​Summary

• GWP Medical Services is a CQC-registered healthcare provider. We are the controller of the patient care records we create when we treat or transport you.

• We collect only what we need for safe care, running our services and meeting legal duties.

• We do not sell personal information, and we do not give event organisers or employers identifiable clinical information.

• Adult patient records are kept for 8 years and children's records until at least their 25th birthday, then securely destroyed.

• You can ask to see, correct or query your information, or make a complaint, by emailing admin@gwpmedical.co.uk.

1. Introduction

GWP Medical Services Ltd ("GWP", "we", "us" or "our") respects the privacy, dignity and confidentiality of everyone who uses or interacts with our services. As a Care Quality Commission (CQC) registered healthcare provider, we take particular care with patient information.

This policy explains how we collect, use, store, share and protect personal information across our services:

• Event medical cover and first aid.

• Ambulance and patient transport services.

• Medical repatriation and patient transfers.

• Clinical assessments, treatment and medical advice.

• Medical consultancy and associated healthcare services.

• Business enquiries, quotations and bookings.

• Recruitment, employment and contractor management.

• Our website, telephone and electronic communications.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (as amended, including by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations 2003 (PECR), the common law duty of confidentiality and relevant professional standards.

This policy is written mainly for patients, clients and website visitors. Staff, contractors and applicants receive a separate workforce privacy notice, which sets out how we use their information, the legal bases and retention periods. [CONFIRM: workforce notice drafted and issued]

2. Who We Are

GWP Medical Services Ltd is a company registered in England and Wales.

• Registered company name: GWP Medical Services Ltd

• Company registration number: 11866707

• ICO registration number: ZB149940

• Regulatory status: CQC registered healthcare provider

• Registered office: Hurst Farm, Cheverell Green Rd, Devizes SN10 5UN

• Correspondence address: Hurst Farm, Cheverell Green Rd, Devizes SN10 5UN

• Email: admin@gwpmedical.co.uk

• Telephone: 0330 043 0797

• Website: www.gwpmedical.co.uk

​

How we act: controller or processor

• Our own services. For patient care records created at events, in ambulances and during transfers or repatriation, GWP is the controller.

• Services for another provider. Where an NHS body or another healthcare provider subcontracts us, our roles follow the contract. We can tell you who the controller is on request.

• Clients and event organisers. We are the controller of their business contact and booking details. They receive anonymised or aggregated clinical information only (see section 10).

• Staff, contractors and applicants. GWP is the controller.

• Website and systems. GWP is the controller. Providers who handle information on our behalf are listed in section 13.

3. What Information We Collect

What we collect depends on our relationship with you and the services we provide.

3.1 Patients and service users

• Name, date of birth, address and contact details.

• NHS number or other patient identifiers, where relevant.

• Emergency contact and next-of-kin details.

• Medical history, existing conditions, current medication and allergies.

• Details of injuries, illnesses and clinical presentations.

• Clinical assessments, observations and examination findings.

• Treatment, medication and interventions provided.

• Safeguarding information.

• Referral, conveyance and clinical handover information.

• Communications with other healthcare professionals.

• Clinical photographs (see section 8).

• For children and people who may lack capacity: details of parents, guardians, carers or representatives, and how consent and capacity were considered (see section 23).

• For repatriation and transfers: travel, insurer or assistance-company, and receiving-facility details.

• Any other information needed for safe assessment, treatment or ongoing care.

Information about your health is special category personal data under UK GDPR and receives additional protection.

3.2 Clients and event organisers

• Names and business contact details.

• Organisation and event details, locations and dates.

• Medical cover requirements.

• Contract and booking information.

• Correspondence and operational instructions.

• Invoicing, payment and financial information.

3.3 Employees, contractors and applicants

We collect identity, contact, employment history, qualifications, professional registration, training and competency records, right-to-work documents, DBS information (which is criminal offence data), availability and attendance, payroll and tax details, fitness-for-work or occupational health information where necessary, and conduct, safeguarding and clinical governance records. Our separate workforce privacy notice gives the detail, including legal bases and retention periods.

3.4 Website visitors

• Information you give through contact and enquiry forms, such as name, telephone number and email address.

• IP address, device, browser and operating system information.

• Website activity and usage information.

• Your cookie preferences.

• Analytics and advertising identifiers, only if you consent through our cookie banner (see section 19).

3.5 Recordings and monitoring

• Telephone call recordings (section 17).

• CCTV images at our head office (section 18).

• [CONFIRM: vehicle tracking, dashcams or body-worn cameras. Add them here and in section 18 if used; delete this line if not.]

4. How We Collect Information

We may obtain personal information:

• Directly from you when you contact or use our services.

• During clinical assessment, treatment or patient transport.

• From event organisers, employers or organisations arranging healthcare services.

• From NHS organisations, hospitals, healthcare professionals or other care providers.

• From insurers, assistance companies, relatives, carers, witnesses or emergency services.

• Through job applications and workforce management.

• Through our website, telephone and electronic communication systems.

• From regulatory and professional bodies where necessary and lawful.

Giving you privacy information. A patient needing emergency care cannot be given a privacy notice at the time. Instead, this policy is published on our website, [CONFIRM: and available by QR code or leaflet at medical posts and in vehicles,] and clinicians will explain how your information is used at a suitable point, such as handover or discharge, when you ask, or when it is safe to do so.

Where we receive information about you from someone else, we will give you privacy information within one month, or at our first contact with you if that is sooner, unless an exemption applies.

5. Why We Use Personal Information

We use personal information only for purposes connected with delivering and managing our services, and aim to use only what is necessary and proportionate for each.

• Medical assessment and treatment. Providing care, recording assessments, giving treatment, arranging referrals and maintaining continuity of care.

• Patient safety. Clinical handovers, safeguarding, incident management and communication with other healthcare providers.

• Clinical governance and learning. Record audits, incident and complaint review, clinical supervision, training and service improvement.

• Claims and legal matters. Handling insurance claims, legal claims and requests from insurers, solicitors, coroners or the police where lawful.

• Business operations. Enquiries, quotations, bookings, contracts, invoicing and communications.

• Workforce management. Recruitment, checking qualifications, allocating duties, training records and payments.

• Regulatory compliance. Meeting statutory, financial, employment, healthcare and regulatory obligations, including CQC requirements.

• Security and quality. Telephone recording and head-office CCTV.

• Website operation. Keeping the site working, answering enquiries, measuring performance and, only with your consent, advertising measurement.

• Marketing. We do not currently send promotional marketing (section 20).

6. Our Legal Basis for Processing Information

Under UK GDPR we must have a lawful basis (Article 6) for using personal information, and an additional condition (Article 9) for health and other special category data. The table shows the main bases for each purpose.

Purpose

Article 6 lawful basis

Article 9 condition (health data) or Article 10

Providing care: assessment, treatment, transport, handover

Legitimate interests 6(1)(f). Vital interests 6(1)(d) in emergencies. Contract 6(1)(b) where we treat you under a contract with you. Public task 6(1)(e) for NHS-commissioned work, as the contract sets out.

Health or social care 9(2)(h) with DPA 2018 Schedule 1. Vital interests 9(2)(c) where you cannot consent.

Safeguarding children and adults at risk

Legal obligation 6(1)(c) or legitimate interests 6(1)(f)

Substantial public interest 9(2)(g), safeguarding condition in DPA 2018 Schedule 1

Clinical governance, audit and learning

Legitimate interests 6(1)(f)

9(2)(h)

Claims, complaints and legal advice

Legitimate interests 6(1)(f)

Legal claims 9(2)(f)

Regulatory compliance (for example CQC)

Legal obligation 6(1)(c)

9(2)(h)

Client contracts, bookings and invoicing

Contract 6(1)(b) or legitimate interests 6(1)(f)

Not applicable

Staff, contractor and applicant records

Contract 6(1)(b) and legal obligation 6(1)(c)

Employment 9(2)(b) and occupational health 9(2)(h). DBS data under Article 10 with a DPA 2018 Schedule 1 condition.

Telephone recording

Legitimate interests 6(1)(f)

Legal claims 9(2)(f) or 9(2)(h) where a call is part of clinical care [CONFIRM]

Head-office CCTV

Legitimate interests 6(1)(f)

Not applicable

Website operation and essential cookies

Legitimate interests 6(1)(f)

Not applicable

Analytics and advertising cookies

Consent 6(1)(a)

Not applicable

Our legitimate interests include delivering and administering healthcare services, maintaining safe and effective operations, managing client relationships, protecting premises, vehicles and medicines, clinical governance and quality assurance, and investigating incidents and protecting legal rights. We weigh these against your rights and freedoms and keep a record of that assessment. 

Consent. Where we rely on consent, such as non-essential cookies, you can withdraw it at any time without affecting earlier processing.

Consent to treatment is not data protection consent. Agreeing to treatment is a separate matter from UK GDPR consent. We do not rely on UK GDPR consent to keep the clinical records needed for safe care.

Criminal offence data and special conditions. We process DBS and other criminal offence information only where an Article 10 condition applies, and we keep an appropriate policy document for processing that relies on DPA 2018 Schedule 1 conditions. [CONFIRM: appropriate policy document in place]

Professional confidentiality. Health data is processed by healthcare professionals, or by staff working under equivalent duties of confidentiality.

7. Patient Confidentiality and Medical Records

Protecting patient confidentiality is fundamental to our services. We treat personal and medical information as confidential wherever care is given: sporting events, festivals, workplaces, public events, ambulances and other settings.

We keep electronic Patient Care Records of clinical assessments, observations, treatment, referrals and decisions. They support safe care, clinical accountability, communication with receiving professionals, continuity of treatment, clinical governance, and legal and professional record-keeping.

Patient Care Records are stored in ConnectTeams, which holds patient information on UK-based servers. [CONFIRM: supplier documentation and data processing agreement support this statement.] Any other system that holds patient information is listed in section 13, with where it processes data.

Only authorised personnel with a clinical, operational, governance or legal reason can access identifiable patient records. Employees and contractors are bound by professional and contractual confidentiality obligations.

8. Clinical Photographs and Images

Our clinicians take photographs only where clinically appropriate, for example wounds, injuries, burns, other visible conditions, or scenes relevant to an injury mechanism or patient safety. [CONFIRM: photographs are taken only on company-approved devices or apps, uploaded to the Patient Care Record and removed from the device. Otherwise change this wording.]

• Photographs form part of the Patient Care Record and are treated as confidential medical information.

• A photograph is taken only where there is a clinical purpose and a lawful basis. Clinicians obtain agreement, or act in line with consent, capacity, safeguarding and confidentiality rules.

• We take proportionate steps to protect other people who appear in a photograph.

• We do not take clinical photographs for promotion or advertising, and we do not publish identifiable patient photographs without your permission and a valid legal basis.

• Photographs are kept for the same period as the rest of the record (section 16).

9. Sharing Patient Information With Healthcare Providers and Others Involved in Your Care

To give safe and effective care we share relevant information with other healthcare providers, including NHS ambulance services, hospital emergency departments, NHS trusts, general practitioners, specialist services and receiving clinical teams. This may include observations, assessments, relevant history, treatment given and onward care needs. We share only what is necessary and lawful, taking account of data protection law, professional duties and the common law duty of confidentiality, without compromising patient safety.

Repatriation and transfers. For medical repatriation and patient transfers, we may also share necessary information with:

• Insurers and assistance companies arranging or funding the transfer.

• Airlines and air ambulance or other transport operators, for example for fitness-to-travel assessments.

• Overseas hospitals and clinicians receiving the patient (see section 14).

• Embassies or consulates, where needed.

• Your family or representatives, where you agree or another lawful basis applies.

10. Information Shared With Event Organisers and Employers

Organisations that commission our services, including event organisers and employers, do not automatically have the right to see patients' confidential medical information, even where they have paid for the cover.

We may give anonymised or aggregated information such as numbers of patients assessed or treated, general categories of incident, broad patterns of medical activity, operational concerns and recommendations for improving medical or event arrangements. We will not routinely give identifiable clinical records to organisers or employers. Where identifiable information must be disclosed, we make sure there is a lawful basis and that confidentiality requirements are met.

We may disclose information without patient agreement where the law permits or requires it, including serious safeguarding concerns.

11. Safeguarding, Serious Incidents and Legal Disclosures

We safeguard children and adults at risk. Where necessary and lawful, we may share information with local authority safeguarding teams, NHS safeguarding professionals, the police and other law enforcement agencies, relevant healthcare organisations, and statutory or regulatory authorities including the CQC and coroners.

We may also disclose information in response to a court order or other legal obligation, and, where lawful, to insurers, solicitors and professional bodies in connection with claims, complaints and legal proceedings. We consider each disclosure against the circumstances, legal requirements, confidentiality obligations and professional guidance.

12. Clinical Governance, Audit and Learning

We monitor and improve patient safety and service quality through Patient Care Record audits, review of clinical documentation, investigation of incidents and complaints, clinical supervision and learning, quality assurance and regulatory compliance, and review of treatment decisions and outcomes.

We use anonymised or pseudonymised information wherever practicable. Where identifiable information is needed, access is limited to authorised individuals under a lawful basis. We do not use identifiable patient information for unrelated commercial purposes.

13. Third-Party Systems and Service Providers

​

GWP Medical Services uses selected third-party service providers to support the safe and efficient operation of our business, including the management of clinical records, administrative functions and communications.

​

All personal information processed and stored through these systems is held securely within the United Kingdom.

We take appropriate steps to ensure that third-party providers comply with applicable UK data protection legislation, including UK GDPR and the Data Protection Act 2018.

​

Where third parties process personal information on our behalf, appropriate contractual and security arrangements are maintained to protect confidentiality, prevent unauthorised access and ensure information is processed only for legitimate and authorised purposes.

Access to personal information is restricted to those who require it for an appropriate professional, clinical or operational purpose.

 

We do not sell personal information or share identifiable patient information with third parties for marketing or unrelated commercial purposes.

​

14. International Transfers

We provide services in the United Kingdom and may carry out international medical or repatriation work. Some providers in section 13 may also process information outside the UK.

When personal information leaves the UK, we use one of these safeguards:

• UK adequacy regulations, including the UK-US data bridge for US organisations certified under it.

• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

Repatriation and overseas clinical handover. When we send clinical information to an overseas hospital or clinician and no adequacy regulation or safeguard is available, we rely on the exceptions in Article 49 UK GDPR. These are occasional transfers where:

• the transfer is necessary to protect your vital interests and you are physically or legally unable to consent; or

• you have given explicit consent after we have told you of the risks.

We share only what the receiving team needs and take confidentiality obligations into account. You can contact us for more information about the safeguards that apply to your information.

15. Information Security

We use technical and organisational measures to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure:

• Restricted access to clinical and operational records.

• Individual accounts and role-based permissions.

• Electronic security controls.

• Confidentiality requirements for staff and contractors.

• Staff training and information governance procedures.

• Secure handling and storage of records, and secure deletion or disposal when no longer needed.

• Controls on information sharing.

• Procedures for responding to security incidents.

• [CONFIRM: annual NHS Data Security and Protection Toolkit completion and any Cyber Essentials certification.]

We review these measures in line with the sensitivity of the information. If a personal data breach occurs, we investigate it, notify the ICO within 72 hours where required, and tell affected individuals where the risk to them is high.

16. How Long We Keep Information

We retain personal information only for as long as necessary for the purposes for which it was collected, or where continued retention is required or justified by legal, clinical, regulatory or other obligations.

Patient Care Records

Our standard adult clinical record retention period is eight years, subject to the requirements applicable to the relevant record category and circumstances.

Children's clinical records are retained for longer, normally in accordance with applicable healthcare records management guidance, including retention until the 25th or 26th birthday where appropriate.

Certain records may require extended retention, including those relating to safeguarding, serious incidents, legal proceedings or specific clinical circumstances.

Clinical photographs forming part of a Patient Care Record follow the relevant clinical record retention arrangements.

Telephone Recordings

Telephone call recordings are normally retained for 12 months.

Where a recording must be preserved in connection with a serious incident, complaint, legal matter or another justified purpose, it may be retained for longer.

Workforce and Business Records

Employment, contractor, training, recruitment, financial and business records are retained in accordance with our documented records retention schedule and applicable legal requirements.

Website Information

Website enquiries, analytics and cookie-related information are retained in accordance with the relevant purpose, configured service settings and applicable data protection requirements.

CCTV Recordings

Head-office CCTV footage is retained for the period necessary to meet our premises security and incident management purposes.

The retention period for routine CCTV footage is determined by our CCTV arrangements. Relevant recordings may be preserved for longer where necessary for a particular incident, investigation or legal matter.

When personal information is no longer required, we arrange for appropriate deletion, destruction or anonymisation.

Individuals may contact us for further information about the retention period applicable to their information.

17. Telephone Recording

We record calls made and received on our designated business telephone systems. Callers are told that recording takes place by an automated recording.

We use recordings to:

• Record instructions and arrangements accurately.

• Support operational and patient safety.

• Carry out quality assurance.

• Review concerns and complaints.

• Investigate incidents.

• Meet legal or regulatory obligations.

Our lawful basis is legitimate interests. Where a call contains health information, the Article 9 condition is shown in section 6. Calls may contain sensitive personal or clinical information, so recordings are confidential and only authorised staff can access them. Retention periods are in section 16.

18. CCTV at Our Head Office

We operate CCTV at our head-office premises. These are operational and administrative facilities that patients and the public do not normally attend.

We use CCTV to protect staff and authorised visitors, protect vehicles, equipment, medicines and other assets, prevent and investigate theft, unauthorised access or damage, and investigate security or safety incidents. Our lawful basis is legitimate interests (Article 6(1)(f)), and we keep a record of that assessment. 

Footage may capture staff, contractors, delivery drivers and other visitors. Signs tell people that CCTV is in use. Access is restricted to authorised individuals. We do not routinely share footage, but we may disclose it where necessary and lawful, including to the police, insurers or other relevant authorities. Retention is in section 16. CCTV is not a substitute for clinical record-keeping.

[

19. Website Cookies, Analytics and Advertising

Our website is hosted using Wix and uses cookies and other tracking technologies.

These technologies may collect information about devices, browsing activity and interactions with our website.

We use or may use the following categories:

Essential cookies

Required for website security, core functionality and the operation of relevant services.

Analytics technologies

Including Google Analytics, used to help us understand website traffic, visitor activity and the performance of our website.

Advertising technologies

Used in connection with advertising campaigns, campaign measurement, audience analysis and, where applicable, advertising-related tracking.

Analytics and advertising technologies may involve processing information such as IP addresses, device identifiers, browser information, website interactions and online identifiers.

Where required by PECR and UK GDPR, we obtain valid consent before non-essential technologies are activated.

Website visitors are provided with controls to manage applicable cookie preferences and to reject or withdraw consent where required.

Further information about individual cookies, relevant providers and their retention periods is available through our website's cookie information and consent management arrangements.

Information gathered through analytics or advertising services is not used by GWP Medical Services to disclose identifiable clinical records to advertising platforms.

20. Marketing Communications

We do not currently send a promotional email newsletter or maintain a mailing list. We contact clients, prospective clients and other organisations about enquiries, quotations, bookings, operational arrangements, contracts and service delivery. These are service communications rather than promotional marketing.

If we start direct marketing, we will first put in place the lawful basis, consent arrangements and opt-out options that PECR and UK GDPR require, and update this policy.

21. Your Data Protection Rights

Under UK GDPR you have these rights over your personal information. Not all of them apply in every case, because it depends on the lawful basis, purpose and nature of the processing.

• Be informed about how and why we use your information.

• Access the personal information we hold about you.

• Rectification of inaccurate or incomplete information.

• Erasure in qualifying circumstances. This is not absolute: we may need to keep clinical records for legal, professional or other justified reasons.

• Restriction of processing in certain circumstances.

• Data portability, where the legal conditions are met.

• Object to processing based on legitimate interests or other relevant grounds, and to direct marketing.

• Automated decisions: protections for solely automated decisions with legal or similarly significant effects.

• Withdraw consent at any time where we rely on it.

Exercising your rights. Email admin@gwpmedical.co.uk. We may ask for information to verify your identity. We normally respond within one month, subject to any lawful extension or exemption, and generally without charge, although the law allows a fee or refusal in limited circumstances.

22. Access to Medical Records

You can ask for a copy of the personal medical information we hold about you, subject to legal restrictions. Use the contact details in this policy.

• If someone asks on your behalf, we may require evidence of their authority.

• Requests involving children, young people or people who may lack capacity are considered under the applicable law, confidentiality obligations and professional guidance.

• Where a record contains information about another identifiable person, we consider that person's rights and confidentiality before disclosing it.

• A request for access does not oblige us to delete the record.

23. Children's Information

We may treat children and young people at events, during patient transport and in other healthcare activities, and we take particular care with their information. We consider a child's age, maturity, understanding and individual confidentiality rights when we collect, use or disclose information. Where appropriate we work with parents, guardians, carers and other healthcare professionals while respecting the child's own legal rights and interests. We may share information where necessary for healthcare, safeguarding or other lawful purposes.

24. Data Protection Complaints

If you think we have handled your information incorrectly, email admin@gwpmedical.co.uk. We will:

• Provide a clear and accessible way to complain.

• Acknowledge your complaint within 30 days, and sooner where we can.

• Investigate without undue delay and keep you informed of progress.

• Tell you the outcome and take corrective action where needed.

Our complaints arrangements reflect the requirements introduced by the Data (Use and Access) Act 2025. The Directors oversee complaints. If your complaint concerns a Director or our data protection lead, it will be reviewed by someone not involved in the matter. [CONFIRM: who this is]

Information Commissioner's Office (ICO). The ICO is the UK's independent data protection regulator. Website: www.ico.org.uk. Telephone: 0303 123 1113. We encourage you to contact us first so we can look into your concerns, but you may contact the ICO at any time.

25. Automated Decision-Making and AI

We do not use solely automated decision-making for clinical treatment decisions or for decisions with legal or similarly significant effects without human involvement. We do not use artificial intelligence tools on identifiable patient information. If this changes, we will review our legal obligations and update this policy.

26. Third-Party Websites

Our website may link to websites run by other organisations. We are not responsible for their privacy practices, and we encourage you to read their privacy policies before giving them personal information.

27. Changes to This Policy

We may update this policy to reflect changes in law, regulatory guidance, our services or our practices. The current version is always on our website. Where a change materially affects how we use personal information, we will give additional information where the law requires.

28. Contact Information

For questions about this policy, patient confidentiality, access to records or other data protection matters:

• GWP Medical Services Ltd, Company Number 11866707, ICO Registration ZB149940

• Email: admin@gwpmedical.co.uk

• Telephone: 0330 043 0797

• Website: www.gwpmedical.co.uk

• Registered office: Cloverleaze, Southcross Lane, Worton, Devizes, SN10 5UW

• Correspondence address: Hurst Farm, Cheverell Green Rd, Devizes SN10 5UN

Last updated: 12 October 2026