Umid
The Barn Annexe, Andover Road, Micheldever Station, Winchester SO21 3AR
umid@umid.co.uk
Phone: 01962 435 090
Effective Date: January 2025
Introduction
At Umid, we are committed to protecting your privacy and ensuring that your personal data is handled securely and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains how we collect, use, store, and protect your personal data and outlines your rights regarding your information.
Who is responsible for your data
The data controller is Umid Healthcare Ltd, a company registered in England and Wales (registration number 14498359), trading as Umid. We are registered with the Information Commissioner's Office (ICO).
What Information We Collect
We may collect the following types of personal data:
- Personal details: Name, date of birth, contact information (address, email, phone number).
- Health-related data: Medical history, diagnostic results, treatment records, prescriptions, referrals, and notes from consultations.
- Payment details: Information for processing payments (if applicable).
- Communication records: Emails, appointment reminders, or feedback provided by you.
This data includes special category data under UK GDPR, specifically health information.
Lawful Basis for Processing
We process your data under the following lawful bases as defined by the UK GDPR:
- Article 6(1)(b): Processing is necessary for the performance of a contract with you (e.g., providing healthcare services).
- Article 6(1)(c): Processing is necessary for compliance with a legal obligation (e.g., maintaining accurate medical records).
- Article 6(1)(f): Processing is necessary for our legitimate interests (e.g., managing our business).
- Article 9(2)(h): Processing of special category data is necessary for the provision of health or social care.
How We Use Your Information
We use your data to:
- Schedule and manage appointments.
- Provide appropriate medical care and treatment.
- Communicate with you regarding your care, including appointment reminders.
- Process payments and issue invoices (if applicable).
- Maintain accurate medical records for continuity of care.
Data Storage & Security
Your data is stored securely in compliance with UK GDPR guidelines. We implement appropriate technical and organisational measures to prevent unauthorised access, loss, or misuse of your information.
- Electronic records are stored in secure, encrypted systems with access controls.
- Paper records (if used) are kept in locked, access-controlled locations.
- Data retention (adults): Records are retained for a minimum of 8 years after the last treatment (or longer if required by law) and securely deleted when no longer needed.
- Data retention (children and young people): Records are retained until the patient's 25th birthday, or until their 26th birthday where the young person was 17 at the conclusion of treatment. Where 8 years from the last treatment falls later than this, the longer period applies.
We have procedures in place for data breaches, including notification to the ICO within 72 hours when required.
Sharing of Information
We do not share your data with third parties without your explicit consent, except in the following circumstances:
- When required by law or regulatory bodies.
- When necessary for your treatment (e.g., referrals to specialists, communication with your GP).
- If you have provided consent to share information with insurers or third-party healthcare providers.
All our systems are GDPR compliant.
The main systems we use to deliver and administer your care are:
- WriteUpp — our secure clinical records system, used to manage appointments, letters and payment information
- Hubspot - Our enquiries management system
- SignatureRx and CloudRx — used to issue and process prescriptions
- Signature Pharmacy — dispenses and delivers prescriptions, and may contact you directly about payment and delivery
- Heidi — a medical scribe system used by many of our clinicians to help document consultations, described below
Use of Medical Scribe Technology
Many of our clinicians use Heidi, a UMID-approved medical scribe system, to help document consultations. This allows the clinician to give their attention to the conversation rather than to typing notes.
Heidi is used widely across the NHS, including by NHS trusts and GP practices. It holds independent certifications including ISO 27001, ISO 42001 (artificial intelligence management), ISO 9001, SOC 2 Type 2 and Cyber Essentials, and is aligned with the NHS Digital Technology Assessment Criteria (DTAC) and the clinical safety standard DCB0129. Data is held in the United Kingdom and encrypted both in transit and at rest.
- You can tell your clinician that you would like Heidi not to be used for the consult.
- The audio of your consultation is not retained. It is used only to produce a written transcript and is deleted once that transcript has been generated.
- The transcript is used solely to prepare your clinical notes and reports. It is deleted once these have been prepared and is not kept as part of your medical record.
- Your clinician reviews and approves every note and report before it is added to your records.
Your Rights
Under UK GDPR, you have the following rights regarding your data:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request corrections to inaccurate or incomplete data.
- Deletion: Request that we delete your personal data, subject to legal and professional record-keeping obligations.
- Restriction: Ask us to restrict the processing of your data in certain circumstances.
- Objection: Object to us processing your data for specific purposes.
- Data portability: Request that we transfer your data to another provider where applicable.
- Complaints: Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data rights have been breached. The ICO can be reached at ico.org.uk or on 0303 123 1113.
To exercise your rights, please contact us at umid@umid.co.uk.
Contact Information
If you have any questions or concerns about this Privacy & Data Protection Policy, or if you wish to make a data request, please contact:
Umid
The Barn Annexe, Andover Road, Micheldever Station, Winchester SO21 3AR
umid@umid.co.uk
01962 435 090
Updates to This Policy
We may update this policy from time to time to reflect changes in legal requirements or our practices. We encourage you to review it periodically.
Acknowledgment & Consent
By continuing to use our services, you acknowledge that you have read and understood this Privacy & Data Protection Policy.
UMID