Patient Privacy Notice

Last updated: 16 September 2026

1. Who we are

This notice is provided by Mediwell North West Ltd (trading as Medi-Forte) ("we", "us", "our"), a company registered in England and Wales with company number 15753666, whose registered office is at 48-52 Penny Lane, Mossley Hill, Liverpool, Merseyside, United Kingdom, L18 1DG.

We are the data controller for the personal and health information we hold about you as a patient. We process your data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and our professional obligations under healthcare law.

If you have any questions about this notice, please contact us at:

Email: Rosieaslan@medi-forte.com
Post: 48-52 Penny Lane, Mossley Hill, Liverpool, Merseyside, United Kingdom, L18 1DG

2. What information we collect about you

As part of providing you with healthcare services, we may collect and hold the following categories of information:

2.1 Personal identification information

Full name, date of birth, sex, gender identity
Contact details: address, telephone number, email address
Emergency contact details
NHS number (where applicable)

2.2 Health and clinical information (special category data)

Medical history, past diagnoses, and treatments
Medications and allergies
Results of examinations, tests, scans, and investigations
Clinical notes, referral letters, and correspondence from other healthcare providers
Details of consultations, procedures, and appointments at Medi-Forte
Information relevant to your ongoing care and treatment

2.3 Administrative and financial information

Appointment and attendance records
Insurance or payment details
Communications with our administrative team

3. Why we use your information and our legal basis

Purpose	Legal basis (UK GDPR)
Providing you with clinical care and treatment	Article 9(2)(h) — health or social care purposes; Schedule 1(2) DPA 2018
Managing your appointments and records	Legitimate interests (Article 6(1)(f))
Billing and payment processing	Contract (Article 6(1)(b)); legitimate interests
Safeguarding children and vulnerable adults	Legal obligation (Article 6(1)(c)); vital interests (Article 6(1)(d))
Communicating with other healthcare providers involved in your care	Article 9(2)(h); legitimate interests
Complying with legal and regulatory obligations	Legal obligation (Article 6(1)(c))
Improving the quality and safety of our services	Legitimate interests (Article 6(1)(f))

We do not rely on consent as our primary lawful basis for processing your clinical health data, as processing is necessary to provide you with healthcare. You cannot withdraw consent to stop us processing data that is essential to your care, but you do have other rights (see Section 7 below).

We may share your information with:

Other healthcare professionals involved in your care (e.g. your NHS GP, hospital consultants, specialist services), with your knowledge or where it is in your vital interests to do so
Diagnostic and laboratory services for the purpose of processing test results
Health insurance providers, where you have authorised us to invoice your insurer directly
Regulatory bodies (e.g. the Care Quality Commission, General Medical Council) where we are legally required to cooperate
Legal and professional advisers, where required for the conduct of legal proceedings or regulatory investigations
IT systems and software providers used to operate our clinical records system, subject to appropriate data processing agreements

We do not sell your personal data to third parties and we do not use your health data for marketing purposes.

5. International transfers

We do not routinely transfer your personal data outside the United Kingdom. If any transfer were necessary, we would ensure appropriate safeguards are in place in accordance with UK GDPR Chapter V.

6. How long we keep your information

We retain patient health records for a minimum of 8 years from the date of last treatment (or until the patient's 25th birthday for records created when the patient was a child, whichever is longer), in line with NHS Records Management Code of Practice guidance applicable to independent healthcare providers.

Financial and administrative records are retained for 6 years in accordance with our legal obligations.

Where records are no longer required, they are securely destroyed.

7. Your rights

Under UK GDPR you have the right to:

Access — request a copy of the personal data we hold about you (Subject Access Request)
Rectification — ask us to correct inaccurate or incomplete data
Erasure — ask us to delete your data in certain circumstances (note: clinical records are generally exempt from erasure requests where retention is required by law or for legitimate healthcare purposes)
Restriction — ask us to restrict processing of your data in certain circumstances
Portability — receive your data in a structured, machine-readable format where processing is based on consent or contract
Object — object to processing based on legitimate interests
Withdraw consent — where we have relied on your consent for a specific processing activity, you may withdraw it at any time (this will not affect the lawfulness of processing before withdrawal)

To exercise any of these rights, please contact us in writing at the address above. We will respond within one calendar month.

8. Complaints

If you are unhappy with how we have handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF

We would welcome the opportunity to resolve your concern directly before you contact the ICO — please reach out to us first at Rosieaslan@medi-forte.com.

9. Changes to this notice

We review and update this Patient Privacy Notice periodically. The current version is always available on our website. Any material changes will be communicated to active patients directly where reasonably practicable.

Mediwell North West Ltd (trading as Medi-Forte) 48-52 Penny Lane, Mossley Hill, Liverpool, Merseyside, United Kingdom, L18 1DG Company number: 15753666 Rosieaslan@medi-forte.com