Preparing your healthcare experience...
Protecting your information, respecting your privacy: A commitment we take seriously
222 Healthcare Ltd is a private GP service based in the UK. We are a registered company in England and Wales (Company No. 13736366), with our registered office at 2nd Floor Grove House, 55 Lowlands Road, Harrow HA1 3AW. Our clinic operates at Stokenchurch Medical Centre, Oxford Road, Stokenchurch, Bucks, HP14 3SX.
We are registered with the Information Commissioner’s Office (ICO) as a data controller (Registration number: ZB290536)..
If you have any questions about this policy or how we handle your data, please contact us:
By phone: 0333 242 2107
We abide by the following data protection principles, as stipulated in the UK General Data Protection Regulation (UK GDPR), in all of our dealings with your personal data:
We may collect and process the following types of personal data:
We are 222 Healthcare Services Ltd, a company incorporated in England and Wales with company number 13736366 and whose registered office is at 2nd Floor Grove House, 55 Lowlands Road, Harrow HA1 3AW, England (“we”, “us”, or “our”). We are a private GP service offering GP services in the United Kingdom including localised in-person services in the Thames Valley area and remote GP services nationwide.
We are registered as a data controller with the Information Commissioner’s Office (registration number ZB290536). As a controller of your personal data (i.e. any information about an individual from which that individual can be identified), we are committed to protecting and respecting your privacy.
This Privacy Policy (and any other documents referred to on it, including our Cookie Policy) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
Our website and services are not intended for children under the age of 16 years old and we do not permit children to open accounts or register with us. However, we do permit children under 16 years of age to use our services where an individual with parental responsibility registers a child in association. In such cases, we reserve the right to make enquiries to satisfy ourselves that such individuals hold appropriate parental responsibility to be able to give clear informed consent for the child concerned. We do not knowingly collect data relating to children under the age of 16 without appropriate consent.
Our website includes links to third-party websites and applications. We do not control these third-party websites and are not responsible for their privacy statements, notices, or policies. When you leave our website, we encourage you to read the privacy notice of every website you visit. We do not accept any responsibility or liability for the privacy policies or notices on third-party websites. Please check these policies before you submit any personal data to such third-party websites.
We collect personal data:
We only process personal information where we have a lawful basis for doing so under UK data protection law. The basis we rely upon will depend on why the information is being used.
Under Article 6 of the UK GDPR, our lawful bases may include:
Information concerning your health is classed as special category data under the UK GDPR and receives additional protection.
In addition to an Article 6 lawful basis, we must therefore have an appropriate condition under Article 9 of the UK GDPR before processing health information.
For information that we process in connection with providing medical care, diagnosis, treatment and the management of our healthcare services, we will generally rely on Article 9(2)(h) - health or social care, together with the relevant provisions of the Data Protection Act 2018.
This allows health information to be processed where it is necessary for purposes including medical diagnosis, the provision of healthcare or treatment, and the management of healthcare services, subject to appropriate duties of confidentiality and professional secrecy.
In some circumstances, another Article 9 condition may apply, for example explicit consent where this is specifically required or appropriate, or vital interests in certain emergency situations.
We will only process health and other special category information where there is an appropriate lawful basis and condition for doing so, and only to the extent necessary for the relevant purpose.
We use your personal data to:
We only share your personal data when necessary and with:
We do not sell or share your data with third parties for marketing purposes.
If you have used our services before, we may contact you occasionally by email with updates about services that are similar to those you have previously booked - such as seasonal vaccination clinics or new appointment types.
This is known as the “soft opt-in”, which is permitted under the Privacy and Electronic Communications Regulations (PECR). It applies where:
We keep these messages infrequent, relevant, and non-intrusive. You can unsubscribe using a link in the email or by contacting us.
We do not send general marketing unless you’ve opted in separately, and we never share your information with third parties for their marketing.
We use trusted third-party providers to help us deliver our services securely, including:
We select providers carefully, taking account of their security, privacy and data-protection arrangements and the nature of the information they process. Appropriate data-processing agreements and safeguards are put in place where required.
Our use of Heidi Health is explained in more detail below.
We use Heidi Health, a healthcare-specific AI-assisted clinical documentation platform, as part of our normal clinical workflow.
The introduction of AI-assisted clinical scribing has been one of the most valuable developments in the way we deliver consultations. Traditionally, doctors have had to divide their attention between listening to and examining their patient and documenting the consultation. AI-assisted scribing allows our clinicians to focus much more fully on the patient and the conversation taking place, without the same need to type or make detailed notes throughout the appointment.
During some consultations, Heidi processes the conversation to assist the clinician in preparing an accurate clinical record. It can transcribe the consultation and generate a draft clinical note for the clinician to review, and may also assist with related clinical administrative tasks. The clinician remains responsible for reviewing and approving the final clinical record.
There is also an important efficiency benefit. In private healthcare, clinician time has a direct impact on the cost of providing a consultation. Reducing the time doctors need to spend documenting consultations during and afterwards allows us to use clinical time more efficiently. These efficiencies form an important part of how we are able to keep our consultation fees lower for patients.
We recognise that medical information is particularly sensitive and that patients may understandably have questions about the use of artificial intelligence in healthcare.
We have deliberately chosen Heidi Health rather than general-purpose AI tools for processing consultation information. Heidi has been developed specifically for healthcare, and we selected it taking account of its privacy, security and data-protection safeguards.
In particular:
Any AI-generated clinical documentation is treated as a draft. Your clinician remains responsible for reviewing the information and for the clinical record ultimately created from the consultation.
We use Heidi as part of our usual clinical workflow, but you may ask us not to use it during your consultation.
If you would prefer Heidi not to be used, please tell your clinician at the beginning of your appointment, before Heidi is activated.
Where Heidi is not used, your clinician will need additional time to document the consultation manually. We therefore recommend allowing approximately 15 minutes of additional appointment time and ask patients opting out to book a minimum 30-minute appointment.
There is no separate charge for opting out of Heidi. Any additional consultation time required is simply charged according to our usual consultation fees, and choosing not to use Heidi will not affect the standard of clinical care you receive.
We retain personal data only for as long as necessary to comply with legal, clinical, and regulatory requirements.
These periods may be extended where clinically appropriate or required by law.
Information processed through Heidi Health for the purpose of assisting with clinical documentation is retained in accordance with our configured clinical retention arrangements and for no longer than is necessary for that purpose. The final clinical record is retained within our clinical record system in accordance with our usual medical records retention requirements.
Financial records (e.g. invoices, payment logs) are retained for at least 6 years to comply with HMRC requirements.
Under UK data protection law, you have the right to:
More information is available from the ICO: www.ico.org.uk
We use cookies to enhance your experience on our website, monitor performance, and understand user behaviour. You can manage cookie preferences in your browser.
We may update this Privacy Policy from time to time. The latest version will always be available on our website, and we will notify you of any significant changes.
Version: 3.0
Effective from: 08 Sep 2026
Version 1: 01 Nov 2021 - By Oiver Large - Initial release of Privacy Policy
Version 1.1: 22 May 2022 - By Oliver Large - Revised to reflect operational focus on COVID-19 testing and core GP services
Version 2.0: 26 May 2025 - By Oliver Large - Updated to provide greater transparency regarding data processors (IT, finance, communications); clarified marketing communications approach under PECR; introduced version control table
Version 3.0: 08 Sep 2026 - By Oliver Large - Updated to provide greater transparency regarding the use of AI-assisted clinical documentation and Heidi Health; updated information regarding data processors, lawful bases for processing health and special category data, and data retention arrangements.