Privacy notice

Last updated October 2026

Glasgow Medical Group Ltd (GMG Ltd) is a private medical provider specialising in healthcare services. GMG Ltd deals directly with clients and does not engage with third-party providers.

GMG Ltd is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA). We are registered with the Information Commissioner's Office, registration ZA754303.

This notice explains how we use personal data to provide healthcare services and to run this portal. We aim to help you understand our practices so you can make informed choices about your information. It covers:

• How we collect personal data
• What we use your personal data for
• Sharing your personal data
• Retention periods
• Data storage, security and transfers
• Your rights

If you have any questions about how we handle your information, or you wish to make a data access request, please contact us at hello@gmgltd.co.uk.

How we collect personal data

Personal details

When you receive treatment or care from our staff, we will ask you to provide basic information including:

• Full name
• Date of birth
• Home address
• Contact telephone number
• Ethnicity
• GP address
• Next of kin name and contact telephone number

Health and medical information

Our clinicians will also ask about your medical conditions and medications to ensure proper assessment and treatment. We do not access NHS records unless they are provided by you (or your parent or guardian).

Through this portal

When you use this portal we collect the details you give us:

• Your account: name, email and billing email, telephone and mobile numbers, invoicing address, and your organisation and purchase order number if you book through a company.
• Training: the courses you book, the names, emails and mobile numbers of anyone you book a place for, attendance, results, certificates and renewal dates.
• Event medical cover: details of your event, its location and organisers, and the cover you need.
• Patient transport: the patient's name, date of birth, addresses, mobility and weight, and medical information needed to transport them safely, such as oxygen, infection risk, DNACPR status and escort details.

The portal only uses the cookies it needs to keep you signed in and to protect its forms. It does not use advertising or tracking cookies.

What we use your personal data for

• Providing medical treatment and healthcare services, which includes recording information on a patient report form.
• Arranging and delivering the training courses, event cover and patient transport you book, including quotes, invoices, certificates and renewal reminders.
• When necessary, sharing personal data for crime prevention purposes.
• Retaining your medical information securely and in compliance with regulatory requirements.

Sharing your personal data with others

We may share your personal data with other healthcare professionals involved in your care, or with an event data controller or NHS organisations as necessary, always with your presence and consent unless required otherwise by law.

We may also disclose information in response to legal requests or to prevent illegal activities. Inside GMG Ltd, portal information is only seen by our office staff and, for training, by your course trainer. We never sell your data.

Retention periods

We retain patient report forms for 10 years after the patient's last interaction with our clinicians, in accordance with best practice guidelines. Clinical audit records are retained for 5 years in anonymised form.

Booking and invoice records are kept for 6 years, as required for company accounts. Patient transport records that contain health information are kept for the same period as patient report forms.

Data storage, security and transfers

We store all personal health data securely on our servers and do not transmit personal data by unsecured means. The portal is only available over an encrypted (https) connection. If data needs to be transferred for legal purposes, it will be done using encrypted methods or approved courier services.

Your rights

Under UK GDPR and the DPA, you have the right to:

• Withdraw consent for data processing.
• Request access to your personal data.
• Ask for rectification or erasure of your data, where applicable.
• Request restriction of processing or object to processing.
• Request portability of your data.

You can update most of your own details at any time on the My details page. You may also contact the Information Commissioner's Office (ICO) if you have concerns about your data protection rights: