Last updated: 11 November 2026
1. Who we are
Concierge Medical is a private, membership-based GP practice. This notice explains how we use the personal and health information of our members, one-off patients, and anyone who contacts us about joining.
The data controller is Concierge Medical Practice Limited, company number 08387668, registered office Lynley House, Moreton Paddox, Moreton Morrell, Warwick, CV35 9BU. We are registered with the Information Commissioner’s Office (ICO) under registration number ZA008093, and with the Care Quality Commission (CQC).
Our data protection lead is Priyen Logeswaran, Director. You can contact him at info@conciergemedical.co.uk, by phone on 01451 600900, or by post to Units 3-4, Lowes Lane Business Park, Lowes Lane, Wellesbourne, Warwick, CV35 9RB.
This notice covers your care with us. How we use information collected through our website (contact forms, cookies and analytics) is covered by our website Privacy Policy and Cookie Policy.
2. What information we hold
About you: name, date of birth, address, phone number, email, emergency contacts, NHS number, the name of your NHS GP, and who else is in your membership household.
About your health (special category data): your medical history, consultation notes, diagnoses, prescriptions and medicines, test and screening results, vaccinations, referral letters and reports from specialists, and records your NHS GP shares with us.
About your membership: your membership type, start date, payment details and billing history, and records of your contact with us (calls, emails and messages).
We hold the same kinds of information, where relevant, for children registered under a parent’s membership.
3. Where we get your information
Most information comes from you, when you enquire, register, or speak to your doctor. We also receive it from:
- your NHS GP, when you consent to us requesting your medical records
- laboratories, with your test results
- hospitals, consultants and other clinicians involved in your care
- a family member or carer, where you’ve asked them to act for you
4. How we use your information, and our lawful basis
UK data protection law requires a lawful basis for each use. Health information also needs an additional condition under Article 9 of the UK GDPR.
| What we use it for | Lawful basis (Article 6) | Health data condition (Article 9) |
|---|---|---|
| Providing your medical care: consultations, prescriptions, tests, referrals, follow-up | Contract (6(1)(b)) | Provision of health care (9(2)(h)), with the Data Protection Act 2018, Schedule 1, paragraph 2 |
| Running your membership: registration, billing, payments, service messages | Contract (6(1)(b)) | Not usually needed; where health details are involved, 9(2)(h) |
| Keeping clinical records and meeting CQC, GMC and tax requirements | Legal obligation (6(1)(c)) | Provision of health care (9(2)(h)) |
| Protecting you in an emergency when you can’t consent | Vital interests (6(1)(d)) | Vital interests (9(2)(c)) |
| Clinical audit, safety checks and improving our service | Legitimate interests (6(1)(f)) | Provision of health care (9(2)(h)) |
| Handling complaints and legal claims | Legitimate interests (6(1)(f)) | Legal claims (9(2)(f)) |
| Marketing and newsletters | Consent (6(1)(a)), or legitimate interests for existing members where the law allows | Not applicable |
We don’t rely on your consent to provide medical care, but your doctor will always discuss treatment, tests and referrals with you before going ahead.
5. Who we share your information with
We only share what each recipient needs. We never sell your information. Depending on your care, we may share your information with:
- healthcare professionals involved in your care, such as your NHS GP, consultants, hospitals and community services
- laboratories that process your tests
- pharmacies that dispense your prescriptions
- your private medical insurer, where you ask us to deal with them
- IT and clinical system providers that host and support our systems
- payment processors that handle membership fees
- professional advisers, such as our lawyers, accountants and insurers
- regulators and authorities, such as the CQC, GMC, police or courts, where the law requires it or to protect someone from serious harm, following General Medical Council confidentiality guidance
We share major diagnoses with your NHS GP by default, to keep your NHS record complete. You can ask us to share more or less. Organisations that process data on our behalf do so under written contracts that require them to keep it secure and use it only on our instructions. We will only share information with your family, carers or employer with your permission.
6. Where your information is stored
Your medical records are held on our clinical system, which is hosted on secure servers in the UK. Some of our service providers may process limited information in the European Economic Area. Where this happens, appropriate safeguards are in place, such as UK adequacy regulations or approved data transfer agreements. You can ask us for details of these safeguards.
7. How long we keep your information
| Information | How long we keep it |
|---|---|
| Medical records | For your lifetime and 10 years after death, including if you leave the practice. This follows the NHS Records Management Code of Practice for GP records. |
| Billing and account records | 6 years after the end of the financial year they relate to |
| Marketing preferences | Until you unsubscribe or ask us to delete them. We keep a minimal record of your opt-out so we don’t contact you again. |
| Website enquiry forms | Deleted 30 days after submission, unless you become a member, in which case the information is transferred to your medical record |
8. Marketing and service messages
We’ll send you messages you need as a member, such as appointment details, results, billing and changes to your membership. These aren’t marketing.
You can opt out of marketing at any time by using the unsubscribe link in any email, or by contacting us. Opting out won’t affect your care.
9. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the right to:
- access your information, including a copy of your medical record (we’ll respond within one month, free of charge in most cases)
- correct information that is inaccurate or incomplete
- object to, or ask us to restrict, how we use your information
- ask us to delete information, although we usually can’t delete medical records before the end of the retention period, because we need them to provide safe care and meet legal requirements
- move information you gave us to another provider
- withdraw consent where we rely on it, such as for marketing
To use any of these rights, contact our data protection lead using the details in section 1.
If you’re unhappy with how we’ve handled your information, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
10. Keeping your information secure, and changes to this notice
Your records are held on secure clinical systems with access limited to staff who need it for your care or for running the practice. All our staff are bound by confidentiality, and our doctors follow General Medical Council guidance.
We review this notice regularly. If we make significant changes, we’ll tell members by email.