Privacy Notice

Vitygas Limited (“we”, “us”, “our”) is committed to protecting your privacy and to handling your personal information, including your health information, with care and in line with the law. This notice explains what information we hold about you, why we hold it, who we share it with, and your rights.

Who we are

Vitygas Limited is the data controller for the personal information we process in connection with your care.

• Registered in England and Wales, company number 17099835.
• Registered office: Weir Bank, Monkey Island Lane, Bray On Thames, SL6 2ED.
• Registered with the Information Commissioner’s Office (ICO), reference ZC201485.
• Data protection contact: dataprotection@vitygas.com.

The information we hold

Depending on your care, we may hold:

• Your name, contact details, date of birth and other identifiers.
• Your health information: clinical records, correspondence, test and investigation results, images, and details of your treatment. This is “special category” information and receives extra protection under the law.
• Details of your GP and any other health professionals involved in your care.
• Appointment information and, where relevant, billing, payment and insurance details. Billing and payment are carried out on our behalf by our outsourced billing provider (see below).

Where we get it from

• From you directly.
• From the health professional who referred you (for example your GP or another consultant).
• From laboratories, imaging providers and others involved in your investigations and care.

Why we use it, and our lawful basis

We use your information to provide and manage your care. Under data protection law we rely on:

• Providing your care and keeping clinical records — necessary for the performance of our contract with you (Article 6(1)(b)) and, for your health information, necessary for the provision of health care and treatment by a health professional (Article 9(2)(h)).
• Meeting our legal, regulatory and professional duties — for example clinical record-keeping and safeguarding (Article 6(1)(c), with the corresponding health condition under Article 9(2)(h)).
• Administering appointments, and billing and payment — necessary for our contract with you and for our legitimate interest in running the practice (Article 6(1)(b) and (f)). Billing and payment are carried out on our behalf by our outsourced billing provider (see “Who we share it with”).
• Establishing, exercising or defending legal claims — where necessary (Article 9(2)(f)).
• Protecting someone’s vital interests — in an emergency, where you are unable to give consent (Article 9(2)(c)).

We do not use your information for marketing, and we do not make decisions about you by automated means alone.

Who we share it with

We keep your information confidential and share it only where necessary for your care, or where the law allows or requires it. This may include:

• The health professionals involved in your care (such as your GP, other consultants and hospitals).
• Laboratories and diagnostic services carrying out your investigations.
• Our administrative and secretarial support, acting under a duty of confidentiality.
• Our outsourced billing provider, Hythehopes Limited, which carries out billing and payment on our behalf under a written contract.
• Your insurer, where they make a legitimate request for information about your care and you have authorised us to release it.
• Our IT and cloud hosting providers, who act as our processors under contract (see “Where your information is held”).
• Our medical defence organisation, regulators or the courts, where necessary to meet a legal or professional obligation or to defend a legal claim.

We will seek your consent before sharing your information for any purpose not connected with your care, unless the law requires or permits us to share it without consent.

Where your information is held

Your records are held in encrypted form. Our cloud hosting provider (currently Hetzner Online GmbH, with data centres in Germany and Finland) acts as our processor under a written contract and stores your information within the European Economic Area (EEA). The EEA provides a level of data protection recognised as adequate under UK law, so your information receives equivalent protection.

How long we keep it

We keep your records for as long as necessary to provide your care and to meet our legal and professional obligations. We follow the retention periods in the NHS Records Management Code of Practice; for adult health records this is a minimum of 8 years after your last treatment (longer for children and for certain other records). When records are no longer needed, they are securely destroyed.

Your rights

You have the right to:

• Ask for a copy of the information we hold about you (a “subject access request”).
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to erase your information, or to restrict or object to our use of it, in certain circumstances. These rights are limited where we are required by law to keep clinical records.
• Ask us to transfer certain information to another provider.
• Withdraw your consent, where we rely on consent.

To exercise any of these rights, contact dataprotection@vitygas.com. We will respond within one month.

Complaints

If you have a concern about how we handle your information, please contact us first at dataprotection@vitygas.com so that we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk, or 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The latest version is always available on our website.

Last updated: 21 July 2026