Privacy Notice & Cookie Policy

GGO Med is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Notice explains how we collect, use, and protect your data when you use our website and services.

1. Data Controller

The data controller responsible for your personal information is:

2. Information We Collect

2.1 Personal Information You Provide

When you use our services, we may collect:

• • Name and contact details (email, phone number, address)
• • Medical information relevant to your consultation or treatment
• • Appointment booking details and communication preferences
• • Payment and billing information (processed securely by our payment providers)
• • Audio recordings of your consultation and the transcripts produced from them (see section 2.3)

2.2 Information Collected Automatically

When you visit our website, we may collect:

• • Browser type, device information, and operating system
• • IP address and general location information
• • Pages visited, time spent on pages, and navigation patterns
• • Referring website or source

2.3 Consultation Recording

Consultations are recorded by default. The recording is made through the ambient scribe built into Carebit, the system that holds your clinical record, and is used to produce a transcript of the consultation and to draft the clinical note and any correspondence arising from it. The recording and the transcript form part of your clinical record and are retained on the same basis as the rest of it (see section 8).

You may decline, and you do not need to give a reason. Tell Mr Ollandini or the secretary at any point — before the consultation or during it — and the recording is switched off. Declining is noted in your record and has no effect whatsoever on the care you receive.

To be clear about what declining does and does not do: we do not rely on your consent as the lawful basis for recording, so this is not a consent you are giving or withdrawing. It is a choice we offer as a matter of practice. Declining stops any further recording. Recordings and transcripts already made remain part of your clinical record and are retained on the same basis as the rest of it, because we are obliged to keep an accurate and complete record of your care. Your rights over that record, including the right to request access, correction or erasure, are set out in section 9 and apply to recordings and transcripts exactly as they apply to anything else in your notes.

Carebit processes this audio as our data processor under a written data processing agreement. Carebit provides its own privacy information covering that processing, which you receive and accept when you book; a copy is available from us on request.

3. How We Use Your Information

We use your personal information for the following purposes:

• • Healthcare Services: To provide medical consultations, treatments, and follow-up care
• • Communication: To respond to your inquiries and provide appointment reminders
• • Administration: To manage bookings, billing, and medical records
• • Legal Compliance: To comply with medical regulations and legal obligations
• • Website Improvement: To improve our website functionality and user experience

4. Legal Basis for Processing

Under the UK GDPR, we process your data based on the following legal grounds:

• • Consent: You have given explicit consent for specific purposes
• • Contract: Processing is necessary to fulfil our contract with you
• • Legal Obligation: We are required by law to process your data
• • Legitimate Interests: Processing is necessary for our legitimate business interests

Special category (health) data: information about your health — including clinical notes, correspondence, images and consultation recordings — is processed under Article 9(2)(h) of the UK GDPR, for the provision of health care and treatment, in addition to the grounds above. Everyone involved in your care works under a duty of confidentiality.

5. Cookie Policy

Our website uses cookies to enhance your browsing experience and understand how visitors use our site.

5.1 What Are Cookies?

Cookies are small text files stored on your device when you visit websites. They help websites remember your preferences and improve functionality.

5.2 Types of Cookies We Use

5.3 Managing Cookies

You can manage your cookie preferences at any time through our cookie consent banner. You can also configure your browser to refuse cookies, though this may affect website functionality.

6. Data Sharing and Disclosure

We may share your information with:

• • Healthcare Providers: Other medical professionals involved in your care (with your consent)
• • Service Providers: Third-party services that support our operations (e.g., appointment booking, payment processing)
• • Legal Authorities: When required by law or to protect vital interests

Clinical and practice systems: your clinical record — including notes, correspondence, invoices, images and consultation recordings — is hosted in our practice management system, Carebit, which processes that information on our instructions under a written data processing agreement. Electronic private prescriptions are transmitted through Clynxx; laboratory requests and results are handled by The Doctors Laboratory; and digital consent for procedures is taken through Concentric at the treating hospital. Each of these providers publishes its own privacy information, and we can point you to it on request.

We do not sell or rent your personal information to third parties.

6.1 Transfers Outside the United Kingdom

Your clinical record is held in the United Kingdom. Our practice management system, Carebit, hosts data in UK data centres.

One routine exception is worth spelling out. Electronic private prescriptions issued through Clynxx can be dispensed at any pharmacy in the United Kingdom or the European Union. If you choose to dispense a prescription at a pharmacy in the EU, the information contained in that prescription necessarily travels with it to that pharmacy. That is a consequence of your choice of pharmacy rather than a routine transfer we make on our own initiative, and you can avoid it entirely by dispensing in the UK.

Where any of our providers processes personal data outside the United Kingdom, we require that the transfer is covered either by UK adequacy regulations or by appropriate safeguards under Article 46 of the UK GDPR, such as the International Data Transfer Agreement or the UK Addendum to the standard contractual clauses. We can tell you which applies to a particular provider on request.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, loss, or misuse. This includes:

• • Secure encrypted connections (HTTPS)
• • Access controls and authentication
• • Regular security assessments
• • Staff training on data protection

8. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law. Medical records are retained in accordance with NHS and GMC guidelines (typically a minimum of 8 years for adults, or until the patient's 25th birthday for paediatric records).

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• • Right to Access: Request a copy of your personal data
• • Right to Rectification: Request correction of inaccurate data
• • Right to Erasure: Request deletion of your data (subject to legal requirements)
• • Right to Restriction: Request limitation of processing
• • Right to Data Portability: Receive your data in a structured format
• • Right to Object: Object to processing based on legitimate interests
• • Right to Withdraw Consent: Withdraw consent at any time

To exercise any of these rights, please contact us at mrollandinisecretary@ggomed.co.uk

10. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party websites you visit.

11. Children's Privacy

Our services are not directed to individuals under the age of 18. For paediatric patients, parental or guardian consent is required for processing personal information.

12. Changes to This Policy

We may update this Privacy Notice from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

13. Contact Us and Complaints

If you have any questions or concerns about this Privacy Notice or our data practices, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):