Privacy Policy

1. Who We Are

Cha2GP Ltd is a private GP telehealth service providing virtual healthcare consultations to patients across the United Kingdom. We are the data controller for your personal information, meaning we determine how and why your data is processed.

We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. All our doctors maintain active registration with the General Medical Council (GMC), and our services comply with Care Quality Commission (CQC) standards.

2. Information We Collect

We collect different categories of personal data depending on how you interact with our services:

Personal Details

• Full name, date of birth, and gender
• Email address, telephone number, and postal address
• Emergency contact details (where relevant to care)

Health & Medical Information

• Medical history, current symptoms, and diagnoses
• Consultation recordings, clinical notes, and treatment plans
• Prescription records and medication history
• Allergy and adverse reaction information

Payment Information

• Billing details and transaction records
• Payment card details are processed securely by our payment provider - we do not store full card numbers

Website Usage Data

• IP address, browser type, and device information
• Pages visited and time spent on site
• Cookies and similar tracking technologies

3. How We Use Your Information

We use your personal data for the following purposes:

• Medical consultations: Providing video consultations, diagnosing conditions, and recommending treatment based on your medical history.
• Prescriptions & fit notes: Issuing private prescriptions, fit notes, and medical letters as part of your care.
• Specialist referrals: Writing referral letters and sharing relevant clinical information with specialists you are referred to.
• Appointment management: Sending booking confirmations, appointment reminders, and follow-up communications.
• Service improvement: Analysing usage patterns to improve our services, website, and patient experience.
• Legal obligations: Maintaining records as required by the GMC, CQC, and other regulatory bodies.

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

• Consent: For marketing communications, analytics cookies, and non-essential data collection. You may withdraw consent at any time.
• Legitimate interest: To improve our services, maintain website security, prevent fraud, and respond to enquiries.
• Legal obligation: To comply with healthcare regulations, GMC requirements, CQC standards, and tax obligations.
• Vital interests: In emergency situations where processing is necessary to protect someone's life.

5. How We Share Your Information

We may share your personal data with the following categories of recipients, only where necessary and with appropriate safeguards:

• Pharmacies: For dispensing prescriptions issued during your consultation.
• Specialists: For referrals, where you have been referred for further treatment.
• Regulatory bodies: The General Medical Council (GMC) and Care Quality Commission (CQC) as required by law.
• Payment processors: For processing card transactions securely. We do not store full card details.

We never sell your personal data to third parties. We do not share your data for third-party marketing without your explicit consent.

6. Data Security

We take the security of your personal data seriously and implement appropriate measures to protect it:

• End-to-end encrypted video consultations
• Secure, encrypted storage for all health records
• Strict access controls - only authorised clinicians can access patient data
• Regular staff training on data protection and information security
• Regular security audits and vulnerability assessments

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete personal data.
• Right to erasure: Request deletion of your data where there is no compelling reason to continue processing.
• Right to restrict processing: Request restriction of processing while we verify accuracy or assess an objection.
• Right to data portability: Receive your data in a structured, machine-readable format for transfer to another provider.
• Right to object: Object to processing based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@cha2gp.co.uk. We will respond within one calendar month.

8. Cookies

Our website uses cookies to improve your experience and analyse usage. We use the following types of cookies:

• Necessary cookies: Required for the website to function properly. These cannot be disabled.
• Analytics cookies: Help us understand how visitors use our website so we can improve it. These are only set with your consent.

You can manage your cookie preferences through your browser settings at any time.

9. Data Retention

We retain your personal data only for as long as necessary for the purposes set out in this policy, or as required by law:

• Medical records: Retained for 10 years from the date of last consultation, in line with NHS records management guidelines.
• Financial records: 7 years as required by HMRC.
• Website analytics data: Deleted after 26 months.
• Marketing consent records: Until you withdraw consent, then deleted within 30 days.

10. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or regulatory guidance. We will notify you of material changes by posting a prominent notice on our website and updating the "Last updated" date at the top of this page.

We recommend reviewing this policy periodically. Continued use of our website and services after changes are posted constitutes acceptance of the revised policy.

11. Contact Us

If you have any questions about this privacy policy, wish to exercise your data rights, or want to raise a concern about how we handle your data: