Privacy and Cookies Notice

Part A explains what we do with your personal information. Part B explains cookies and similar technologies. Where Part A refers to the Cookie Notice, it means Part B.

Part A — Privacy Notice

At a glance

Two organisations handle your information, and they do different things with it.

If you only read one thing: your health information does not go to advertisers. Section 5 explains how we make sure of that.

1. Who we are

1.1Doctor UK Health Ltd, trading as Doctor.uk, company number 17442409, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, ICO registration ZC257940, is the controller for the website, marketing and your account. Contact: hello@doctor.uk.

1.2Archvale Partnership is the controller for everything clinical. Its ICO registration is ZB810572 and it has appointed an external data protection officer, Regulatory Solution Ltd. You can reach them at hello@doctor.uk. Its full details are in the provider details panel on your documents and in the Participating Providers Register.

1.2AWhere more than one provider participates in doctor.uk, your own Treating Provider is the controller for your clinical information and its registration and data protection contact are shown in the provider details panel on the documents it issues to you.

1.3These are separate organisations with separate responsibilities. Neither answers for the other.

2. What Doctor UK Health does with your information

2.1 Before you start the health assessment

When you browse doctor.uk, Doctor UK Health may collect your device and browser information, your IP address, the page you came from, campaign information showing how you reached us, and how you move around the site. With your consent, some of this is used for advertising and analytics.

If you give us your details to hear more, Doctor UK Health uses them to send you marketing by email or SMS. You can unsubscribe at any time, in every message.

The legal basis is our legitimate interest in running and improving the service, or your consent where the law requires it — including for advertising cookies and marketing messages.

2.2 When Doctor UK Health acts for your Treating Provider

Doctor UK Health takes your payment and helps get your delivery to you. It does this on your Treating Provider’s instructions, as their processor, not for its own purposes. For this Doctor UK Health sees your name, contact details, billing and delivery address, and the amount you paid.

Doctor UK Health does not see what you were prescribed. Order descriptions, payment descriptors and delivery labels do not name a medicine, strength or dose. Doctor UK Health’s customer service systems are built so that clinical information cannot be displayed in them.

Doctor UK Health also helps run the clinical computer system your provider uses — setting up user accounts, managing the subscription and fixing technical faults. Your provider owns that system and its records, decides what Doctor UK Health may do in it, and can remove Doctor UK Health’s access at any time. Only named Doctor UK Health staff hold that access, it is restricted so that it does not extend to reading clinical records, every session is logged and reviewed by your provider, and those staff are bound by the same duty of confidentiality as healthcare staff. In the rare case where a fault cannot be fixed without an administrator seeing a record, your provider must approve it beforehand or be told within one working day, and it is recorded.

Doctor UK Health staff who handle this information are individually bound by confidentiality obligations equivalent to those a healthcare professional owes.

3. What your Treating Provider does with your information

Your Treating Provider holds your assessment answers, consultation records, medical history, prescriptions, doses, supply records and correspondence. They use it to assess you, decide whether treatment is appropriate, prescribe, supply your medicine, review your treatment, keep you safe, and meet their legal and professional obligations.

The legal basis is the contract for your care, and for health information specifically, Article 9(2)(h) of the UK GDPR — the provision of health care and treatment — together with paragraph 2 of Part 1 of Schedule 1 to the Data Protection Act 2018. This information is handled by or under the responsibility of health professionals, who are bound by a duty of confidentiality.

Where they report a suspected side effect to the MHRA, the basis is their legal obligation and the public interest in public health.

4. Legal bases in full

5. What we deliberately do not do

The clinical part of doctor.uk is separated from the marketing part by design, not just by policy. From the moment you start the health assessment:

• There are no advertising pixels, no analytics tags and no session recording on any assessment page. Nothing you type there is captured by a third party.
• Your answers, your BMI, your height and weight, your eligibility outcome, your medicine and your dose are never sent to any advertising or analytics platform, in any form.
• Nothing appears in a web address that could reveal anything about your health.
• Doctor UK Health is told only that you reached a stage — that an assessment was completed or a consultation booked — and never what happened in it.
• Where an event is shared with an advertising platform for campaign measurement, it carries a fixed nominal value that does not vary by medicine or dose, and no identifier that platform could match to you.
• Clinical emails come from your provider’s systems, on a different sending domain, and carry no open or click tracking.

We check this. The separation is verified before launch and at least once a year by an independent assessor, and scanned automatically every week for anything unauthorised.

6. Who we share your information with

We do not sell your information to anyone, and we do not share clinical information for marketing purposes.

7. How long we keep it

8. Your rights

You can ask for a copy of your information, ask us to correct it, ask us to delete it, ask us to restrict or stop certain uses, object to processing based on legitimate interests, ask for your information in a portable format, withdraw consent at any time, and complain.

Send a request about clinical information to your Treating Provider, and about the website, marketing or your account to Doctor UK Health. If you are not sure, ask either of us and we will pass it on and tell you where it went. We respond within one month, and will tell you if we need longer.

Some rights work differently for health records. Deletion usually does not apply, because your provider must keep clinical records by law. And information can be withheld where releasing it would be likely to cause serious harm to you or someone else — that is a judgement made by a health professional, not an administrative decision.

You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but you do not have to.

9. Cookies

Cookies and similar technologies are explained in our Cookie Notice. Nothing beyond what is strictly necessary is set until you consent, and you can change your choices at any time.

Advertising and analytics cookies are never used on assessment pages, whatever you have consented to elsewhere. Consent is not a route around the separation described in section 5.

10. Where your information is held

Your clinical information is stored in the UK. Where any supplier processes information outside the UK, we make sure appropriate safeguards are in place — an adequacy decision or the International Data Transfer Agreement or Addendum — and you can ask us for details.

11. Security

Information is encrypted in transit and at rest. Access is restricted to those who need it for their role, and everyone handling clinical information is bound by confidentiality obligations. Access is logged and audited. If something goes wrong and there is a risk to you, we will tell you.

12. If your Treating Provider changes

If a new provider simply joins doctor.uk, nothing about your information changes. Your records stay with the provider treating you.

Your own provider may change — for example if it moves a private service into a separate company. If that happens your records transfer to the new provider so that your care carries on without interruption.

We do not rely on your consent to do this, and we will not ask you to give it. The legal basis is the contract for your care under Article 6(1)(b), and Article 9(2)(h) for your health information. Consent is not the right basis here, because your care would have to continue in any event and a consent you could not realistically refuse would not be a real one. You agree in advance to transfers of this kind when you accept the Patient Terms of Treatment, and section 15 of those terms sets out the protections that apply.

What you can rely on:

• We will write to you individually, by email, at least 30 days before any transfer, and by post if your email bounces.
• You can object during that window. If you object, your records will not be transferred and we will discuss your options with you.
• The new provider will be registered with the Care Quality Commission before anything transfers, and will hold indemnity at least equivalent to your current provider’s.
• After the transfer the new provider will contact you to confirm its identity, its contact details and how it handles your information.
• Your records move across in full, including records of care you received before the transfer. The new provider becomes responsible for them, and is who you contact for a copy or to exercise any of your rights — including about your earlier treatment.

Where your care would move to a genuinely different organisation with different clinicians, we ask for your consent before transferring your records instead of relying on the above.

13. Children

This service is for adults aged 18 and over. We do not knowingly collect information about children. If you think we have, please tell us.

14. Changes to this notice

We may update this notice. The date at the top shows when it last changed. If a change is significant, we will tell you directly.

15. Contact

Part B — Cookie Notice

1. What this covers

Cookies are small files placed on your device by a website. This policy also covers similar technologies — pixels, tags, local storage and software development kits — which do comparable things. We refer to all of them as cookies.

This policy explains what we use, why, and how you control it. It sits alongside our Privacy Notice, which explains what we do with personal information more generally.

2. Your choice comes first

2.1We do not place any cookie on your device beyond those strictly necessary to make the website work until you have told us you are happy for us to. You will see a banner the first time you visit.

2.2Saying no is as easy as saying yes. There is a reject-all option on the first screen of the banner, not buried behind a settings menu.

2.3You can change your mind at any time using the cookie settings link in the footer of every page.

2.4The rules here come from the Privacy and Electronic Communications Regulations 2003 and the UK GDPR. Strictly necessary cookies do not need your consent; everything else does.

3. What we use

Strictly necessary — always on

These make the website work. Without them, pages will not load properly, you cannot stay logged in, and you cannot complete a booking. They do not track you and cannot be switched off.

Functional — only with your consent

These remember your preferences so the site is easier to use. Turning them off will not break anything, but some things will not be remembered.

Analytics — only with your consent

These tell us how people find and use the site so we can improve it — which pages are read, where people get stuck, what does not work on a phone.

Advertising — only with your consent

These let us show you relevant advertising elsewhere on the internet and measure whether our advertising works. They are set by advertising companies who may use them to build a profile of your interests.

A current list of every cookie in each category, with its name and provider, is available through the cookie settings link in the footer, and is kept up to date automatically.

4. No tracking in the health assessment

4.1From the moment you begin the health assessment, no analytics or advertising cookies operate. Only the strictly necessary cookies that keep your place in the form are used.

4.2This applies even if you have consented to analytics and advertising elsewhere on the site. Your consent does not extend into the assessment, and we do not treat it as if it did.

4.3Nothing you enter in the assessment — your answers, your height and weight, your eligibility, your medicine or your dose — is sent to any analytics or advertising company, in any form. Nor is any of it used to decide what advertising you see.

4.4We check this rather than assert it. The assessment is scanned automatically every week for any unauthorised tracking, and independently tested at least once a year.

5. Cookies set by other companies

Some cookies are set by companies other than us — analytics and advertising providers, and our payment provider. We choose who those are, and they only operate where you have consented, but they are governed by their own privacy policies as well as ours. The current list, with links, is in the cookie settings panel.

We do not allow any third-party cookie to operate on the health assessment.

6. Controlling cookies yourself

• Use the cookie settings link in the footer of any page to change your choices on this site.
• Your browser also lets you block or delete cookies. Every major browser has a privacy or security settings section that explains how.
• Blocking strictly necessary cookies in your browser will stop parts of the site working, including booking and payment.
• Deleting your cookies will also delete your record of choices here, so you will see the banner again.
• Most browsers offer a Do Not Track setting. There is no agreed standard for how sites should respond to it, so we do not rely on it — use our cookie settings instead, which we do act on.

7. Changes and contact

We update this policy when what we use changes. The date at the top shows when it last changed. If we introduce a new category of cookie we will ask for your consent again.

Questions about cookies: hello@doctor.uk. Questions about your clinical information go to your Treating Provider — see the provider details panel on your documents. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Version history

Superseded versions are retained and are not deleted, so that the position in force on any past date can be established.