Skip to Content

Privacy Notice

Version 2026.04-DRAFT — effective 2026-06-01

DRAFT — not for production. This privacy notice has not yet been reviewed and signed off by the Data Protection Officer. The Registered Manager must replace this text before patients are onboarded.

Privacy Notice

Version 2026.04-DRAFT — placeholder pending DPO sign-off.

1. Who we are

Threevo Solutions Inc. (the "practice", "we", "us") is the data controller for the personal information you provide to us through this website and during the provision of medical care.

2. Data Protection Officer

Our Data Protection Officer is the Data Protection Officer. You can contact the DPO at dpo@anae.example for any question about how your personal data is handled, or to exercise your rights under UK GDPR.

3. Categories of personal data we process

  • Identity and contact details (name, date of birth, address, phone, email).
  • NHS number, where you have provided one.
  • Health and medical data, including consultation notes, prescriptions, results, and referrals (special category data under UK GDPR Article 9).
  • Account credentials and audit logs of your access to the patient portal.
  • Payment data processed by our payment provider (Stripe). We do not store card numbers ourselves.

4. Lawful basis

We process clinical data under UK GDPR Article 9(2)(h) (provision of health and social care). This is a legal basis and is not based on your consent. We process your contact details under Article 6(1)(b) (contract: providing the services you request) and Article 6(1)(c) (legal obligation, including statutory record keeping). We send you marketing communications only where you have given explicit, separate, opt-in consent under Article 6(1)(a), and we use anonymised data for research only with your separate consent.

5. Your rights

You have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Have your data erased, where the law permits (note: clinical records have statutory retention and cannot be deleted on request).
  • Restrict or object to processing in certain circumstances.
  • Receive a copy of your data in a portable format.
  • Withdraw any consent you have given (this does not affect lawfulness of past processing).
  • Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

6. Retention

Clinical records are retained in accordance with NHS retention schedules — typically a minimum of 10 years after last contact, and longer for certain record types. Non-clinical data is kept only as long as necessary for the purposes for which it was collected.

7. International transfers

Personal data is stored on servers located in the United Kingdom. Where data is transferred outside the UK (for example, to our technical service providers), we rely on the UK International Data Transfer Agreement or equivalent safeguards.

8. Changes to this notice

We will notify you of material changes to this notice through the patient portal and at the next point of contact. The version label and effective date at the top of this page identify the version currently in force.