This notice explains how MedHealth Ultrasound Ltd uses personal information when you enquire about, book or receive our adult diagnostic ultrasound services. It also covers people contacting us on a patient’s behalf.
Who is responsible for your information
MedHealth Ultrasound Ltd is the controller of information used to run our service and maintain clinical records. Our registered company address is 112 Milton Road, Portsmouth, PO3 6AR. Contact Andrea Drackett, Registered Manager, at [email protected] or 02392 064601 for privacy enquiries.
What we collect
We collect your name, date of birth, contact details, appointment information, relevant medical history, symptoms, referral information, consent and chaperone preferences, communication or accessibility needs, ultrasound images, findings and reports. We also keep necessary payment, correspondence and complaint records. Payment providers handle payment information under their own privacy notices.
Most information comes from you. We may also receive relevant information from a referring clinician, your GP, a partner clinic or someone authorised to act for you. Website services may collect technical information such as IP addresses and cookie preferences; see our Cookie Policy.
Why we use your information
We use information to assess clinical suitability, arrange appointments, provide examinations, prepare and communicate reports, arrange appropriate follow-up and respond to enquiries. Necessary information also supports payments, complaints, safeguarding, clinical audit, peer review, incident investigation, regulatory duties and legal claims. We minimise identifiable information used for audit and learning.
Lawful bases
For arranging and providing the private service you request, we rely on contractual necessity under UK GDPR Article 6(1)(b). Article 6(1)(c) applies where a specific legal duty requires processing, and Article 6(1)(f) applies to necessary administration, quality assurance and defending legal claims where legitimate interests are not overridden by your rights. The basis depends on the activity.
For health information used in diagnosis and healthcare under professional confidentiality, we rely on Article 9(2)(h), supported by Schedule 1 Part 1 paragraph 2 of the Data Protection Act 2018. Article 9(2)(f) may apply to legal claims. Consent to an examination is separate from the data-protection basis for maintaining clinical records.
Storage and sharing
We use Cliniko for appointments and clinical records and PostDICOM for ultrasound image storage. Access is limited to authorised people who need information for their role. Suppliers may provide IT, communications, payment processing and professional advice under appropriate contractual and confidentiality arrangements.
With your agreement, we may send relevant findings to your GP, referring clinician or a partner GP supporting your care. We discuss routine sharing choices with you. Necessary sharing without agreement may occur where required by law or where a justified safeguarding, serious-risk or other lawful exception applies. We record the reason and share only what is necessary. Partner GPs and other treating organisations are responsible for their own clinical records and privacy notices.
We restrict access, train staff in confidentiality and assess supplier security. You can contact us for information about storage locations, overseas processing and applicable transfer safeguards.
How long we keep information
We retain information for safe care, follow-up, professional accountability, legal duties and claims. Retention depends on the record type, the last episode of care, relevant guidance and any complaint, safeguarding concern or legal hold. We securely delete or anonymise records when no longer required.
Your rights and choices
You can request access to your information and correction of inaccurate details. Depending on the circumstances, you may also request erasure, restriction or portability, or object to processing based on legitimate interests. These rights are not absolute: we may need to retain an accurate clinical record or information required by law. If you disagree with a clinical opinion, we can record your concerns without rewriting an accurate historical record.
You can object to direct marketing at any time. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. Contact us using the details above. We will verify identity where necessary and respond within the applicable statutory period, normally one month.
Marketing is optional and follows your recorded preferences and applicable rules. Appointment and care messages are service communications. Please avoid sending medical information through social media. Qualified clinicians make care decisions; we do not make solely automated decisions with legal or similarly significant effects about your care.
Questions and complaints
You can contact Andrea Drackett with a privacy concern. You also have the right to complain to the Information Commissioner’s Office; you do not have to complain to us first. We will explain material changes in how we use your information and update this notice when needed.
Last updated 17 October 2026.