Your information

Privacy notice

Version 1.1 · effective 22 October 2026

This notice explains how Medical Consulting uses your personal information when you are referred to us for eye care, when you are treated by us, and when you contact us.

Who we are

Medical Consulting is the trading name of Medical Consulting Ltd (company number 12252304), a consultant-led ophthalmology service registered with the Care Quality Commission (CQC). Our head office is at Lancaster Centre, Suite 9, Meteor Business Park, Staverton, Gloucester GL2 9QL. Medical Consulting Ltd is the controller of the information described here, which means we decide how it is used and are responsible for protecting it. Our registration number with the Information Commissioner's Office (ICO) is ZB676465.

Data Protection Officer: Dr Guzaliya Safiullina
Caldicott Guardian (the senior clinician responsible for patient confidentiality): Dr Guzaliya Safiullina
Contact for anything in this notice: info@medicalconsulting.uk, telephone 02046 416942, or write to us at our head office.

What we collect

About	What	Where it comes from
Patients	Name, date of birth, NHS number, address, phone, email, GP practice	Your GP or optometrist when they refer you, and you
Patients	Health information: referral letters, eye examination results, scans and photographs, diagnoses, treatment (including injections and medicines), clinical notes and letters	Your GP, optometrist or hospital, you, and our own clinicians
Patients	Your preferences and needs, for example a large-print letter or an interpreter	You or the person who referred you
Referring clinicians	Name, practice, address, email, phone, professional registration number (GMC or GOC)	The referrer
Anyone who contacts us	Your name, contact details and what you tell us	You

Health information is special category data and has extra legal protection.

Why we use it, and our lawful basis

We use your information to receive and triage your referral, book and provide your care, write to you and to your GP and referring clinician, monitor and improve the safety and quality of our service, and meet our legal and regulatory duties.

NHS-funded care (UK GDPR Article 6(1)(e)): we use your information to carry out a task in the public interest, providing health care commissioned by the NHS.
Care you arrange with us directly (Article 6(1)(b)): the information is needed to provide the care you have asked for.
Health information (Article 9(2)(h) and Data Protection Act 2018, Schedule 1, paragraph 2): it is used to provide health care by, or under the responsibility of, health professionals who owe you a duty of confidentiality.
Legal and regulatory duties (Article 6(1)(c)): we keep clinical records and report to regulators such as the CQC as the law requires.
Referring clinician details (Article 6(1)(e) or (f)): we need to contact and update the professional who referred you.

We do not use your information for marketing, we do not sell it, and we do not use it to make automated decisions about you.

Your GP and the clinician who referred you, so they know about your care. This is a normal part of NHS care.
Colleagues at the surgery or practice that referred you: clinicians at the same GP surgery or optician's practice who use our portal can see the progress of referrals sent from that practice and the outcome letter, so your care can be followed up when the person who referred you is away.
Other health and care services involved in your care, for example a hospital eye service if you need to be transferred, or a pharmacy.
The NHS organisations that commission our service, for example to confirm the care we have provided. Wherever possible this does not identify you.
Service providers working for us, under contracts that require them to protect your data and only follow our instructions:
- Amazon Web Services (our servers, encrypted backups and email delivery), in London, UK
- Google Workspace (our secure email)
Others only when the law requires it, for example a court order, a regulator such as the CQC or GMC, or to protect someone from serious harm.

Your information is stored in the UK. If a provider ever processes it outside the UK, we make sure UK-approved safeguards (such as the International Data Transfer Agreement) are in place.

National data opt-out

We do not use your confidential patient information for purposes beyond your individual care, such as research or planning. If we ever do, we will apply the national data opt-out. You can find out more, or change your choice, at nhs.uk/your-nhs-data-matters.

How we protect it

All connections to our website are encrypted. Staff sign in with individual accounts and two-factor authentication, are signed out after 30 minutes of inactivity, and every view and download of a patient record is logged. Our servers and encrypted backups are in the UK.

How long we keep it

We follow the NHS Records Management Code of Practice:

Adult clinical records: 8 years after your care with us ends.
Children's clinical records: until the patient's 25th birthday (26th if they were 17 when care ended), or 8 years after care ends if that is longer.
Referrals that do not lead to an appointment: 2 years after our last contact.
Copies in our email inbox: 90 days, because the master copy is kept in our secure system.
Encrypted backups: 35 days.

Our full Records Retention Schedule is available on request.

Your rights

You have the right to:

access a copy of your information
have inaccurate information corrected
ask us to delete your information (we usually need to keep clinical records for the periods above)
ask us to restrict how we use it, or object to how we use it
receive information you gave us in a portable format

To use any of these rights, email info@medicalconsulting.uk or use the form at the bottom of this page. We will reply within one month. There is normally no charge.

Complaints

If you are unhappy with how we have handled your information, please tell us first: email info@medicalconsulting.uk or use the form below. We will acknowledge your complaint within 30 days, investigate it, keep you updated and tell you the outcome. Our Data Protection Complaints Procedure explains this in full.

You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Cookies

Our website keeps cookies and similar storage to a minimum:

Strictly necessary (always on): a secure sign-in cookie for staff and clinicians using our portals, and a note of the cookie choices you make, so we do not ask again.
Functional (only if you allow it): your text size choice, saved in your own browser.

We do not use analytics, advertising or tracking cookies, and our fonts are served from our own server, so visiting the website does not share your details with other companies. You can change your choice at any time with Cookie settings at the bottom of every page.

Changes to this notice

We review this notice at least once a year. The version and date are shown at the top of the page.

Make a request or complaint

Use this form to ask for a copy of your information, to correct or delete it, or to complain about how we have handled it. You can also email info@medicalconsulting.uk or call 02046 416942.