This notice explains how Northern Medical Network Limited (“Northern Medical Network”, “we”, “us”) handles personal information about the people we work with: patients, partner organisations, website visitors, suppliers, job applicants and staff. It explains what we collect, why, who we share it with, how long we keep it and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are and how to contact us
Northern Medical Network Limited is the controller of the personal information described in this notice.
| Company | Northern Medical Network Limited, registered in England and Wales, company number 17490921 |
| Address | Business First Centre, Millennium City Park, Millennium Road, Preston, PR2 5BL |
| ICO registration number | C2073544 |
| Data Protection Officer | Haroon Amanji |
| privacy@northernmedicalnetwork.co.uk | |
| Post | Data Protection Officer, Northern Medical Network Limited, Business First Centre, Millennium City Park, Millennium Road, Preston, PR2 5BL |
Contact our Data Protection Officer with any question about this notice or to exercise your rights.
When another organisation is in charge of your data
Some of our partner organisations collect information about you directly, for example when you sign up to their service. For that information, the partner is the controller and its own privacy notice applies. Where we process information only on a partner’s instructions, we act as its processor, and you should contact the partner with questions about how it uses your data.
2. Where your information comes from
- From you, when you have a consultation, fill in a form, contact us, make a complaint, apply for a job or sign up to hear from us.
- From partner organisations that refer you to our service, including through their platforms and systems.
- From health and care professionals involved in your care, such as your GP or another pharmacy.
- Generated by our services, such as prescriptions, clinical notes and monitoring records.
- Automatically, when you visit our website (see section 10).
- From public sources, such as business websites and professional profiles, when we contact organisations about our services.
When another organisation gives us your information, we expect it to have told you about this and to have a lawful reason for sharing it. If that hasn’t happened, we will let you know within a month that we hold your information, where practical.
If you give us information about someone else, please make sure they know and are happy for you to do so.
3. How we use your information
If you are a patient
| What we do | Information we use | Lawful basis |
|---|---|---|
| Provide consultations, prescribing, monitoring and follow-up care | Name, date of birth, contact details, address, NHS number, identity checks, medical history, consultation answers, measurements, test results, prescriptions and clinical notes | Performance of a contract, or legitimate interests where a partner contracts with us; for health data, provision of health care (Article 9(2)(h)) |
| Arrange dispensing and delivery of your medicines | Name, address, contact details, prescription | As above |
| Share information with your GP, other professionals involved in your care and, where you ask us to, family members or carers | Information relevant to your care, and the contact details and roles of those involved | Legitimate interests in providing safe, joined-up care; for health data, Article 9(2)(h) |
| Keep clinical records and meet our regulatory duties, including GPhC standards | Your clinical record | Legal obligation; for health data, Article 9(2)(h) and (i) |
| Protect patients from harm, including safeguarding | Information relevant to the concern | Legal obligation or vital interests; for health data, substantial public interest |
If you work with us or contact us
| What we do | Information we use | Lawful basis |
|---|---|---|
| Provide services to partner organisations and work with integration and project partners | Names, job titles, work contact details and anything you send us | Performance of a contract with your organisation |
| Talk to organisations that might use our services | Names, job titles, work contact details, from you or from public business sources | Legitimate interests in growing our business |
| Send updates and news you have asked for | Name, email, job title, organisation, marketing preferences | Consent for email; legitimate interests for post. You can opt out at any time |
| Run events and training | Name, job title, contact details, accessibility or dietary needs, photographs | Legitimate interests; explicit consent for health-related needs and photographs |
| Carry out research and gather feedback on our services | Contact details and your responses, which may include health information | Legitimate interests; explicit consent where research involves patients or health information |
| Respond to enquiries and complaints | Contact details, details of the enquiry or complaint, and information about other people involved | Legitimate interests in resolving issues; for health data, Article 9(2)(h) |
| Manage suppliers | Contact details, purchase orders, invoices and payment information | Performance of a contract |
| Recruit and employ staff | CVs, application information, references, right-to-work and DBS checks, professional registration, employment, payroll, pension and absence records | Performance of the employment contract and legal obligations; explicit consent for occupational health |
For everyone
| What we do | Information we use | Lawful basis |
|---|---|---|
| Respond to requests to exercise your data protection rights | Contact details, the request and proof of identity where needed | Legal obligation |
| Investigate and manage data breaches | Any information affected | Legal obligation |
| Prevent and detect fraud and crime, and help the police and other authorities | Information relevant to the matter | Legitimate interests; substantial public interest |
| Keep our website and systems secure and working | IP address, device and browser information, and any data needed to fix a specific problem | Legitimate interests |
We only collect what we need for each purpose, and we review what we collect regularly.
4. Health information
Health information is a “special category” of personal data, and we treat it with extra care. We only use it where the law allows (as shown above), limit it to what is needed, and restrict access to the people who need it to provide or oversee your care. All our clinicians have a professional duty of confidentiality.
5. Automated decisions and profiling
We may use information from your consultations and monitoring to track your progress and help your prescriber review your treatment. We never make decisions about your treatment by automated means alone. Every prescribing decision is made by a registered prescriber.
6. Who we share information with
We share personal information only where needed for the purposes above and where we have a lawful reason. This may include:
- Pharmacies and delivery companies involved in dispensing and delivering your medicines.
- The partner healthcare service through which you used our service, where needed for your care.
- Your GP and other health and care professionals involved in your care, and family members or carers where you ask us to.
- Our suppliers, such as IT, hosting, identity verification and communication providers, who process data for us under contract.
- Professional advisers, such as lawyers, accountants and insurers.
- Regulators, the police and other authorities, where the law requires it, to protect someone at risk, or in connection with legal proceedings or protecting our legal rights.
- A buyer or investor, if we sell, merge or restructure all or part of our business.
We never sell your personal information or share it for other organisations’ marketing.
7. International transfers
We store personal information in the UK or the European Economic Area, where data protection law is recognised as adequate. If we ever need to transfer information elsewhere, we will assess the risks and put appropriate safeguards in place, such as the UK International Data Transfer Agreement or approved contract clauses.
8. Keeping your information secure
We use technical and organisational measures to protect personal information, including encryption, access controls, staff training and confidentiality agreements. We review these measures regularly. No method of sending data over the internet is completely secure, so please use the secure channels we provide when sharing health information.
9. How long we keep information
We keep information only for as long as we need it for the purpose it was collected for, or as the law requires.
Patient and prescribing records are kept in line with the NHS England Records Management Code of Practice and professional requirements.
We may keep information for longer where the law requires it or it is needed for legal claims. For more detail, contact our Data Protection Officer.
10. Cookies and our website
Our website does not set cookies and does not use analytics, advertising or tracking tools. Our fonts are hosted on our own servers, so visiting the site does not share your information with third parties. If this changes, we will update this notice and ask for your consent where the law requires it.
Our website links to other organisations’ websites. We are not responsible for their privacy practices.
11. Your rights
You have the right to:
- be told how your information is used (this notice);
- access the personal information we hold about you;
- have inaccurate or incomplete information corrected;
- have your information deleted, in some circumstances;
- restrict how we use your information, in some circumstances;
- receive your information in a portable format, in some circumstances;
- object to how we use your information, including for marketing; and
- withdraw your consent at any time, where we rely on consent.
To use any of these rights, contact our Data Protection Officer. We will usually respond within one month. We may ask for proof of identity. Some rights don’t apply in every case, for example, we must keep clinical records for a set period. If an exemption applies, we will explain why. Find out more about your rights on the ICO website.
12. Complaints
If you are unhappy with how we have used your information, please contact our Data Protection Officer and we will try to put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
13. Other formats
We can provide this notice in other formats, such as large print, printed copies or other languages. Please ask our Data Protection Officer.
14. Changes to this notice
We review this notice at least once a year, and sooner if we change how we use personal information or the law changes. The version number and effective date at the top of this page show which version applies, and the version history below summarises each change.
Version history
We review this page at least once a year and whenever our services or the law change. Previous versions are available on request from hello@northernmedicalnetwork.co.uk.
| Version 1.0, 2 November 2026 | First published. |
|---|