Privacy Notice
Schedule 1 to your Curia Health Membership Agreement.
This notice explains what information we hold about you, why we hold it, who is responsible for it, how we keep it safe, and what rights you have. We have written it to be read.
You do not need to sign this notice and it places no obligation on you. When you sign your Membership Agreement you confirm only that you have received it. The current version is published on our website and that published version is the one that applies.
Who this notice is for. Members in the United Kingdom and everywhere else in the world outside the United States. If you receive care from our US medical practice, that practice has its own notice under US law, which is Schedule 2 to your Membership Agreement. This notice still covers everything our UK organisations do with your information, wherever you are.
Who is responsible for your information
Your membership involves more than one organisation. Each is independently responsible, as a data controller, for the information it holds.
Curia Health LLP. Registered in England and Wales, number OC447029. Registered office Units 3-4, 42 Orchard Road, London N6 5TR. ICO registration ZB545925. Curia is responsible for your membership information, your care coordination records, your billing, and the health and performance services Curia provides to you directly.
CHHP Research Ltd. Registered in England and Wales, number 13479177. Registered office Units 3-4, 42 Orchard Road, London N6 5TR. ICO registration ZB689801. Registered with the Care Quality Commission, provider ID 1-11736819118. CHHP is responsible for your clinical records: the records of the regulated medical care its doctors provide to you in the United Kingdom.
In short: if it is a medical record of UK care, CHHP holds it. If it is anything else about your membership, Curia holds it.
These two organisations are not joint controllers. Each answers for its own information. They share with each other only what is needed to coordinate your care, and each has its own lawful basis for doing so.
Your clinical records sit on Curia's secure records platform. Where CHHP's records are concerned, Curia acts only as CHHP's service provider under a written data processing agreement. It holds those records on CHHP's instructions and for no other purpose. Access is controlled by role, so clinical records are visible only to those CHHP authorises, and Curia cannot restrict CHHP's access to them.
Our US medical practice is responsible for your US clinical records under US law, and a separate US organisation provides it with administrative and technical support. Both are named, with their addresses, in Schedule 2, which also describes how they handle your information.
What we collect, and where it comes from
We collect:
- Identity and contact details.
- Membership and billing information. Card payments are handled by a payment provider that collects your card details directly; we do not store them.
- Health information you give us or authorise others to give us: your history, medications, diagnoses, test results, assessments, imaging, and the records of your consultations.
- Lifestyle and performance information relevant to your programme: training, sleep, nutrition, and wearable data where you choose to share it.
- Your correspondence with your care team, including messages.
- The questions you ask us, including requests for literature reviews and expert summaries under "Ask us anything", together with whatever clinical context you give us so that we can answer them usefully. Where your question is about your own health, the answer and the context behind it form part of your record.
Most of this comes from you. Some comes from clinicians you ask or authorise to share it, such as your GP or a specialist. Some comes from practitioners in our network who are involved in your care. Occasionally we are introduced to you by someone who gives us your contact details.
Much of this is special category data, meaning information about your health. It is held in confidence by people who owe you a professional duty of confidentiality, and handled under the safeguards described here.
Do you have to give it to us? Giving us this information is a condition of your membership rather than a legal obligation. Your Membership Agreement asks you to give us accurate and complete information about your health and to keep us updated. If you choose not to, we will still care for you, but we may not be able to do so safely or well, and we will tell you where that is the case.
Why we use your information, and our lawful bases
We do not rely on your consent for the care you receive. That runs on the bases above, which is deliberate: consent can be withdrawn, and a clinician cannot stop holding a medical record because consent was withdrawn. Where we do ask for consent, it is for something genuinely optional, it is asked for separately, and you can withdraw it at any time without affecting your care.
Where your information is held, and transfers abroad
Your health records are held on our encrypted electronic health record system, hosted in the United Kingdom, with access controlled by role.
Our working systems for email, documents and care coordination are provided by Google Workspace and hosted in the United States. Google is certified under the UK Extension to the EU-US Data Privacy Framework, and our contract with Google also contains standard data protection clauses that take effect automatically if that certification ever lapses, so your information stays protected either way.
Because our members and our team are international, your information may move between the UK, the US and other countries where that is needed to look after you: to our US practice if you receive care there, or to a local physician you have asked us to coordinate with. Every such transfer is protected by at least one of:
- UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment where one is required
- Business Associate Agreements under HIPAA, for US health information
- technical measures including encryption and restricted access
If we change where a system is hosted, we will update this notice. If you want to know which safeguard applies to a particular transfer, ask us and we will tell you.
How we keep your information safe
Your records are encrypted, both where they are stored and when they travel between systems. Access to our electronic health record is granted by role, so that people can see only what their part in your care requires, and access to clinical records is logged. Our people are trained on confidentiality and data protection, and are bound by professional duties of confidence and by written confidentiality obligations. Our suppliers are contractually bound to equivalent standards, and we check that they still meet them. We hold insurance covering cyber incidents and data loss.
If something does go wrong and your information is affected in a way that presents a risk to you, we will tell you, and we will tell the Information Commissioner's Office where the law requires it.
AI-assisted consultation notes
Some clinicians use Heidi, an AI transcription tool, during consultations to produce a draft note. The tool processes the consultation to generate that draft. The clinician reviews and verifies every note before it goes into your record and remains responsible for its content.
Heidi acts as our processor under a written contract and may not use your information for its own purposes. Its processing and storage for UK customers take place in the United Kingdom, and it does not use patient information to train AI models. The audio is deleted once the transcript has been produced, and the transcript itself is deleted after 30 days.
This is optional. Tell your clinician if you would prefer your consultation not to be transcribed this way, and it will not be. Your care is unaffected either way.
Automated decisions about you
We do not make decisions about you by automated means, and we do not profile you in any way that produces legal or similarly significant effects. The AI transcription described above drafts a note for a clinician to check; it does not decide anything. Your clinical decisions are made by clinicians.
Care outside the UK and the US
If you are living or travelling somewhere we are not licensed to provide medical care, Curia coordinates and supports rather than treats. In that situation we do not create a clinical record of medical care for you, because there is none to create.
Where you ask us to work with a local doctor or clinic, we share what is needed for your care, with your authority. That local practitioner is independently responsible for their own records and their own handling of your information, under the law of their country. We are not responsible for what they do with it, though we choose who we recommend with care.
If the organisation providing your care changes
From time to time the organisation that holds your clinical records and provides your regulated medical care may change, for example where the practice is reorganised or the regulated activity moves to another organisation in our group. We expect this to happen, and your care, your care team and the name you deal with are designed to stay the same through it.
When it does:
- We will tell you in writing beforehand, naming the new organisation and its Care Quality Commission registration.
- Your clinical records will move to the new provider so that your care continues without a gap. We do this under the same lawful bases as the rest of your care, performance of your Membership Agreement and Article 9(2)(h). We do not ask for your consent to it, because your record has to be complete for your care to be safe, and a consent you could withdraw would not give you a record you can rely on.
- You can tell us you would rather your records went somewhere else instead, to another provider or to your own doctor, and we will arrange that.
- We will publish an updated version of this notice naming the new organisation, and tell you by email.
- The previous organisation keeps a copy only where the law or professional standards require it, and stays responsible for that copy.
Nothing about this reduces your rights. If you would rather not continue under a new provider, your Membership Agreement lets you cancel and be refunded for the unused part of your membership year.
If you receive care from our US team
Our US medical practice, which Schedule 2 names, is a separate organisation from the two named at the top of this notice, and a covered entity under the US Health Insurance Portability and Accountability Act. It has its own Notice of Privacy Practices, which is Schedule 2 to your Membership Agreement, and which applies if you ever receive care from the US team, wherever you happen to live.
When you signed your Membership Agreement you confirmed that you had received that notice. That confirmation is a receipt and nothing more. You are not consenting to anything by it, and declining to give it would not have affected your care.
This notice continues to govern everything Curia Health LLP and CHHP Research Ltd do with your information.
Supporting people close to you
You are welcome to raise the health of someone close to you with us, and we help where we can. We cannot diagnose, treat, prescribe for, or hold a medical record about anyone who is not registered with us. Where a conversation involves information about another person, we record only what is necessary to answer you and to keep your own record accurate, and we do not open a record in their name. If they need proper care, we will offer to register them, at which point this notice applies to them in their own right.
How long we keep your information
Clinical records are kept in line with the Records Management Code of Practice for Health and Care 2021 and the retention standards of the professional regulators. Other records are kept only as long as they are needed, including for legal, tax and accounting periods. Our retention schedule is available on request. When information is no longer needed it is securely destroyed.
Your rights
You have the right to:
- be informed, which is what this notice is for
- see your information, including your medical records. Ask us verbally or in writing, free of charge, and we will normally respond within one month. There are narrow limits: we may withhold information that would identify another person who has not consented, or in the rare case where disclosure would cause serious harm
- have inaccurate information corrected, and to tell us when your details change
- have information erased in certain circumstances. This is not an absolute right, and medical records must be kept for the periods the law and professional standards require
- restrict how we use your information
- receive a copy of information you gave us in a portable format
- object, including to any marketing, which we will always stop on request
- withdraw consent at any time, where we asked for it
Your right to object. Where we rely on our legitimate interests, you can object to what we are doing at any time. Tell us and we will stop, unless there are compelling grounds for us to continue. Marketing is different: if you ask us to stop, we stop, with no reason needed.
To exercise any right, contact us below. We may need to check your identity first.
Who to contact
If you are not sure which applies, write to either and we will route it.
Complaints
Our complaints procedure is at curia.health/complaints.
If something has gone wrong, please tell us first and we will try to put it right. Contact your care team, or write to us at the addresses above.
You can also complain to:
- The Information Commissioner's Office, at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
- The Care Quality Commission, about regulated care provided by CHHP.
- The US Department of Health and Human Services, Office for Civil Rights, at ocrportal.hhs.gov, about information held by our US practice.
Complaining to a regulator does not affect your care, and we will never treat you differently for doing so.
Changes to this notice
We review this notice regularly and update it when the law, our systems, our suppliers or the organisations providing your care change.
The version attached to your Membership Agreement is the version current when you signed. The version published on our website is always the one that applies. Updating this notice is not a change to your Membership Agreement, and the notice period for changes to that Agreement does not apply to it. We will tell you by email about any material change.