Privacy notice

This notice explains what personal data GPDQ Limited collects, why, on what legal basis, who we share it with, how long we keep it and what your rights are. It covers everyone whose data we hold: people who visit this site or contact us, the organisations we work with and their staff, and the clinicians who apply to us and work with us.

Who we are and how to reach us

GPDQ Limited is a healthcare provider registered with the Care Quality Commission. We are registered in England and Wales, company number 09635612, at 727-729 High Road, London N12 0BP. We are registered with the Information Commissioner's Office as a data controller, registration number ZA147981. For anything in this notice, email support@gpdq.co.uk marked for the attention of the data protection lead, or write to us at 727-729 High Road, London N12 0BP. Because of the scale of health data we hold we are required to have a data protection officer; the appointment is in hand, and the officer's contact details will replace the address above when it is made.

The roles we play

For everything in this notice we are the controller, which means we decide why and how your data is used, unless a section says otherwise. Two exceptions matter. Where our prescribers or other clinicians work inside a client's own clinical system, the client remains the regulated provider and the controller of its patients' records; our clinicians use those records under the client's arrangements and our written agreement with it, and the client's privacy notice covers that care. Where we deliver a programme commissioned by an NHS body or a local authority, that body is the controller or shares that role with us under a written arrangement, its own notice applies as well, and we tell you so when you attend.

Visitors to this site

When you visit, our hosting provider records the technical details every web server records, such as your IP address, the pages requested and the browser used, in security logs. We use them to keep the site available and secure. Our lawful basis is our legitimate interest in running a secure service. The logs are kept for 12 months, longer only where an investigation needs them.

With your consent, and only then, the site keeps a short record of the pages you viewed and the buttons you used and sends it to our own server so we can see which pages are read and where people get stuck. It holds no name or email and nothing from any other site, and our server keeps each batch for 90 days. Our cookies page lists everything the site stores and lets you change your choice; withdrawing your consent stops the collection from then on and does not affect what was lawfully collected before.

People who enquire, book a call or ask for a price

When you fill in a form on this site, book a call or email us, we collect what you give us, ordinarily your name, work email, company, role, telephone number, what you are asking about and, for a plan request, the headcount and options you chose. We use it to answer you, to prepare the call or quotation you asked for, and to follow up about our services. If you are enquiring for yourself, our lawful basis is taking steps at your request before entering into a contract with you. If you are enquiring for your employer or another organisation, our lawful basis is our legitimate interest in responding to a business enquiry and in marketing our services to organisations. You have the right to object to direct marketing at any time, and if you do we stop; every marketing email we send tells you how.

The copy of your enquiry held by our hosting provider is deleted 730 days after we receive it. The copy in our customer relationship system and our mailboxes is kept for 24 months from our last contact with you, or, where a contract follows, for the life of the client relationship and 6 years after it ends.

Our clients and their staff

We hold the business contact details of the people we deal with at client and partner organisations, and the correspondence, contracts and records of the work. Our lawful basis is our legitimate interest in managing the relationship and performing the contract with the organisation you work for. We keep contracts and the records under them for 6 years after the contract ends.

Clinicians who apply to us and work with us

If you apply to join our bench, we collect what the application asks for and what the vetting the law and our regulators require. That includes your identity, right to work, professional registration, qualifications, references, a Disclosure and Barring Service check at the level the role requires, and your indemnity arrangements. Some of that comes from you and some from other sources: your referees, the professional registers, the Disclosure and Barring Service, and any agency or platform through which you came to us. You are required to give us what the checks need; without it we cannot engage you.

Our lawful basis is taking steps at your request before a contract and then performing it, and for the checks, our legal obligations and our regulators' requirements. For information about criminal records, which the DBS check contains, we rely on the conditions the Data Protection Act 2018 sets in Schedule 1 for employment and for safeguarding.

If you are not engaged, we keep your application for 6 months from the decision, then delete it. If you are engaged, we keep your engagement file, references and vetting records for 6 years after the engagement ends, and right to work evidence for 2 years after it ends. The DBS certificate itself is not retained; the fact, date and number of the check are kept for 6 years from the date of the check. Your compliance status is held in our workforce system, which will not let a booking be made for you until a person has completed and recorded your checks.

Who we share data with

We share data with the people who need it for the purposes above and with no one else. They are our own staff and clinicians, bound by confidentiality; the service providers that process data on our instructions, in the categories of web hosting and forms, email and documents, appointment booking and online meetings, customer and clinician records, clinical records, onboarding forms, workforce scheduling and compliance, email delivery of confirmations and quotations, and the laboratories that analyse samples we take; your NHS GP, with your consent; our professional advisers and insurers where a matter requires it; and regulators and public authorities where the law requires or permits it. The current list of providers is available from us on request. We do not sell personal data and we do not share it for anyone else's marketing.

Our clinical and workforce systems are hosted in the United Kingdom. Some of our providers, including those that host this website and our email, may hold copies of data in other countries as part of running their services. Where they do, the transfer relies on the UK's adequacy regulations or on the international data transfer addendum to the standard contractual clauses in the provider's data processing terms, and you can ask us for a copy of the safeguards that apply.

How we keep it safe

We are implementing an information security management system for certification to ISO/IEC 27001:2022, and its policies were issued in September 2026. Access to personal data is limited to the people who need it. Every personal data breach is recorded and assessed and, where the law requires, reported to the Information Commissioner within 72 hours and to the people affected.

How long we keep it

The periods above come from our records retention schedule. Clinical records for 8 years after care ends, or to the 25th birthday for anyone under 18; workforce and contract records for 6 years after they end; unsuccessful applications for 6 months; enquiries for 24 months from last contact; website security logs for 12 months. At the end of a period the record is deleted from our live systems, including copies in mailboxes and forms tools; copies in backups are removed as the backups expire on their own cycle. Where a legal hold, an investigation or a regulator's request applies, deletion waits until it closes. Complaints and requests to exercise your rights are kept for 3 years after they close.

Your rights

You can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to our using it, and ask for it in a form you can take elsewhere. These rights have limits: for example, we cannot delete a clinical record while the law requires us to keep it, and the right to take your data elsewhere applies to data you gave us that we process by automated means on the basis of your consent or a contract. Where we rely on your consent, you can withdraw it at any time, without affecting what was done lawfully before you withdrew it.

You have the right to object at any time to our using your data for direct marketing, and if you object we stop.

We acknowledge every request on receipt, confirm your identity where we have reason to doubt it, and answer within one month. Requests about clinical records are handled by our Chief Medical Officer, who applies the exemptions the law provides for health records where they arise. To make a request, email support@gpdq.co.uk.

We do not make decisions about you by automated means alone that have a legal or similarly significant effect on you, and we do not profile you.

If you are unhappy with how we have handled your data, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

We change this notice when what we do changes, and we show the date of the last review at the foot of the page. Material changes to how we use the data of people taking part in a programme are told to them directly.

This notice was last reviewed on 17 September 2026.