Privacy Policy

1.1 Your privacy is important to us.

1.2 We are committed to protecting your personal information and ensuring that it is handled securely, lawfully and transparently, in accordance with:

(a) the UK General Data Protection Regulation (UK GDPR);
(b) the Data Protection Act 2018;
(c) relevant professional and NHS record-keeping standards;
(d) Care Quality Commission (CQC) requirements.

1.3 This Privacy Policy explains how we collect, use, store and protect your personal data when you use our Services.

2.1 The data controller responsible for your personal data is:

(a) Menopause Care (London) Limited, trading as “Your Menopause Care with Rupa”;
(b) address: Dawes Court House, Dawes Court, High Street, Esher, Surrey, KT10 9QD;
(c) email: rupa@yourmenopausecare.co.uk.

2.2 We are registered with the Information Commissioner’s Office (ICO) as a data controller under registration number ZC136473.

3.1 We may collect and process the following categories of personal data:

(a) Personal identifiers, including your name, date of birth, contact details, address, NHS number (if provided) and GP details.
(b) Health information, including your symptoms, menopause status, medical history, surgical history, family history, test results, medications, allergies, lifestyle factors and any related information you provide via questionnaires, consultations or correspondence.
(c) Consultation data, including notes and records from online consultations, clinical assessments, treatment plans, prescriptions and follow-up communications.
(d) Payment information, including billing name, billing address and basic payment details. We use third-party payment processors and do not store full card details.
(e) Technical information, including IP address, device type, browser information and cookie data relating to use of the Website, where applicable and subject to your cookie preferences.

3.2 We only collect information that is relevant and necessary to provide safe, effective care and to run our business lawfully.

3.3 We normally collect personal data directly from you, for example when:

(a) you complete online forms or medical questionnaires;
(b) you book or attend consultations;
(c) you contact us by email or through our Website.

3.4 We may also receive information about you from:

(a) your GP or other healthcare professionals, where they share information with us to support your care;
(b) pharmacies or laboratories we work with (for example, prescription or test result information);
(c) regulators or authorities, where this is necessary for legal or regulatory reasons.

3.5 Our Services are not intended for children and we do not knowingly provide clinical Services to anyone under 18. We do not knowingly collect personal data relating to children. If you believe a child’s data has been provided to us in error, please contact us so that we can review and, where appropriate, delete it.

4.1 We use your personal data for the following purposes:

(a) Providing healthcare, including:
(i) registering you as a patient and verifying your details;
(ii) assessing your symptoms and medical history;
(iii) providing menopause consultation and prescribing services;
(iv) arranging prescriptions and coordinating with pharmacies and laboratories;
(v) monitoring your response to treatment and managing follow-up.

(b) Communication, including:
(i) contacting you about appointments, test results and treatment;
(ii) responding to queries, complaints or feedback;
(iii) sending reminders and essential service updates.
(c) Clinical records and governance, including:
(i) maintaining accurate, up-to-date health records;
(ii) undertaking audit, quality improvement, incident review and clinical governance;
(iii) meeting regulatory and legal obligations, including those of the CQC and GPhC.

(d) Business administration, including:
(i) processing payments and managing our accounts;
(ii) managing our relationship with you as a patient or client;
(iii) maintaining and improving our Website and IT systems.

(e) Marketing (if applicable), including:
(i) sending you optional newsletters or information about our services only where you have given explicit consent (for example, by ticking an email marketing box);
(ii) allowing you to withdraw your consent at any time by using the “unsubscribe” link in our emails or by contacting us at rupa@yourmenopausecare.co.uk.

4.2 We will not use your health information for automated decision-making that has legal or similarly significant effects without your explicit consent and appropriate safeguards.

5.1 We process your personal data under the following lawful bases:

(a) For provision of healthcare:
(i) Article 6(1)(e) UK GDPR (task in the public interest) and/or Article 6(1)(b) (performance of a contract); and
(ii) Article 9(2)(h) (provision of health or social care).

(b) For regulatory compliance:
(i) Article 6(1)(c) (legal obligation), including CQC, clinical record-keeping and safeguarding duties.

(c) For communication and administration:
(i) Article 6(1)(b) (performance of a contract) and/or Article 6(1)(f) (legitimate interests) for necessary operational communications.

(d) For marketing and newsletters (if used):
(i) Article 6(1)(a) (consent); and
(ii) where relevant, Article 9(2)(a) (explicit consent) if marketing involves special category data.

5.2 You have the right to withdraw consent for optional communications at any time.

6.1 We only share your data where necessary and with appropriate safeguards, including:

(a) with your GP or other healthcare professionals, to ensure safe, joined-up care and where we consider it clinically appropriate or necessary;
(b) with pharmacies, including SignatureRx, to dispense your prescription;
(c) with laboratories or diagnostic providers, where tests are requested;
(d) with IT and clinical software providers, including providers of secure video consultation and messaging platforms, who host our systems or provide secure communication tools, under strict data-processing agreements;
(e) with regulators and authorities, such as the CQC, GPhC or safeguarding authorities, where legally required or in the public interest;
(f) with professional advisers, such as accountants or legal advisers, where necessary for our business and subject to confidentiality obligations.

6.2 We do not sell your data or share it with third parties for their independent marketing purposes.

6.3 We will only allow access to your personal data to those members of our team and our processors who have a genuine need to know it for the purposes set out in this Policy and who are subject to a duty of confidentiality.

6.4 In many cases, your GP, pharmacies and laboratories will act as independent data controllers in their own right, responsible for the data they hold about you and for complying with data protection law. Their own privacy notices will apply to their use of your data.

6.5 In limited circumstances, we may be legally required to share your data, for example in response to a court order, to prevent or detect crime, or where we have safeguarding concerns about serious harm to you or others. We will usually try to tell you before we do this, unless the law or guidance prevents us from doing so.

7.1 If any of our processors or service providers transfer your data outside the UK, we will ensure that:

(a) appropriate safeguards are in place in accordance with UK GDPR, including adequacy regulations, standard contractual clauses or equivalent mechanisms; and
(b) you can obtain further details of such safeguards upon request.

8.1 We take appropriate technical and organisational measures to protect your data, including:

(a) using secure, encrypted systems for storing and transmitting information;
(b) implementing role-based access controls so only those who need access can see your data;
(c) reviewing our systems and policies regularly to maintain security;
(d) using secure platforms for online consultations.

8.2 You should also take care to protect your own device and communications, including:

(a) using secure Wi-Fi connections;
(b) keeping your passwords confidential;
(c) logging out of shared devices.

8.3 We have procedures in place to deal with any suspected data security breach. Where we are legally required to do so, we will notify you and the Information Commissioner’s Office (ICO) of a suspected breach.

8.4 We carry out Data Protection Impact Assessments (DPIAs) where our processing is likely to result in a high risk to your rights and freedoms.

9.1 We retain your records in line with Department of Health and professional guidance, including:

(a) for adult health records, normally 8 years after the last entry, unless a longer period is required, for example in the case of safeguarding or ongoing claims;
(b) for prescriptions and consultation notes, for the same period as part of your clinical record;
(c) for complaint records, normally at least 3 years from closure of the complaint.

9.2 After the relevant retention period expires, we will securely delete or anonymise your data.

10.1 You have the following rights under UK GDPR, subject to certain conditions:

(a) the right of access, to request a copy of your personal data (Subject Access Request);
(b) the right to rectification, to have inaccurate or incomplete data corrected;
(c) the right to erasure, to request deletion of your data where there is no lawful reason for us to keep it;
(d) the right to restrict processing, to limit how we use your data in certain circumstances;
(e) the right to object to certain types of processing, including direct marketing;
(f) the right to data portability, in some cases, to receive data in a structured, commonly used format and have it transferred to another controller;
(g) the right to withdraw consent, where processing is based on your consent (for example, marketing), without affecting the lawfulness of processing before withdrawal;
(h) the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects.

10.2 To exercise any of these rights, you should email rupa@yourmenopausecare.co.uk.

10.3 We may need to verify your identity before responding.

10.4 We aim to respond to requests within one calendar month.

11.1 Our Website uses cookies and similar technologies to ensure the Website functions correctly, remember user preferences and, where you have provided consent, help us understand how visitors use our Website and support relevant marketing activities.

11.2 We use Cookiebot by Usercentrics to manage cookie consent on our Website. Cookies are grouped into categories, including Necessary, Preferences, Statistics and Marketing.

11.3 Necessary cookies are required for the Website to function and may be used without consent where permitted by law. Other cookies will only be used in accordance with the consent choices you make.

11.4 When you visit our Website, you can manage your preferences for non-essential cookies through our cookie consent tool. You can change or withdraw your consent at any time using the Cookie Settings function available on our Website.

11.5 Further information about the cookies and similar technologies used on our Website and your consent choices is available through our Cookie Settings tool.

11.6 You can also control or delete cookies through your browser settings. Please be aware that disabling certain cookies may affect the functionality of some parts of the Website.

11.7 Links to other websites
Our Website may contain links to other websites. We are not responsible for the content, security or privacy practices of third-party websites. We encourage you to read the privacy notices and cookie information provided by any third-party websites you visit.

12.1 If you have concerns about how we handle your data, you should contact us in the first instance at rupa@yourmenopausecare.co.uk, and we will do our best to resolve your concerns.

12.2 You also have the right to complain to the Information Commissioner’s Office (ICO):

(a) via their website at ico.org.uk; or
(b) by telephone on 0303 123 1113.

13.1 We review this Privacy Policy at least annually, or sooner if there are significant changes in legislation, technology or how we deliver our Services.

13.2 The updated version will:

(a) be published on our Website; and
(b) show a new “last updated” date.

14.1 If you require this Privacy Policy in another format (for example, large print or another language), please contact us at rupa@yourmenopausecare.co.uk and we will do our best to accommodate your needs.