or test results, diagnoses, and treatments (including medications).
From other third parties: we may collect data from third parties if required to fulfill justifications explained in paragraph 10 these may include (but not be limited to): your next of kin / emergency contacts, employers, local authorities, educational providers, solicitors, insurance providers, credit reference agencies, debt collection agencies, and government agencies.

13. Changing: we will update our systems with changes to your personal information as advised by you, or any of the sources listed in paragraph 12, but will generally also maintain a record of the originally submitted information.

14. Storing: we have security measures designed to protect the information we store, and prevent accidental loss, unauthorised access, alteration or disclosure

15. Retaining: we retain your personal information only for as long as necessary to fulfill the justifications explained in paragraph 10. When it is no longer needed, we securely destroy it.

16. Sharing: we may share your personal information with necessary third parties. The nature and extent of any information shared will be limited to what is required to satisfy the justifications explained in paragraph 10 and the role of the third party in said justificationt. We may share your personal information with:

Healthcare providers and professionals (e.g. when making referrals)
Medical service providers (e.g. when arranging investigations)
Delivery services (e.g. if we need to send something to your home – like a test kit)
Employers
Regulators/safeguarding authorities/commissioners
Law enforcement
IT service providers
Legal representatives
Emergency contacts
Insurance companies
Internal employees
New business owners in the event of a sale

International transfers

17. Your personal information is not shared outside of the EEA.

Communication

18. We may communicate with you via:

Post
Telephone (where voice messages may be left)
SMS
Email
Other online communication methods such as social media messaging or apps

19. Messages we send will be in pursuit of the justifications explained in paragraph 10 and may take the form of (but not be limited to):

Updates and reminders for appointments
Invoicing information
Information relevant to your healthcare (e.g. test results)
Patient surveys (as explained in paragraph 20)
Marketing (if you have specifically consented to this)

Patient Surveys, Audits, and Initiatives

20. We may invite you to participate in surveys to help improve our services. These surveys are not for marketing purposes, and your participation is entirely voluntary, you can opt out at any point.

Aggregate Data:

21. Aggregate data is derived from your personal information but is not considered personal information in law as it cannot be used to identify you. This is because in creating aggregate data, the separate elements of your personal information are split up and then combined (or aggregated) with the same elements from other people. Aggregate data is used to analyse trends and can be useful in planning service provision or marketing activities. Examples of aggregate data would be demographic groups. If aggregate data is transformed such that you can once again be identified from it, we process it in line with this privacy policy.

Data Breaches

22. A ‘data breach’ can be broadly defined as a security incident that has affected the confidentiality, integrity or availability of personal data. As explained in paragraph 14, we have security measures in place to protect your personal information. Should a data breach occur, we will notify you and any applicable regulator (e.g. the ICO) where we are legally required to do so.

Your Rights

23. You have the right to:

Know if we hold or use your personal information, and how we do so
Request access to the personal information we hold
Get your personal information in a way that is accessible
Challenge the accuracy of our record of your personal information
Request that we remove your personal information from our records
Object to us processing your personal information
Limit how we use your personal information in certain circumstances
Prevent automated processing of your personal information in certain circumstances
Withdraw consent to the processing of your data
Make a data protection complaint, as explained in paragraphs 27 to 29

24. You may exercise your rights at any time by contacting our Data Protection Officer (DPO) with any requests (contact details are found in paragraph 31). We will respond to your requests in writing. If you have corresponded with us electronically we will seek to continue with our response electronically where possible.

25. We will respond to your request in line with time limits set by applicable regulators, for simple requests this limit is a month, but may increase to three months for complex requests. If we require information from you in order to process your request (such as ID), the time limit will begin once we have received this.

26. Generally, we will not charge you to meet a request; however we may charge, or alternatively may reasonably refuse a request, completely or in part, under certain circumstances. If this is the case we will always explain why. Reasons may include:

A large number of requests
Unreasonable requests
Requests involving another person’s information
Requests which put us in breach of applicable law or regulation
Requests which contradict justifications set out in paragraph 10 (e.g. asking us to remove your personal information while we are still providing medical care as per contract)
Requests which affect our ability to exercise or defend legal claims

Making a Data Protection Complaint

27. You can make a complaint to us, if you think we have not processed your personal information responsibly and in line with good practice. Complaints should be made in writing, to our DPO using the contact details in paragraph 31. Email is preferred.

28. We will respond within the timeframes explained in paragraph 24.

29. If we do not respond to you, you can complain to the ICO (Information Commissioner’s Office), which is the UK’s independent regulator for data protection and information rights law (ico.org.uk); however we would appreciate the chance to help you with your complaint first.

External Websites

30. Our website may link to other, external sites. We are not responsible for the privacy policies of linked external websites. Therefore, please make sure to read any relevant privacy policies before using these sites.

Our Data Protection Officer

31. Our Data Protection Officer (DPO) is Dr. Charles Middle. You can contact him at:

Email: charlie@wessexprivategp.co.uk
Postal address:

Data Protection Officer

The Poundbury Clinic

Middlemarsh Street

Poundbury

Dorchester

DT1 3FD

Updates to This Privacy Notice

32. This notice may be updated periodically to ensure it remains accurate. Last updated: 5th June 2025.