Privacy policy

Oxford Medical Group is committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What Data We Collect

We collect personal data necessary to provide medical services, including:

  • Contact details (name, address, phone number, email)
  • Medical history and health records
  • Payment and insurance information
  • Emergency contact details
  • CCTV footage (where security cameras are in use)

Why We Use Your Data

We process your personal data for:

  • Providing healthcare services – diagnosing, treating, and monitoring your health
  • Legal and regulatory obligations – maintaining clinical records as required by law
  • Appointment management – scheduling and reminding you of appointments
  • Billing and payment – processing fees and insurance claims
  • Quality and safety – conducting audits and improving service delivery

Legal basis: Your explicit consent (where required), contractual necessity, legal obligation, and our legitimate interests in providing safe, effective care.

Use of AI for Administrative Tasks

We use artificial intelligence (AI) to assist with certain administrative functions, including:

  • Scheduling and appointment reminders
  • Initial patient inquiry responses
  • Document organization and record management
  • Basic billing inquiries

Important: AI systems are not used for clinical decision-making or diagnosing conditions. All clinical decisions remain the responsibility of qualified healthcare professionals.

Your personal data processed by AI tools is encrypted and anonymized where possible. All AI vendors comply with UK GDPR requirements and are bound by Data Processing Agreements.

Who We Share Your Data With

We may share your data with:

  • NHS services (where clinically necessary or legally required)
  • Insurance providers (with your consent)
  • Third-party service providers (IT support, billing, appointment systems)
  • Regulatory bodies (GMC, CQC, or other authorities)
  • Emergency services (in life-threatening situations)

We do not sell your data to third parties.

Your Rights

You have the right to:

  • Access your personal data (Subject Access Request)
  • Correct inaccurate information
  • Erase your data (right to be forgotten) – subject to legal retention requirements
  • Restrict processing of your data
  • Data portability – receive your data in a structured format
  • Object to processing
  • Not be subject to automated decision-making – you have the right to human review of any AI-generated administrative decisions that significantly affect you

To exercise any of these rights, contact us using the details below.

Data Retention

We retain your medical records for:

  • Active patients: Duration of treatment plus 6 years after last appointment
  • Deceased patients: 2-3 years after death (or as legally required)
  • Minors: Until age 25 or 8 years after last appointment (whichever is later)

Administrative data (emails, appointment records) is retained for up to 1 year unless clinically relevant.

Security

We protect your data through:

  • Encrypted digital storage and communication
  • Restricted staff access (only those with a legitimate need)
  • Regular security audits and staff training
  • Secure disposal of paper records (shredding/incineration)

Cookies and Tracking

Our website may use cookies to improve functionality. You can manage cookie preferences in your browser settings.

Cookies are small text files placed on your device when you visit a website. This website uses essential and functional cookies – for example, to remember choices you make during your visit and to help pages load quickly. We do not use advertising cookies. To learn more about cookies and how to manage them, visit www.aboutcookies.org.

Data Breach

In the event of a data breach affecting your rights, we will notify you and the ICO within 72 hours as required by law.

Website Enquiry Forms

When you use the enquiry or booking forms on this website, we ask for information such as your name, contact details and brief details of your enquiry. This information is sent securely to our team and is used only to respond to your enquiry and, where relevant, to arrange your care. It is not used for marketing purposes without your explicit consent.

Google Analytics

We use Google Analytics, a third-party service, to collect anonymised statistics about how visitors use our website, such as device type, approximate location and pages visited. This information helps us make improvements to the site and cannot be used to identify you personally. Google Analytics sets cookies to help us estimate visitor numbers and usage patterns. For more information on how Google Analytics processes this information, visit www.google.com/analytics.

Email Marketing

If you sign up to receive emails from us, we will use the information you provide only to deliver the service you have requested. We will never automatically sign you up to marketing emails – we will only send them with your explicit consent, and every marketing email we send will give you the opportunity to unsubscribe. If you unsubscribe, we will remove you from our mailing list immediately and keep a record of your email address only for suppression purposes.

Links to Other Websites

This privacy policy relates only to this website and does not cover links to other websites. We encourage you to read the privacy statements of any other websites you visit after following an external link.

About This Website

This website is owned and operated by Oxford Medical Group LTD, a company registered in England and Wales with company number 13631345.

Contact Us

Data Protection Officer / Privacy Contact: Professor M. Dominik Fischer, 35 Pound Lane, Marlow SL7 2AZ, United Kingdom
Phone: 01865 477 803
Email: info@oxfordmedicalgroup.co.uk

To lodge a complaint with the ICO: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Phone: 0303 123 1113
www.ico.org.uk

Changes to This Notice

We may update this privacy notice to reflect changes in law or our practices. We will notify you of significant changes by email or when you next visit.

Last updated: 8th July 2026