Privacy Policy

Last updated: 14/09/2026

1. Who we are

247 GP Direct Ltd is the data controller for the personal information described in this policy.

  • Company registration no.: 17371724
  • Registered office: Rock Centre, 27-31 Lichfield Street, Walsall, West Midlands, WS1 1TJ, United Kingdom
  • ICO registration: ZC246856

Data Protection contact: [name/role and email], or write to us at the registered office above marked "Data Protection," or call 0330 520 0089.

2. What data we collect

  • Identity and contact data: name, date of birth, address, phone number, email address.
  • Membership and payment data: subscription plan, payment details (processed by our payment provider), billing history.
  • Health data (special category data): information you share during consultations, symptoms, medical history relevant to your consultation, prescriptions issued, referral letters.
  • Technical data: how you use our website (see our Cookie Policy).

3. Why we process your data, and our legal basis

Providing GP consultations and clinical care

Article 9(2)(h) UK GDPR — provision of health care, under conditions of professional secrecy

Managing your membership and billing

Contract performance

Legal and regulatory record-keeping

Legal obligation

Service communications

Contract performance / legitimate interests

Marketing communications (where you've opted in)

Consent

4. Who we share data with

  • Treating GPs and clinical staff involved in your care.
  • Pharmacies, for prescription fulfilment.
  • Private consultants, where you've been referred, with your consent.
  • Payment processors, for handling subscription payments.
  • Regulators, where legally required.
  • We do not sell your personal data.

5. How long we keep your data

Health records are retained in line with [applicable NHS/private healthcare records retention guidance — confirm exact retention schedule with your clinical governance lead, as this differs for adult vs. paediatric records]. Billing and account data is retained for [period] after your membership ends, for legal and accounting purposes.

6. Your rights

Under UK GDPR, you have the right to: access your data, correct inaccurate data, request erasure (subject to our record-keeping obligations as a healthcare provider), restrict or object to processing, and data portability. To exercise these rights, call 0330 520 0089.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk) if you're unhappy with how we've handled your data.

7. International transfers

[Confirm whether any data is processed or stored outside the UK/EEA — e.g. via cloud infrastructure — and the safeguards in place, such as UK adequacy regulations or Standard Contractual Clauses.]

8. Security

We use appropriate technical and organisational measures to protect your data, in line with our Cyber Essentials certification and NHS data security standards referenced on our site.

9. Changes to this policy

We'll update this policy from time to time and post the current version here with a revised "last updated" date.