Privacy Policy

Last updated: October 2026

This notice explains what information we hold about you, why we hold it, who we share it with, how long we keep it, and your rights. It applies to patients of Urban Health Care and of the partner services we oversee, and to parents, carers and representatives who contact us about a patient.

Who we are

Urban Health Care is the trading name of SJLD Ltd (company number 13138487), 301–305 High Street, Croydon, CR0 1QL. We are the data controller for the information we hold about you, and are registered with the Information Commissioner’s Office (ICO) under number ZB550258. This includes information held by our partner services, which provide care under our CQC registration: Origin TRT, Origin HRT and Origin Bloods; CANN-ABI; and Nexus ABI and Nexus Health. Our Data Protection Officer is Timothy Liggins, Registered Manager. You can contact him at rm@urbanhealthcare.co.uk, on 020 8686 7401, or by post at the address above. Our Caldicott Guardian, who makes sure patient information is kept confidential and shared appropriately, is Dr Steven Liggins, Medical Director.

The information we hold

Type	Examples
Contact and identity details	Name, address, date of birth, phone number, email, NHS number, next of kin, and identity documents we check before some treatments
Health information	Medical, dental and mental health history; consultation notes; examination findings; test results; X-rays and photographs; prescriptions; care plans; reports; capacity assessments and consent forms
Information from others	Letters and records from your GP, hospital or other clinicians; information from your case manager, deputy, solicitor or insurer when they refer you or fund your care
Payment details	Invoices, payments and insurance details. Card details are processed securely by our payment provider and are not stored by us
Recordings and images	CCTV images at the clinic. Video consultations are not recorded unless you agree
Communication needs	Any support you need to communicate or receive information

Why we use your information, and our legal basis

We use your information to assess and treat you, to keep you safe, to communicate with you and others involved in your care, to manage payments, to check and improve the quality of our services, and to meet our legal duties.

Purpose	Legal basis under UK GDPR
Providing your care and treatment	Article 6(1)(b), a contract with you for your care, or Article 6(1)(f), legitimate interests, where someone else such as an insurer funds your care; and Article 9(2)(h), the provision of health care, with Data Protection Act 2018, Schedule 1, paragraph 2
Keeping you and others safe, including safeguarding	Article 6(1)(c), legal obligation, or Article 6(1)(d), vital interests in an emergency; and Article 9(2)(h) or 9(2)(c), with Data Protection Act 2018, Schedule 1, paragraph 18 (safeguarding of children and individuals at risk)
Meeting our legal and regulatory duties, such as controlled drug records, CQC requirements and tax	Article 6(1)(c), legal obligation
Checking and improving our services, such as clinical audit and responding to complaints	Article 6(1)(f), legitimate interests; and Article 9(2)(h) (see our Complaints Policy)
Sending you surveys or news about our services	Your consent, which you can withdraw at any time

As well as data protection law, we follow the common law duty of confidentiality. We share confidential information only with your consent, where the law requires it, or where it is in the public interest, for example to protect someone from serious harm.

Who we share your information with

We share only what is needed, with:

your GP, so that your care is safe and joined up. For some treatments, such as cannabis-based medicines, testosterone and weight management medicines, agreeing to us telling your GP is a condition of treatment, and we will explain this to you first;
other clinicians involved in your care, for example when we refer you to a specialist or hospital, and clinicians in our partner services who are caring for you;
pharmacies that dispense your prescriptions, and laboratories that test your samples;
your case manager, deputy, attorney, solicitor or insurer, when they arrange or fund your care, with your consent or legal authority;
family members or carers, only with your consent, or in your best interests if you lack capacity to decide;
regulators and authorities where the law requires it, such as the Care Quality Commission, professional regulators, the NHS England Controlled Drugs Accountable Officer, the police or the courts, and local authorities for safeguarding.

We never sell your information or use it for marketing by other companies.

Systems and suppliers

We use carefully chosen suppliers who process information on our behalf under written contracts. They include Semble (our electronic patient record and video consultations), iinsight (case management for Nexus ABI and Nexus Health), our dental practice software and patient portal, Zanda Health (medical appointment booking), Google Workspace (secure email and storage) and Stripe (card payments). All of them hold data in the UK, in countries with UK adequacy regulations, or under the ICO’s International Data Transfer Agreement. Origin TRT also offers WhatsApp, provided by Meta, for general enquiries only. Please do not send health information by WhatsApp; call or email us instead.

Digital and AI tools

Some clinicians use approved digital tools, such as dictation or transcription, to help write notes and letters. We will tell you before such a tool is used in your consultation, and you can say no without it affecting your care. A registered clinician checks everything and remains responsible for every clinical decision. Your information is not used to train other organisations’ AI systems.

CCTV at our clinic

These premises are under CCTV surveillance. Images are recorded and monitored for the prevention and detection of crime and for public safety. The system is operated by SJLD Ltd, trading as Urban Health Care. For subject access requests or any other queries, please contact our Data Protection Officer, Timothy Liggins, in writing at rm@urbanhealthcare.co.uk. Cameras cover the entrance, reception, waiting room, emergency equipment area and back courtyard. They do not record sound and are never used in surgeries, consulting rooms or toilets. There is no CCTV on home visits or in video consultations.

When you use our website

If you contact us or request an appointment through our website, we use your details to reply to you and arrange your care. Our website has a contact form, an emergency dental callback form and a mailing list sign-up. If you join our mailing list, we send you news about our services, and you can unsubscribe at any time. Some appointments are booked through other providers’ systems linked from our website: Treatwell for beauty and wellness treatments, our dental patient portal for dental appointments, and Zanda Health for medical appointments. Treatwell is an independent booking platform with its own privacy policy. Our website uses cookies that are needed for it to work. We only use other cookies, such as analytics, if you agree through our cookie banner, and you can change your choice at any time. Our Cookie Policy explains which cookies we use and how to manage them. Our website links to other sites, such as our social media pages. Those sites have their own privacy policies.

How long we keep your information

Record	How long we keep it
Adult medical records	8 years after your last treatment
Mental health and psychology records, including CANN-ABI and Nexus ABI records	20 years after treatment ends, or 10 years after death if sooner
Adult dental records	11 years after treatment
Children’s dental records	Until the 25th birthday (26th if 17 when treatment ended), or 11 years after treatment, whichever is longer
CCTV images	31 days, unless needed as evidence
Payment records	6 years

The full schedule is in our Records Management Policy, which you can ask to see.

Your rights

You have the right to:

see a copy of the information we hold about you (a subject access request), free of charge, usually within one month;
have inaccurate information corrected;
ask us to delete information, where we no longer need it and the law allows (health records usually have to be kept for the periods above);
ask us to restrict how we use your information, or object to how we use it, in some circumstances;
withdraw your consent where we rely on it, for example for surveys;
receive information you gave us in a portable format, in some circumstances.

We do not make decisions about you based only on automated processing, and we do not use your confidential information for research or planning. If we ever wish to, we will ask you first. To use any of these rights, contact our Data Protection Officer. We may ask for proof of identity. Someone acting for you, such as a solicitor or attorney, will need your written authority or proof of their legal authority. Children: for children seen by our dental team, parents can usually see their child’s records, but a young person who understands their care may make their own decisions about their information.

Questions and complaints

If you have a question, or are unhappy with how we have used your information, please contact our Data Protection Officer first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We review this notice every year and will tell you about any important changes. You can ask for a printed copy, or a copy in another format such as large print, at reception.