Privacy Policy

1. Who we are

WMG Health is the customer-facing brand for our private diagnostics service and, through our WMG Meds service, our prescription medication service. Two registered companies sit behind it:

• Westminster Medical Group (Company No. 11237471) holds the Care Quality Commission (CQC) registration and is responsible for all clinical services, including blood draws, sample handling, clinical review of results, and any follow-up care. Westminster Medical Group is the data controller for your clinical and health information.
• WMG Health Ltd (Company No. 17127236) provides the booking, payment, and customer-facing commercial services. WMG Health Ltd is the data controller for your booking, order and payment information.

Both companies are registered in England and Wales, and services are provided at 134 Harley Street, London W1G 7JY. An intercompany data sharing arrangement is in place to allow your booking information to flow to the clinical team and your results to flow back to you securely.

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For any privacy matters, you can contact us at: health@wmglondon.com or by post to our clinic address.

2. What data we collect

We may collect and process the following categories of personal data:

• Identity data: your name, date of birth, sex, NHS number (if provided), and a record of any identity check we carry out
• Contact data: email address, telephone number, postal address, and a delivery address where medication is sent to you
• Health data: blood test results, diagnostic reports, clinical notes, and the medical history you share with us. If you use our medication service this also includes your assessment answers (such as medical history, current medicines and allergies), the clinician's decision, prescriptions and your order history, and any progress photos you upload to your patient portal. This is special category data under UK GDPR
• Payment data: billing address, payment confirmation and payment history (card details are processed by our payment provider and never stored by us)
• Account and consent data: your patient portal account details, records of the consents you give us, and, if you switch on notifications, the device information needed to send them
• Technical data: IP address, browser type and version, pages visited, time and date of visits (collected via server logs)
• Communications: enquiry form submissions, emails, call records

3. How we collect your data

• When you complete our online booking or enquiry form
• When you call or email us directly
• When you attend our clinic and a blood draw is performed
• When you access our website (technical data via server logs)
• From our laboratory partners, who process your samples and return results to us

4. Legal basis for processing

We rely on the following lawful bases under UK GDPR:

• Contract performance, to fulfil your booking and deliver your test results
• Legal obligation, to comply with CQC, GMC, and HMRC requirements
• Vital interests, in an emergency, to protect your life or that of another person
• Legitimate interests, to improve our services, prevent fraud, and maintain clinic security
• Provision of health care (UK GDPR Article 9(2)(h)), for health (special category) data, where we process it to provide your care, such as blood testing, clinical review of your results and prescribing, by or under the responsibility of a health professional who owes a duty of confidentiality. This also allows us to keep the clinical record that the law requires.
• Explicit consent, for optional extras and for marketing, where we ask for it (for example, progress photos you choose to upload and marketing messages). You may withdraw consent at any time. We also ask for your agreement to your treatment as a matter of good clinical practice, and that is separate from the legal basis for handling your data.

5. How we use your data

• To book and confirm your appointment
• To perform your requested blood tests and deliver results to your secure patient portal
• If you use our medication service, to assess whether prescribing is appropriate, issue prescriptions, arrange dispensing and delivery, and review your treatment before repeat supplies
• To have a GMC-registered clinician review and annotate your results
• To contact you if your results require urgent clinical follow-up
• To send appointment reminders and results notifications
• To respond to your enquiries
• To maintain clinical records in accordance with our CQC registration obligations
• To process your payment
• To send marketing communications only with your explicit opt-in consent

Decisions about your care. Our online medication assessment uses safety rules that flag particular answers for clinical attention. These rules do not decide whether you are prescribed anything. A GMC-registered doctor reviews your case and makes every prescribing decision.

6. Sharing your data

We do not sell your personal data. We share it only where necessary:

• Accredited UK laboratories, to process your blood samples. These partners are bound by data processing agreements and operate under UKAS accreditation
• Westminster Medical Group clinicians, GMC-registered doctors who review your results and, where you use our medication service, prescribe
• Our patient and booking platform (Marlmed), which we use to manage enquiries, appointments and bookings and which also holds your clinical record: assessments, results, prescriptions, orders and decisions, your patient portal account and any progress photos you upload. When you submit an enquiry or booking through our website, the details you provide (such as your name, date of birth, contact details, and the tests or panel you are interested in) are securely transmitted to this platform so our team can respond and arrange your care. Marlmed acts as our data processor under a data processing agreement
• Our transactional email provider (Resend), which delivers the emails we send to patients and to our clinicians, including enquiry notifications, confirmations, payment links and results notifications. The content of those emails passes through this provider solely to deliver the message, under a data processing agreement
• Payment processor (Stripe), to process your payment securely (PCI-DSS compliant)
• Our partner pharmacy (Certus Healthcare Ltd, trading as Primed Pharmacy), if you use our medication service. It receives your name, date of birth, delivery address and prescription so that it can dispense your medication, and it handles that information under its own professional and regulatory obligations
• Delivery providers, who receive your name and delivery address so that medication can be delivered to you
• Hosting and security providers, our systems are hosted in the UK (DigitalOcean, London), and Cloudflare delivers and protects our websites, so web traffic passes through its network. Both operate under data processing agreements
• Legal or regulatory authorities, where required by law (e.g., CQC inspection, court order)
• Your GP or other clinicians, only with your explicit written consent

All third parties are required to process your data securely and only for the specified purpose, and act on our instructions under written data processing agreements.

7. International transfers

Our systems are hosted in the UK. However, some of the service providers we use are based in, or process data in, the United States, so some of your personal data is transferred there as part of normal operation. These are Resend (email delivery), Stripe (payments), Cloudflare (website delivery and security), Google Analytics (only if you accept analytics cookies), and Sentry (error monitoring on our patient platform, with personal data removed before it is sent).

Wherever we transfer personal data outside the UK, we make sure it is protected by an appropriate safeguard, such as the UK-US data bridge where the provider is certified under it, or the UK International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses.

8. Data retention

We retain your health records for a minimum of 8 years from your last appointment in accordance with NHS and CQC guidance for private healthcare providers.

Enquiry data (where no appointment was booked) is kept only for as long as it is needed to respond to you and to follow up on your enquiry, and is reviewed periodically. You can ask us to delete your enquiry at any time by emailing health@wmglondon.com.

Payment records are retained for 7 years for HMRC compliance.

9. Your rights

Under UK GDPR, you have the right to:

• Access, request a copy of the personal data we hold about you (Subject Access Request)
• Rectification, ask us to correct inaccurate data
• Erasure, ask us to delete your data, subject to our retention obligations
• Restriction, ask us to limit how we use your data
• Portability, receive your data in a machine-readable format
• Object, object to processing based on legitimate interests or for direct marketing
• Withdraw consent, at any time, where processing is based on consent

To exercise any of these rights, contact us at health@wmglondon.com. We will respond within one calendar month.

10. Cookies and website analytics

Essential storage. Our site stores a small piece of data in your browser (using local storage) to remember your cookie preference, so we don't show you the consent banner on every page load. This is operationally necessary, contains no personal information, and is not used for tracking. Our server also keeps standard logs (IP address, page requests, timestamps) for security and uptime monitoring.

Optional analytics cookies. If you accept via our cookie banner, we use Google Analytics to understand which pages and panels are most useful to visitors and to improve the site. Analytics cookies are set in your browser and process anonymised usage data on our behalf. IP addresses are anonymised before storage. We do not link analytics data to your identity or your clinical record.

What the analytics record. If you accept, the analytics describe how the site is used: which pages are viewed, which buttons and links are clicked, how far down a page you read, and whether an enquiry form is started or completed. We never send what you type into a form, your date of birth, your contact details or any health information to Google Analytics, and we do not use the data for advertising or remarketing.

How you arrived. If you accept, we also keep a first-party cookie for up to 30 days that notes how you first arrived (for example the campaign link or website you came from). If you then send an enquiry, it is saved with your enquiry so we can tell which of our pages and campaigns are useful.

If you decline, no analytics cookies are set and no analytics usage data is collected. You can change your choice at any time by clearing your browser's site data for this domain, which will re-show the banner.

We do not use advertising cookies, retargeting pixels, or social media tracking pixels (no Meta Pixel, no LinkedIn Insight Tag, no advertising trackers of any kind).

11. Security

We implement appropriate technical and organisational measures to protect your data, including:

• TLS encryption for all data in transit
• Encrypted storage for health records
• Access controls and staff training
• Regular security reviews

In the event of a data breach that is likely to affect your rights, we will notify you and the Information Commissioner's Office (ICO) within 72 hours as required by law.

12. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns directly first. Please contact us at health@wmglondon.com.

13. Changes to this policy

We may update this Privacy Policy from time to time. The date at the top of this page reflects the most recent revision. Significant changes will be communicated to active patients by email.