Privacy Policy | Marpe Wellbeing

MARPE WELLBEING | Marpe Health Clinic (Referred to as 'Marpe')

Patient Privacy Policy

Last updated: 8th June 2026

Version 2.0

This Privacy Policy explains what personal information we collect about you as a patient, how we use it, how long we retain it, and your rights in relation to it. Marpe is a CQC-registered independent private clinic offering GP, psychiatry, ADHD assessment, therapy, and related services. We are committed to handling your information with care, transparency, and in full accordance with the law.

1. Who We Are

Marpe (trading also as Marpe Health/ Marpe Wellbeing) is a CQC-registered private healthcare provider based in the United Kingdom.

Contact: hello@marpewellbeing.uk

Registered Company: #12561490

2. What Information We Collect About You

When you register and use our services, we collect the following categories of personal information:

Personal identifiers: full name, date of birth, address, telephone number, and email address
GP details and relevant medical history
Clinical information: consultation notes, diagnoses, prescribed medications, test results, medical images, and clinical correspondence
Payment information: processed securely via Stripe. We do not store your card details
Identity verification documents (e.g. passport, driving licence) where required for clinical safety
Communications you send to us, including emails and messages through our platform

3. How We Use Your Information

To provide you with clinical care, including booking appointments, issuing prescriptions, and communicating with other healthcare providers involved in your care
To maintain accurate and up-to-date clinical records
To communicate with your NHS GP or other treating clinicians, where clinically necessary and with your consent
To comply with our legal and regulatory obligations as a CQC-registered provider
To respond to your enquiries, complaints, or subject access requests
To send you administrative communications including appointment reminders and clinical letters
To send you marketing communications about our services, where you have given consent or where we have a legitimate interest to do so - you may opt out at any time
To monitor and improve the quality of our services

4. Legal Basis for Processing Your Information

We process your personal information under the following legal bases under the UK General Data Protection Regulation (UK GDPR):

Performance of a contract: where processing is necessary to provide the clinical services you have requested
Legal obligation: where we are required to process or retain your data by law or regulation
Vital interests: in emergency or safeguarding situations
Legitimate interests: for business administration, fraud prevention, and service improvement, where these do not override your rights
Consent: for marketing communications and for sharing your information with your GP or third parties where not otherwise required by law

For special category data (including your health information), we rely on:

Article 9(2)(h) UK GDPR: processing necessary for the provision of health or social care
Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018: healthcare purposes

5. How Long We Keep Your Information

As a CQC-registered clinical provider, we are required to retain your clinical records in accordance with the NHS Records Management Code of Practice 2021. The GMC directs all registered doctors to follow this guidance regardless of whether they work in the NHS (GMC Confidentiality Guidance, paragraph 130).

The following minimum retention periods apply:

General adult medical records: minimum 8 years from the date of your last contact with us
Mental health records: minimum 20 years from the date of last contact, given the complexity and sensitivity of such records
Records created when you were a child: retained until your 25th birthday, or 8 years after death if you pass away before the age of 18

Your right to request deletion of your records:

Under UK GDPR you have the right to request erasure of your personal data. However, this right is not absolute. As the data we hold is exclusively clinical in nature, we are unable to delete your records during the applicable mandatory retention period. This is required under UK legislation, GMC guidance, and the NHS Records Management Code of Practice 2021. Upon receiving a deletion request, we will close your account and ensure you receive no further non-essential communications from us. Your clinical records will be retained for the duration required by law and securely destroyed thereafter.

6. How We Store and Protect Your Information

Your clinical records are held securely within Cliniko, our practice management system. Cliniko stores all UK account data on servers located within the United Kingdom, hosted via Amazon Web Services (AWS). Cliniko holds the following security accreditations:

PCI DSS Level 1 (Payment Card Industry Data Security Standard)
ISO 27001 (Information Security Management System)
FIPS 140-2 (US Federal Information Processing Standard)

Additional security measures include:

End-to-end encryption using HTTPS and AES-256 encryption for data at rest
Daily backups with redundant storage across multiple physical locations
24/7 platform monitoring
Access to your data is restricted on a strict need-to-know basis in accordance with the Caldicott Principles
All staff are subject to confidentiality agreements and receive information governance training
All data access is logged and subject to regular audit

7. Who We Share Your Information With

We will not share your personal information except in the following circumstances:

With your NHS GP or other treating clinicians, where clinically necessary and with your consent
With third-party service providers who support our operations, including Cliniko (records management), Stripe (payments), and laboratory partners - all bound by data processing agreements
With regulatory authorities such as the CQC or GMC where required by law
With law enforcement or other public authorities where required by law or court order
Where there is a risk of serious harm to you or another person, in line with our safeguarding obligations
With professional advisors, insurers, or regulators in the event of a complaint or legal claim

We do not sell, rent, or share your personal data with third parties for marketing purposes without your explicit consent.

8. Your Rights

Under UK GDPR, you have the following rights:

Right of access: to request a copy of the personal information we hold about you
Right to rectification: to request correction of any inaccurate or incomplete information
Right to erasure: to request deletion of your data, subject to our legal retention obligations (see Section 5)
Right to restriction: to request that we limit how we use your data in certain circumstances
Right to data portability: to request that we transfer your data to another provider where technically feasible
Right to object: to object to processing based on legitimate interests
Right to withdraw consent: you may withdraw consent at any time without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at hello@marpewellbeing.uk. We will respond within one calendar month and may ask you to verify your identity before processing your request.

9. Cookies

Our website uses cookies to improve your experience. You may disable cookies through your browser settings at any time, though this may affect the functionality of our website. For full details please refer to our Cookies Policy.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices and encourage you to read their own privacy policies before submitting any personal information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The most current version will always be available at marpewellbeing.uk/privacypolicy. Where changes are material, we will notify you by email where possible.

12. Complaints

If you have any concerns about how we handle your personal information, please contact us at hello@marpewellbeing.uk in the first instance.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: https://www.ico.org.uk

Last reviewed: 8th June 2026 | Version 2.0

Marpe Wellbeing | Registered Company #12561490 | hello@marpewellbeing.uk