Private GP Surgery

PRIVACY POLICY
Nordicsprings Health Limited
How we collect, use and protect your information
Organisation: Nordicsprings Health Limited
Company Number: 16635312
ICO Registration Number: ZC009394
Version: 1.0
Date: April 2026
Review Date: April 2027
Contact: nordicspringshealth@gmail.com

Nordicsprings Health Limited is a private GP service operating from:

The Hope Centre, Saxonbrook Medical Practice, Maidenbower Square, Crawley RH10 7QH
Nordicsprings Health Limited is legally and clinically independent from Saxonbrook Medical Practice. This means that Nordicsprings Health Limited is responsible for its own clinical services, patient records, data protection responsibilities and patient confidentiality.
This Privacy Policy explains how we collect, use, store and protect your personal information when you use our website, contact us, register as a patient, book an appointment, receive care from us or communicate with us.
Please read this policy carefully. If you have any questions about how your information is handled, please contact us at: nordicspringshealth@gmail.com

1. Who we are

Nordicsprings Health Limited is the Data Controller for the personal information you provide to us.
This means we are responsible for deciding how and why your personal information is collected, used, stored and shared.

 

Our Data Protection and Information Governance Lead is:
Emily Carney
Registered Manager and Nominated Individual
Email: nordicspringshealth@gmail.com
We are registered with the Information Commissioner’s Office under registration number:ZC009394

 

2. What information we collect

We may collect and process the following types of personal information.
 

Identity information
This may include:

• Full name,

• date of birth,

• gender and other information needed to identify you safely.

 

Contact information
This may include:

• Address,

• telephone number,

• email address and emergency contact details.

 

Clinical information
This may include:

• Medical history,

• symptoms, diagnoses,

• test results,

• medication history,

• allergies,

• clinical notes,

• treatment plans,

• referrals and follow-up information.

 

Prescribing information
This may include:

• Prescriptions issued,

• dosage information,

• medication monitoring records and clinical prescribing decisions.

 

Administrative information
This may include:

• Appointment history,

• registration forms,

• correspondence,

• billing information,

• payment records,

• complaints,

• feedback and service enquiries.

​

Special category health information

This may include:

• Health data,

• sexual health information,

• mental health information,

• weight management data and any other sensitive clinical information needed to provide safe healthcare.

 

3. How we collect your information

We may collect information from:
You directly, when you complete registration forms, contact forms, booking forms, medical questionnaires or consultation forms.
You directly, during consultations, telephone calls, video calls, emails or other correspondence.
Other healthcare professionals involved in your care, where this is clinically appropriate.
Your NHS GP, only where relevant and appropriate.
Referral letters, medical reports, test results or other clinical documents you provide to us.
Our clinical system, appointment system, email system or website forms.

 

4. Why we use your information

 

We use your personal information to:

• Provide private GP consultations, diagnosis and treatment.

• Assess your medical needs and provide safe clinical advice.

• Prescribe and monitor medication safely.

• Maintain accurate and up-to-date clinical records.

• Book, manage and confirm appointments.

• Communicate with you about appointments, results, follow-up care and clinical matters.

• Refer you to another healthcare professional, where clinically appropriate.

• Share information with your NHS GP where you have consented or where there is a clear clinical, safeguarding or legal reason.

• Respond to your questions, complaints or requests.

• Meet our legal, professional, safeguarding and regulatory obligations.

• Support clinical governance, audit, quality improvement and service safety.

• Protect patients, staff and the wider public where there is a serious risk of harm.

 

We will not use your personal information for automated decision-making or profiling.

 

5. Lawful basis for using your information

We only use your personal information where we have a lawful basis to do so.
The lawful bases we may rely on include:
Healthcare delivery - We process clinical and health information where it is necessary to provide medical care, diagnosis, treatment and clinical management. This includes processing special category health data under UK GDPR Article 9(2)(h), where processing is necessary for the provision of health or social care.
Contract - We process information where it is necessary to provide the healthcare service you have requested or agreed to receive from us.
Legal obligation - We process information where required to comply with legal, safeguarding, professional, regulatory or statutory duties. This may include duties connected with healthcare regulation, CQC requirements, safeguarding, complaints, medical records and legal requests.
Consent - We may ask for your consent for specific optional uses of your information, such as sending non-essential communications, newsletters or sharing consultation summaries with your NHS GP where consent is appropriate.
Withdraw - You can withdraw consent at any time. This will not affect any lawful processing already carried out before consent was withdrawn.
Vital interests - We may process or share information where it is necessary to protect life or prevent serious harm, for example in an emergency situation.

6. Website forms and online enquiries

If you contact us through our website, we may collect the information you provide in the form.
This may include your name, contact details, message content and any health or appointment information you choose to submit.
Please only provide information that is relevant to your enquiry.

 

Website form submissions may be used to:

• Respond to your enquiry.

• Arrange appointments or follow-up contact.

• Provide information about our services.

• Direct you to the correct member of our team.

• Keep a record of your communication with us.

Where your enquiry contains clinical information, we will handle it as confidential health information.

 

7. Appointments, registration and clinical records

When you register with Nordicsprings Health Limited or book an appointment, we may ask you to provide personal, contact and health information.
We need this information to provide safe and appropriate healthcare.
Our clinical records are stored securely in Cliniko, an encrypted cloud-based clinical records system. Access to clinical records is restricted to authorised users only.

 

8. Who we share your information with

We only share your personal information where there is a clear reason to do so and where the law allows it.
We may share relevant information with:

• Your NHS GP

• We may share a consultation summary, referral information or other relevant clinical information with your NHS GP where you have given consent, or where there is another lawful basis to do so.

• Other healthcare professionals

• We may share relevant information with other doctors, specialists, laboratories, pharmacies or healthcare professionals where this is necessary for your care.

• CQC and regulators

• We may share information with the Care Quality Commission or other regulators where required by law or regulatory obligation.

• Safeguarding authorities

• We may share information with safeguarding authorities where there is a concern about risk of harm to a child or adult.

• Police, courts or legal authorities

• We may share information where legally required, where ordered by a court, or where there is a serious risk of harm.

• Service providers and processors

• We may use trusted service providers to support our services, including clinical records, appointment management, secure communication, website hosting, email and administration.

• Where a service provider processes personal information on our behalf, they must follow our instructions and protect your information appropriately.

• We will never sell your personal information.

We will never share your personal information with third parties for marketing purposes.

 

9. Relationship with Saxonbrook Medical Practice

Nordicsprings Health Limited operates from The Hope Centre, Saxonbrook Medical Practice, Maidenbower Square, Crawley RH10 7QH.
Nordicsprings Health Limited is legally and clinically independent from Saxonbrook Medical Practice.

 

We do not share your clinical records with Saxonbrook Medical Practice unless:

• You have given explicit consent.

• There is a legal obligation to do so.

• There is a safeguarding concern.

• There is a serious risk of harm.

 

There is another lawful basis that allows or requires us to share the information.

Where Saxonbrook Medical Practice provides limited administrative support under a formal data processing agreement, they act only as a processor and are bound by confidentiality and data protection obligations.

 

10. Cookies and website tracking

Our website may use essential cookies to make the website work properly and to support website security.
If we use non-essential cookies, analytics cookies or marketing cookies, we will provide appropriate cookie information and request consent where required.
You can manage or block cookies through your browser settings.
Please note that blocking some cookies may affect how the website works.

 

11. Marketing communications

We will only send you marketing communications, newsletters or general health updates where you have opted in or where the law allows us to do so.
You can unsubscribe or withdraw consent at any time by contacting: nordicspringshealth@gmail.com
We will not use your clinical information for marketing.

​

12. How long we keep your information

We only keep personal information for as long as necessary.
Our retention periods include:

• Record TypeRetention Period

• Adult clinical records10 years after the last entry

• Children’s recordsUntil the patient’s 26th birthday

• Safeguarding records15 years, or 8 years after death

• Mental health records20 years

• Vaccination records10 years

• Complaints records10 years

 

When records are no longer needed, they are securely and irreversibly destroyed. Destruction of records is documented.

 

13. How we keep your information secure

We take data protection and patient confidentiality seriously.
We use appropriate technical and organisational measures to protect your information, including:

• Secure clinical records held in Cliniko.

• Encrypted cloud-based storage.

• Role-based access controls.

• Two-factor authentication on clinical systems.

• Password-protected devices.

• Device auto-lock settings.

• Restricted access to patient information.

• Staff training in data protection and information governance.

• Data breach reporting procedures.

• No patient-identifiable information stored on personal devices.

• Audit logging where available.

 

14. Data breaches

If we become aware of a data breach that may pose a risk to your rights and freedoms, we will investigate it promptly.
Where required, we will notify the Information Commissioner’s Office within 72 hours.
Where a breach is likely to result in a high risk to you, we will also inform you as soon as possible.
All data breaches are logged, reviewed and investigated.

 

15. Your rights

Under UK data protection law, you have rights over your personal information.
These include:

• Right of access - You can request a copy of the personal information we hold about you. This is known as a Subject Access Request.

• Right to rectification - You can ask us to correct inaccurate or incomplete information.

• Right to erasure - You can ask us to delete your information, although this right may be limited where we have legal, clinical or regulatory duties to retain records.

• Right to restriction - You can ask us to restrict how we use your information in certain circumstances.

• Right to data portability - You can ask us to provide certain information in a structured, commonly used format.

• Right to object - You can object to certain types of processing, including direct marketing.

• Right to withdraw consent - Where we rely on your consent, you can withdraw it at any time.

• Withdrawing consent will not affect any processing carried out before your consent was withdrawn.

• To exercise your rights, please contact: nordicspringshealth@gmail.com. We will respond within one calendar month.

 

16. Children and young people

Where we provide care to children or young people, we will handle their personal information with particular care.
We may collect information from a parent, guardian or person with parental responsibility where appropriate.
Where a child or young person has sufficient understanding to make their own decisions about their information, we will take this into account.
Children’s records are retained until the patient’s 26th birthday.

 

17. Confidentiality

We treat all patient information as confidential.
We will only access, use or share your information where there is a proper reason to do so.
Everyone working with or for Nordicsprings Health Limited is expected to follow confidentiality and data protection requirements.

 

18. Complaints and concerns

If you are concerned about how we handle your personal information, please contact us first so we can try to resolve the issue.
Emily Carney — Information Governance Lead
Nordicsprings Health Limited
The Hope Centre, Saxonbrook Medical Practice
Maidenbower Square
Crawley RH10 7QH
Email: nordicspringshealth@gmail.com
If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office.
Information Commissioner’s Office
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

 

19. Changes to this Privacy Policy

We review this Privacy Policy at least annually or sooner if our services, systems, legal duties or data protection practices change significantly.
The current version will be available on our website and on request.
Nordicsprings Health Limited
Company No: 16635312
ICO Reg: ZC009394
Email: nordicspringshealth@gmail.com
Privacy Policy Version: 1.0
Date: April 2026
Review Date: April 2027