Privacy Notice for Patients
How we use your information | Version 1.2 | 6 August 2026
Who we are
Medica Universal Ltd is the data controller for the information we hold about you. We are registered with the Information Commissioner’s Office, registration number ZB611565.
Our address for correspondence is 19 Rosetta Road, Portsmouth PO4 8JY. You can contact us about anything in this notice at hello@medicauniversal.co.uk or on 07300 944955. The person responsible for data protection is Perminder Sethi.
What we collect
| Type | What it includes | Where it comes from |
|---|---|---|
| Identity and contact | Your name, date of birth, address, telephone number and email address. An image of a photographic identity document — passport or driving licence | You, at registration |
| Health information | Your medical history, current medicines, allergies, previous reactions, diagnosed conditions, pregnancy and contraception status where relevant, mental health history including any history of eating disorder or self-harm, alcohol, smoking and substance use, height, weight and measurements, blood results, and everything discussed and decided during your consultations | You, and — with your consent — your GP, a laboratory, or a previous provider |
| Photographs | Where relevant to a weight management assessment, a photograph you send us. We ask separately each time and explain what it is for. We never ask for photographs of intimate areas and you can decline | You, only when we ask and you agree |
| Consultation records | Notes made during and after each consultation, prescriptions issued, correspondence sent | Us |
| Payment information | Records of what you have paid and when. Card details are handled by our payment provider and are not held by us | You and our payment provider |
| Technical information | Records of when you log in and what is accessed on your record | Our systems |
Why we use it, and our legal basis
We use your information to assess you safely, to decide whether treatment is appropriate, to prescribe and monitor it, to communicate with you and your GP, to keep the records we are legally required to keep, and to manage bookings and payment.
We do not rely on your consent as our legal basis for using your health information. That matters, because if we did, withdrawing consent would leave us unable to keep records we are legally obliged to retain. You still consent to your treatment, and to us writing to your GP, and you can change your mind about either.
| Legal basis | What it covers |
|---|---|
| Article 6(1)(b) UK GDPR — performance of a contract | Providing the service you have asked us for |
| Article 6(1)(c) — legal obligation | Keeping clinical records for the required period, and meeting our obligations as a registered provider |
| Article 9(2)(h) — health and social care | Using your health information to provide care and treatment. This is our basis for using health information — not your consent |
| Schedule 1, Part 1, paragraph 2, Data Protection Act 2018 | The additional condition required in UK law for using health information, met because we are working under the responsibility of a health professional |
| Legal obligation and vital interests | Safeguarding referrals, reporting suspected side effects to the MHRA, and notifications we are required to make |
The online questionnaire
Before your consultation you complete a health questionnaire. It applies simple rules that flag certain answers — for example a history of a particular thyroid cancer, which means weight management medication would not be safe for you.
The questionnaire can flag an answer and it can hold a booking. It cannot approve you, choose a treatment for you, or authorise a prescription. Every flag is looked at by a clinician before we tell you anything, because a declared history can be misunderstood or recorded wrongly. Every decision about whether treatment is right for you is made by a clinician, in a live consultation.
If we cannot offer you medication, we will tell you why, and where we can we will offer you the programme without it.
Who we share it with
- Your registered GP — a summary after any consultation where we diagnose something, prescribe or change a medicine, make a referral, or have a safety concern. This is our default and we explain it at registration. You can decline, and section ‘Your choices’ below explains what happens then
- The pharmacy that dispenses your prescription — your name, address, date of birth and the prescription. You choose the pharmacy
- A laboratory, where blood tests are arranged through us
- Our external clinical reviewer — an independent GP who reviews a small random sample of records each quarter to check the quality of our care. He works under a written agreement, keeps no copies, and is bound by the same duty of confidentiality
- Our technology suppliers, who host our systems under written contracts that restrict them to acting on our instructions
- Our messaging platform, which sends appointment reminders and administrative messages by WhatsApp. Your telephone number and the content of those messages are processed by that provider and its own suppliers, some of them outside the UK
- Our payment provider, where you pay a fee. We do not hold your card details
- Regulators and authorities, where we are required to share — the Care Quality Commission, the General Medical Council, a local authority safeguarding team, the police, a coroner, or a court
We do not sell your information, and we do not use it for marketing without asking you separately.
Where it is held
Your clinical record is held on secure systems in the United Kingdom, accessed only from encrypted equipment used solely for this service. It is not held on personal devices or personal accounts.
Some information is processed outside the United Kingdom. We use a messaging platform to send appointment reminders, confirmations and other administrative messages by WhatsApp. That platform, and its own suppliers, process telephone numbers and message content in Singapore, Belgium and the United States. Our payment provider also processes information outside the UK.
Where information is transferred outside the UK we rely on the safeguards required by UK data protection law — standard contractual clauses and the UK International Data Transfer Addendum — and we assess the risks of those transfers. You can ask us for details of any of this.
We do not use messaging for clinical consultation. If you send us something clinical by message, we will move the conversation to a consultation rather than answering there.
How long we keep it
| Record | How long |
|---|---|
| Your clinical record | 8 years from the last entry, or the end of your treatment, whichever is later |
| The image of your identity document | While you are an active patient, and up to 12 months after your last contact. After that we delete the image and keep only a note that we checked it, what type it was, and when |
| Photographs | Until the assessment they were taken for is complete or out of date, and no longer than 12 months. The clinical note made from them stays on your record |
| If you apply but we cannot treat you | We delete the health information you gave us after 2 years, keeping only a short note that you applied, when, and why we could not proceed |
| Payment records | 6 years, for accounting purposes, kept separately from your clinical record |
Your rights
- To be told what we hold about you and to have a copy — usually within one month, and free of charge
- To have anything inaccurate corrected. Where a clinical opinion is recorded that you disagree with, we will not delete it, but we will record your view alongside it
- To ask us to delete information. This right is limited for clinical records, because we are required to keep them. We will explain if we cannot
- To object to, or ask us to restrict, how we use your information
- To receive information you gave us in a portable format
- To withdraw consent to something you consented to — for example writing to your GP, or a photograph — without affecting the care we have already provided
To exercise any of these, contact us at hello@medicauniversal.co.uk. We may ask you to confirm your identity first, so that we do not give your information to someone else.
Your choices about your GP
Sharing with your registered GP is what we do unless you tell us otherwise, because it is safer for you. If you would rather we did not, you can say so and we will respect that.
We will explain what the risks are: your GP’s record will be incomplete, nobody else can check for interactions with your other medicines, monitoring may be missed, and if you are treated elsewhere those clinicians will not know what you are taking. We will record that we discussed it.
Your decision about your information does not decide whether we can treat you. That is a separate clinical judgement, and there are situations where we will not prescribe without your GP knowing. If that applies we will tell you and explain what would need to change. Where we do treat you without telling your GP, we will give you a written summary of your medicine to keep with you and show to anyone treating you.
There are limits. If we believe you or someone else is at risk of serious harm, if there is a safeguarding concern, or if the law requires it, we may share information without your agreement. We will tell you when we can.
Complaints
If you are unhappy with how we have handled your information, please tell us first — hello@medicauniversal.co.uk. We take it seriously and we will respond.
You can also complain to the Information Commissioner’s Office at any time, without coming to us first. ico.org.uk, or 0303 123 1113. Complaining to the ICO does not affect your care.
Changes
We review this notice annually and whenever we change how we use information. The current version is always on our website, and we will tell you directly about any change that materially affects you.
A separate Privacy Notice covers our website, general enquiries, promotions and marketing. This notice is the one that applies to you as a patient.
Version 1.2 | Approved by Perminder Sethi | Date 19 August 2026 | Next review 19 August 2027