Effective Date: 16 January 2026

​

Red Rose Healthcare is committed to protecting your personal data and processing it in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This notice explains how we collect, use, store, and safeguard your personal information.

 

Information We Collect

 

We may collect and process the following categories of personal data:

 

Personal details, including your name, date of birth, address, telephone number, and email address.

Medical information, including your medical history, clinical records, consultation notes, treatment plans, and prescriptions.

Appointment information, including booking details, attendance records, and correspondence with you.

Diagnostic information, including test results and reports.

 

Purpose of Processing

 

We process your personal and special category (health) data for the following purposes:

 

To provide safe, effective, and appropriate medical care.

To manage appointments and ongoing treatment or follow-up care.

To communicate with you and, where appropriate, other healthcare professionals involved in your care.

To comply with our legal, professional, and regulatory obligations.

 

Our lawful basis for processing includes the provision of healthcare services, compliance with legal obligations, and the management of healthcare systems and services under UK GDPR.

 

Data Security

 

We implement appropriate technical and organisational measures to ensure your personal data is kept secure and confidential. Access to your information is limited to authorised personnel who require it for legitimate clinical or administrative purposes. Data is stored securely in accordance with applicable data protection laws and healthcare record-keeping standards.

​

Data Retention

 

We retain medical records and related information in line with applicable legal and regulatory requirements, including recognised healthcare records management guidance. Retention periods depend on the type of record and the nature of the care provided.

 

Your Rights

 

Under UK GDPR, you have the right to request access to your personal data, request correction of inaccurate or incomplete data, request erasure of data in certain circumstances, restrict or object to processing where applicable, and request the transfer of your data to another provider where technically feasible.

 

If you wish to exercise any of your rights or have questions about how your data is handled, please contact us directly.

 

Complaints

​

If you are dissatisfied with how we process your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO). Further information can be found at www.ico.org.uk.