Policies

Privacy notice

This notice explains what personal data GPDQ Limited collects, why, on what legal basis, who we share it with, how long we keep it and what your rights are. It covers everyone whose data we hold: people who visit this site or contact us, the organisations we work with and their staff, and the clinicians who apply to us and work with us.

Who we are and how to reach us

GPDQ Limited is a healthcare provider registered with the Care Quality Commission. We are registered in England and Wales, company number 09635612, at 727-729 High Road, London N12 0BP. We are registered with the Information Commissioner's Office as a data controller, registration number ZA147981. For anything in this notice, email support@gpdq.co.uk marked for the attention of the data protection lead, or write to us at 727-729 High Road, London N12 0BP. Because of the scale of health data we hold we are required to have a data protection officer; the appointment is in hand, and the officer's contact details will replace the address above when it is made.

The roles we play

For everything in this notice we are the controller, which means we decide why and how your data is used, unless a section says otherwise. Two exceptions matter. Where our prescribers or other clinicians work inside a client's own clinical system, the client remains the regulated provider and the controller of its patients' records; our clinicians use those records under the client's arrangements and our written agreement with it, and the client's privacy notice covers that care. Where we deliver a programme commissioned by an NHS body or a local authority, that body is the controller or shares that role with us under a written arrangement, its own notice applies as well, and we tell you so when you attend.

Visitors to this site

When you visit, our hosting provider records the technical details every web server records, such as your IP address, the pages requested and the browser used, in security logs. We use them to keep the site available and secure. Our lawful basis is our legitimate interest in running a secure service. The logs are kept for 12 months, longer only where an investigation needs them.

With your consent, and only then, the site keeps a short record of the pages you viewed and the buttons you used and sends it to our own server so we can see which pages are read and where people get stuck. It holds no name or email and nothing from any other site, and our server keeps each batch for 90 days. Our cookies page lists everything the site stores and lets you change your choice; withdrawing your consent stops the collection from then on and does not affect what was lawfully collected before.

People who enquire, book a call or ask for a price

When you fill in a form on this site, book a call or email us, we collect what you give us, ordinarily your name, work email, company, role, telephone number, what you are asking about and, for a plan request, the headcount and options you chose. We use it to answer you, to prepare the call or quotation you asked for, and to follow up about our services. If you are enquiring for yourself, our lawful basis is taking steps at your request before entering into a contract with you. If you are enquiring for your employer or another organisation, our lawful basis is our legitimate interest in responding to a business enquiry and in marketing our services to organisations. You have the right to object to direct marketing at any time, and if you do we stop; every marketing email we send tells you how.

The copy of your enquiry held by our hosting provider is deleted 730 days after we receive it. The copy in our customer relationship system and our mailboxes is kept for 24 months from our last contact with you, or, where a contract follows, for the life of the client relationship and 6 years after it ends.

Our clients and their staff

We hold the business contact details of the people we deal with at client and partner organisations, and the correspondence, contracts and records of the work. Our lawful basis is our legitimate interest in managing the relationship and performing the contract with the organisation you work for. We keep contracts and the records under them for 6 years after the contract ends.

Clinicians who apply to us and work with us

If you apply to join our bench, we collect what the application asks for and what the vetting the law and our regulators require. That includes your identity, right to work, professional registration, qualifications, references, a Disclosure and Barring Service check at the level the role requires, and your indemnity arrangements. Some of that comes from you and some from other sources: your referees, the professional registers, the Disclosure and Barring Service, and any agency or platform through which you came to us. You are required to give us what the checks need; without it we cannot engage you.

Our lawful basis is taking steps at your request before a contract and then performing it, and for the checks, our legal obligations and our regulators' requirements. For information about criminal records, which the DBS check contains, we rely on the conditions the Data Protection Act 2018 sets in Schedule 1 for employment and for safeguarding.

If you are not engaged, we keep your application for 6 months from the decision, then delete it. If you are engaged, we keep your engagement file, references and vetting records for 6 years after the engagement ends, and right to work evidence for 2 years after it ends. The DBS certificate itself is not retained; the fact, date and number of the check are kept for 6 years from the date of the check. Your compliance status is held in our workforce system, which will not let a booking be made for you until a person has completed and recorded your checks.

Who we share data with

We share data with the people who need it for the purposes above and with no one else. They are our own staff and clinicians, bound by confidentiality; the service providers that process data on our instructions, in the categories of web hosting and forms, email and documents, appointment booking and online meetings, customer and clinician records, clinical records, onboarding forms, workforce scheduling and compliance, email delivery of confirmations and quotations, and the laboratories that analyse samples we take; your NHS GP, with your consent; our professional advisers and insurers where a matter requires it; and regulators and public authorities where the law requires or permits it. The current list of providers is available from us on request. We do not sell personal data and we do not share it for anyone else's marketing.

Our clinical and workforce systems are hosted in the United Kingdom. Some of our providers, including those that host this website and our email, may hold copies of data in other countries as part of running their services. Where they do, the transfer relies on the UK's adequacy regulations or on the international data transfer addendum to the standard contractual clauses in the provider's data processing terms, and you can ask us for a copy of the safeguards that apply.

How we keep it safe

We are implementing an information security management system for certification to ISO/IEC 27001:2022, and its policies were issued in September 2026. Access to personal data is limited to the people who need it. Every personal data breach is recorded and assessed and, where the law requires, reported to the Information Commissioner within 72 hours and to the people affected.

How long we keep it

The periods above come from our records retention schedule. Clinical records for 8 years after care ends, or to the 25th birthday for anyone under 18; workforce and contract records for 6 years after they end; unsuccessful applications for 6 months; enquiries for 24 months from last contact; website security logs for 12 months. At the end of a period the record is deleted from our live systems, including copies in mailboxes and forms tools; copies in backups are removed as the backups expire on their own cycle. Where a legal hold, an investigation or a regulator's request applies, deletion waits until it closes. Complaints and requests to exercise your rights are kept for 3 years after they close.

Your rights

You can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our using it, and ask for it in a form you can take elsewhere. These rights have limits: for example, we cannot delete a clinical record while the law requires us to keep it, and the right to take your data elsewhere applies to data you gave us that we process by automated means on the basis of your consent or a contract. Where we rely on your consent, you can withdraw it at any time, without affecting what was done lawfully before you withdrew it.

You have the right to object at any time to our using your data for direct marketing, and if you object we stop.

We acknowledge every request on receipt, confirm your identity where we have reason to doubt it, and answer within one month. Requests about clinical records are handled by our Chief Medical Officer, who applies the exemptions the law provides for health records where they arise. To make a request, email support@gpdq.co.uk.

We do not make decisions about you by automated means alone that have a legal or similarly significant effect on you, and we do not profile you.

If you are unhappy with how we have handled your data, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

We change this notice when what we do changes, and we show the date of the last review at the foot of the page. Material changes to how we use the data of people taking part in a programme are told to them directly.

This notice was last reviewed on 17 September 2026.

Cookies and similar technologies

This site stores very little on your device and nothing that tracks you across other sites. This page lists everything it can store, what each item is for, how long it lasts, whether it needs your consent, and how to change your choice.

What we store, and why

Nothing is stored for advertising, and no advertising or social network sets anything here. Our fonts and images are served from our own hosting, so a visit makes no request to Google, Meta or any other advertising network. The only party other than us that can set anything is Cloudflare, which serves the site.

Pages that let you configure a plan or an estimate keep your choices in the page while you use it and do not store them after you leave.

Your choice

When you first visit, a bar at the foot of the page asks whether you accept the optional storage above. Accept and Reject are the same size and each takes one click; nothing is pre-selected, and if you do nothing, nothing optional is stored. You can change your mind at any time with the button below, which clears your recorded choice and any usage record and asks you again.

Change your cookie choice

How the law applies

The Privacy and Electronic Communications Regulations require your consent before anything is stored on or read from your device, unless it is strictly necessary to provide a service you have asked for, is needed to transmit a communication, or falls within the other narrow exceptions the Regulations allow. Cloudflare's security cookie and the record of your own choice fall within those exceptions. Our usage measurement does not, which is why it is off until you switch it on. Our privacy notice explains what happens to any personal data we hold.

This page was last reviewed on 17 September 2026. It is updated whenever what the site stores changes.

Terms of use

These terms cover your use of this website. The services we provide to clients are governed by a separate client agreement and GPDQ's standard terms of business, which we provide before any contract is signed. By using this site you accept these terms. If you do not, please do not use it.

Who we are

This website is operated by GPDQ Limited, a company registered in England and Wales, company number 09635612, registered office 727-729 High Road, London N12 0BP, VAT registration number 388 4656 37. We are a healthcare provider registered with the Care Quality Commission, which regulates health and social care in England; our entry on its register is at cqc.org.uk. You can contact us at support@gpdq.co.uk or on 0203 805 1781.

What this site is for

This site describes clinical workforce services that GPDQ provides to organisations. It is written for business audiences, is not directed at patients, and does not promote any medicine. Nothing on it is medical advice. If you need medical help, contact your GP. For urgent help that is not an emergency, use NHS 111, or your local urgent care service in Northern Ireland. In an emergency call 999. The forms on this site are not a way to get medical help.

Prices and quotations

Prices and figures shown on this site are indicative. They are confirmed in a written quotation or client agreement. A plan or estimate produced on this site is an illustration based on what you entered, is subject to contract, and excludes VAT unless it says otherwise. We may change what is shown on the site at any time.

Services are under a separate agreement

Any service we provide is provided under a client agreement and our standard terms of business, which set out the services, the fees, the term, the notice periods, data protection and liability. We send those documents to you before any contract is signed. Where anything on this site differs from them, they govern.

Using the site

You may view, print and download material from this site for your own use, for evaluating our services and for sharing within your organisation and with your professional advisers for that purpose. Apart from that, and from anything the law allows, the content, design, text, images and code, which are owned by GPDQ Limited or licensed to it, may not be reproduced, distributed or used commercially without our written permission. GPDQ and the GPDQ mark are trade marks of GPDQ Limited.

You must not use the site in any way that breaks the law, that harms it or anyone else, or that attempts to gain access to any part of it you are not entitled to. Forms on the site are for genuine enquiries about our services.

Accuracy and availability

We take care to keep this site accurate and up to date and to keep it available, but we do not promise that it always will be, and we may change or withdraw any part of it. Information about our services on this site describes them and is not an offer.

Links to other sites

Where we link to another site, we do not control its content or how it handles your data, and its own terms and privacy notice apply to it. Our own responsibilities for your data are set out in our privacy notice.

Liability

This section applies only to use of this website and does not limit or exclude liability arising from services we provide. The contractual terms for those services are set out in the relevant client agreement and our standard terms of business.

Nothing in these terms limits or excludes our liability for death or personal injury caused by our negligence, for fraud or fraudulent misrepresentation, or for anything else the law does not allow us to limit or exclude. If you are a consumer, nothing in these terms affects your legal rights, including your rights under the Consumer Rights Act 2015, and we are responsible for loss you suffer that is a foreseeable result of our negligence or our breach of these terms. Nothing in these terms limits or excludes any rights or remedies you have under data protection law.

If you use this site in the course of your trade, business, craft or profession and are not acting as a consumer, we are not liable for loss of profit, business, contracts or data, or for any indirect or consequential loss, arising from your use of, or inability to use, the site.

The information on this site is provided free of charge to help you evaluate our services. Before committing expenditure or entering into a contract on the basis of information about our services, please ask us to confirm the relevant details in writing. Prices and service commitments are confirmed in a written quotation or client agreement. This paragraph does not limit or exclude liability for misrepresentation or negligent misstatement.

Your data

How we handle personal data is set out in our privacy notice, and what this site stores on your device in our cookies page. Those pages explain what we do; they are not part of these terms.

Changes and law

We may change these terms by publishing a new version on this page with a new date. The new version applies to use of the site from that date. These terms are governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction over any dispute about them, except that if you are a consumer living in Scotland or Northern Ireland you may also bring proceedings in your own courts, and you keep the protection of the mandatory laws of the country you live in.

Severability

If any part of these terms is found by a court to be unenforceable, the rest of the terms remain in force.

Waiver

If we delay in exercising a right under these terms, we have not waived our right to exercise it later.

Entire agreement

These terms are the whole agreement between you and us on your use of this website. They do not affect any client agreement, and nothing in them excludes liability for fraudulent misrepresentation.

These terms were last reviewed on 17 September 2026.

Data processing agreement

Where GPDQ processes personal data on a client's behalf, the law requires a written agreement setting out what we do and on whose instructions. These are the standard terms we offer. They are incorporated into a client agreement by reference, and a client agreement may add to them but may not reduce the obligations that Article 28 of the UK GDPR requires.

1. What this agreement covers

This agreement applies wherever GPDQ Limited, company number 09635612 (the processor), processes personal data on behalf of a client (the controller) in the course of providing services under a client agreement. It gives effect to Article 28 of the UK General Data Protection Regulation. Whether GPDQ acts as processor or as controller for a given service is agreed in writing in the client agreement before the service starts; where GPDQ is the controller, our privacy notice applies instead.

2. The processing

The subject matter and duration of the processing, its nature and purpose, the types of personal data, the categories of data subject, and the controller's obligations and rights are set out in a processing schedule to the client agreement, which is completed before processing starts. For a clinical service the data will ordinarily be the identity and contact details of the people receiving care and their clinical information, which is special category data, together with the identity of the client's staff who administer the service.

3. Our obligations

We process personal data only on the client's documented instructions, including any transfer outside the United Kingdom, unless UK law requires us to do otherwise, in which case we tell the client of that requirement before processing unless the law prohibits us from doing so on important grounds of public interest. We tell the client at once if we believe an instruction breaks data protection law.

We make sure that everyone we authorise to process the data is bound by a duty of confidentiality, whether under contract or, for our clinicians, by their professional obligations as well.

We implement the technical and organisational measures Article 32 requires, appropriate to the risk, and we set out the measures that apply to a service in the processing schedule before processing starts. We are implementing an information security management system for certification to ISO/IEC 27001:2022, and its policies were issued in September 2026.

Taking into account the nature of the processing, we assist the client by appropriate technical and organisational measures, insofar as this is possible, in responding to people exercising their rights, and we route any request we receive to the client within 5 working days. Taking into account the nature of the processing and the information available to us, we assist the client in meeting its obligations on security, on notifying breaches, on data protection impact assessments and on prior consultation with the Information Commissioner.

We tell the client without undue delay after becoming aware of a personal data breach affecting the client's data, and in any event within 48 hours, and we give the client the information it needs to meet its own reporting duties.

At the end of the services we delete or return the personal data as the client chooses, and delete the copies we hold, unless UK law requires us to retain a record, in which case we tell the client which law and what we keep.

We make available to the client all the information needed to show that we meet these obligations, and we allow and contribute to audits and inspections by the client or an auditor it appoints, on reasonable notice and at reasonable intervals, and at any time a breach, a regulator or a credible concern makes one necessary.

4. Sub-processors

The client gives its general written authorisation for us to use sub-processors, and the current list is set out in the processing schedule. Those in general use across our services provide email and documents, web hosting, customer records, clinical records, forms, workforce scheduling and compliance, and email delivery. We tell the client before adding or replacing a sub-processor and give it the opportunity to object. We impose the same data protection obligations on every sub-processor by written contract, and we remain fully responsible to the client for its performance.

5. International transfers

Our clinical and workforce systems are hosted in the United Kingdom. Where a sub-processor holds data outside the United Kingdom, the transfer is made under the UK's adequacy regulations or under the international data transfer addendum to the standard contractual clauses, the processing schedule says which, and a copy of the safeguards is available to the client on request.

6. The client's obligations

The client is responsible for the lawfulness of the processing it instructs, for having a lawful basis and, for special category data, a condition for it, for giving the people concerned the information the law requires, and for the accuracy of the data it provides.

7. Liability and term

Liability under this agreement is governed by the liability clause of the client agreement. This agreement lasts as long as we process personal data for the client, and the obligations of confidentiality and deletion survive its end.

8. Agreeing it

This agreement is incorporated into a client agreement by reference to this page and the date shown below, or by a signed copy. Where a client prefers its own form of processing terms, we will review it. Where the two conflict, the signed document governs, except that nothing in either can reduce what Article 28 requires.

Version of 17 September 2026.