Privacy Notice
BioFit Health Ltd · Last updated 26 August 2026 · Next review 26 August 2027
This notice explains what personal information BioFit Health Ltd collects about you, why we hold it, who we share it with, and what rights you have. We have written it in plain terms rather than legal language. If anything is unclear, please ask us.
Who we are
BioFit Health Ltd is the data controller for the information described in this notice. We are a private healthcare provider registered with the Care Quality Commission.
BioFit Health LtdMoat Barn, High Cross Lane, Little Canfield, Dunmow, Essex CM6 1TD
Website: biofithealth.co.uk
Email: hello@biofithealth.co.uk
Registered with the Information Commissioner’s Office, registration number ZB906254
The person responsible for data protection at BioFit Health is Frankie Munns, Registered Manager and Director. Because of the size of our service we are not required to appoint a Data Protection Officer, and we have not appointed one. Any data protection question or request should be sent to Frankie Munns at hello@biofithealth.co.uk.
The information we hold
If you are a patient
- Your name, date of birth, address, contact details and NHS number if you give it to us
- Your medical history, symptoms, examination findings, diagnoses and treatment
- Test results, including blood, microbiology and allergy testing
- Records of consent, including chaperone offers and decisions
- Prescriptions issued and medicines supplied
- Correspondence about your care, including letters to and from your GP
If you attend for occupational health
- Your name, date of birth, job role and employer
- Health questionnaire responses and examination findings
- The fitness for work outcome and any recommended adjustments
- Where testing is arranged, drug and alcohol test results and chain of custody records
If you contact us or use our website
- Your name and contact details, and whatever you tell us in an enquiry
- Your IP address and cookie or analytics identifiers when you visit biofithealth.co.uk
If you work with us
We hold records for the clinicians we contract with, including professional registration, DBS checks, indemnity cover, training and appraisal. We are required to hold these under Regulation 19 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.
Why we hold it, and our lawful basis
We do not rely on your consent to provide your care. Health records are kept because the law requires it and because we could not treat you safely without them. This matters in practice: you can ask us to stop sending you information, but you cannot ask us to delete a clinical record we are required to keep.
| What we do | Lawful basis |
|---|---|
| Provide your care and treatment | Article 6(1)(b) contract and 6(1)(c) legal obligation, with Article 9(2)(h) for health data — the provision of health care by a professional bound by a duty of confidentiality |
| Occupational health assessment | Article 6(1)(b) or 6(1)(f), with Article 9(2)(h) — occupational medicine and assessment of working capacity |
| Prescribing | Article 6(1)(c) legal obligation, with Article 9(2)(h) |
| Safeguarding a child or adult at risk | Article 6(1)(c) and 6(1)(d) vital interests, with the safeguarding condition in Schedule 1 of the Data Protection Act 2018 |
| Billing, accounts and tax records | Article 6(1)(b) contract and 6(1)(c) legal obligation |
| Handling a complaint or a legal claim | Article 6(1)(c) and 6(1)(f), with Article 9(2)(f) for legal claims |
| Website enquiries and analytics | Article 6(1)(f) legitimate interests for enquiries; your consent for non-essential cookies |
Who we share your information with
We only share what is necessary, and only with the organisations below. We do not sell your information and we do not use your health information for marketing.
| Who | Why | Their role |
|---|---|---|
| Semble | Our clinical record system, where your record is held | Acts on our instructions |
| Inuvi Diagnostics | Blood and biomarker testing | Acts on our instructions, and separately keeps its own archive — see below |
| The Doctors Laboratory | Blood, microbiology and specialist pathology | Acts on our instructions |
| Your registered GP | So that your ongoing care is joined up | Separate controller |
| Your employer | Occupational health outcomes only — see below | Separate controller |
| Stripe | Taking card payments | Acts on our instructions, and also uses payment data for its own fraud prevention and service purposes |
| Google Workspace | Our email and document storage | Acts on our instructions |
| IONOS | Hosting our website and enquiry forms | Acts on our instructions |
| Social care and the police | Where we have a safeguarding concern | Separate controllers |
| The Care Quality Commission | Regulatory assessment and investigation | Statutory powers — see below |
| Our insurers and indemnity provider | Only if there is a claim or potential claim | Separate controllers |
| Our accountant | Billing and financial records only — never clinical records | Separate controller |
Laboratories keep their own copy. Inuvi Diagnostics is required to keep an archive of patient identifiers and results for five years to comply with Royal College of Pathologists guidance and to meet its own regulatory obligations. For that archive Inuvi is a data controller in its own right, not simply acting for us. This means a copy of your test information exists outside our records.
Occupational health. If you attend an occupational health appointment arranged by your employer, your employer receives only the fitness for work outcome and any recommended adjustments. Your employer does not receive your clinical detail, your questionnaire answers or your examination findings. You will be shown the report before it is released, and you may withdraw your consent to its release.
Safeguarding. If we believe a child or an adult at risk is being harmed, we will share information with social care or the police. We do not need your consent to do this, and we may not be able to tell you beforehand. We will share only what is necessary.
Regulatory inspection. The Care Quality Commission can require access to records using its statutory powers under the Health and Social Care Act 2008. Your consent is not needed for this. Where it is practicable, we will tell you if your records have been accessed.
Where your information is held
Your clinical record is held electronically. Some of the organisations above operate outside the United Kingdom, and where that happens the law requires us to make sure your information is equally protected.
- Inuvi stores data with Amazon Web Services in London and Dublin. Transfers to Ireland are covered by UK adequacy regulations.
- Stripe transfers data to the United States and India, protected by Standard Contractual Clauses and the UK International Data Transfer Addendum.
- Google and Semble operate internationally and use the UK International Data Transfer Addendum where a transfer takes place.
How long we keep it
- Adult health records: eight years after your last contact with us.
- Children and young people: until your 25th birthday, or your 26th if you were 17 at your last contact.
- Occupational health records: longer in some cases, depending on the assessment and any legal requirement.
- Billing and accounting records: six years plus the current tax year.
- Complaints: ten years from closure.
- Website enquiries: deleted once dealt with, or added to your clinical record if you become a patient.
These periods follow the NHS Records Management Code of Practice, which we adopt as good practice.
Automated decisions
We do not make any decision about your care by automated means, and we do not profile you.
Your rights
You have the right to:
- Ask what we hold about you and receive a copy — usually within one month, free of charge
- Ask us to correct anything inaccurate. We cannot delete a clinical opinion you disagree with, but we will record your view alongside it
- Ask us to delete information, restrict how we use it, or object to our using it. These rights are limited where the law requires us to keep health records
- Receive your information in a portable format
- Withdraw consent where we relied on it, such as for marketing or for releasing an occupational health report
To exercise any of these, email Frankie Munns at hello@biofithealth.co.uk, or write to us at the address above. We may ask you to confirm your identity first, so that we do not release your information to the wrong person.
If you ask one of our laboratories or our payment provider directly for information they hold for us, they will pass your request to us to answer.
Complaints Procedure
Our commitment to you
At BioFit Health, we take all complaints seriously.
Every patient has the right to raise a concern or complaint about the care or service they have received. We will listen to your concerns, investigate complaints fairly and impartially, and use the outcome to improve the quality and safety of our services.
Our complaints process is designed to be accessible, transparent and proportionate. You will be treated with courtesy and respect throughout the process, and making a complaint will not affect your future care.
BioFit Health operates a complaints system in accordance with Regulation 16 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014. We also recognise our responsibilities under the statutory and professional duty of candour.
How to raise a complaint
You can make a complaint in whichever way is easiest for you. You do not have to put your complaint in writing.
You can:
- speak to us in person;
- telephone us;
- email us; or
- write to us.
Contact details
BioFit Health Ltd
Moat Barn
Little Canfield
CM6 1TD
Email: hello@biofithealth.co.uk
If you wish to make a formal complaint, please provide as much information as possible, including:
- your name and contact details;
- the date(s) concerned;
- details of what happened;
- the names of any staff involved, where known;
- what you are concerned about; and
- what you would like us to consider or resolve.
You may also ask a relative, friend, adviser or other representative to support you or make a complaint on your behalf. Where appropriate, we may need to confirm that the person has authority to act for you.
What happens when you complain?
Stage 1 – Local resolution
We will acknowledge your complaint in writing within three working days.
We will then investigate the complaint thoroughly and fairly. We aim to provide a full written response within 20 working days.
Some complaints may require more time, particularly where clinical records, external information or independent clinical advice need to be considered. If we cannot provide a full response within 20 working days, we will explain the reason for the delay and provide you with a realistic timescale for completion.
You will be kept informed about the progress of your complaint where the investigation takes longer than expected.
Where a concern can be resolved quickly, we will try to resolve it at the earliest opportunity. A verbal complaint that cannot be resolved within 24 hours will be formally recorded and investigated.
Our investigation may involve reviewing clinical records, speaking with relevant individuals, reviewing processes or undertaking additional clinical governance activity where appropriate.
We will provide a clear response explaining our findings and, where something has gone wrong, what action we have taken or intend to take to address the issue and reduce the risk of it happening again.
Stage 2 – Internal review
If you remain dissatisfied following our response, you may ask us to review the complaint again.
This will be a genuine review of the original investigation and will not simply repeat the original decision.
As BioFit Health is a single-clinician service, where a complaint concerns care personally provided by the Registered Manager, or where there is otherwise a potential conflict of interest, an independent clinical reviewer may be commissioned or advice may be sought from our medical indemnity provider before the final response is issued.
The Stage 2 review is the final stage of BioFit Health’s internal complaints process.
Important information about private healthcare complaints
BioFit Health is an independent, privately funded healthcare provider and does not provide NHS-funded care.
The Parliamentary and Health Service Ombudsman (PHSO) does not have jurisdiction over privately funded healthcare and therefore cannot investigate complaints about BioFit Health.
BioFit Health also does not subscribe to an independent private healthcare adjudication scheme. Consequently, there is no external ombudsman or independent adjudication stage available through BioFit Health after the Stage 2 review.
This does not prevent you from taking other appropriate action.
Other organisations you can contact
You may contact the Care Quality Commission (CQC) at any stage.
The CQC does not investigate individual complaints or provide compensation or a remedy to individual patients, but it can record information about concerns regarding a registered healthcare provider and may use that information as part of its regulatory activity.
Care Quality Commission (CQC)
Telephone: 03000 616161
Website: cqc.org.uk
You may also contact the relevant professional regulator if your complaint concerns the conduct or fitness to practise of an individual healthcare professional.
Depending on the professional involved, this may include:
- Health and Care Professions Council (HCPC) – for paramedics and other HCPC-registered professionals;
- General Medical Council (GMC) – for doctors;
- Nursing and Midwifery Council (NMC) – for nurses; or
- another relevant professional regulator.
You may also seek independent legal advice.
Support with making a complaint
You are welcome to ask a relative, friend, adviser or another person you trust to support you.
The Patients Association provides free, independent support to people raising healthcare concerns, including people receiving private healthcare.
You can also seek independent legal advice if you wish.
Complaints made on behalf of someone else
You may make a complaint on behalf of another person where you have appropriate authority to do so.
This may include acting on behalf of:
- a child, where the complaint is in the child’s best interests;
- someone who lacks capacity to make the complaint themselves;
- a deceased person where you are their appropriate personal representative; or
- someone who has given you consent to act on their behalf.
We may need to verify your authority before sharing confidential information.
Confidentiality
Complaints are handled confidentially.
Information relating to a complaint will only be shared with those who need it for the purposes of investigating and responding to the complaint, or where disclosure is otherwise required or permitted by law.
Complaint documentation is maintained separately from the patient’s clinical record, with appropriate access restrictions.
Complaints about personal information
If your complaint specifically concerns how BioFit Health has handled your personal data or health information, this will also be treated as a data protection complaint.
You can contact us at:
We will handle data protection complaints in accordance with our obligations under UK data protection legislation.
You also have the right to complain directly to the Information Commissioner’s Office (ICO) if you are concerned about how your personal information has been handled.
Time limit for complaints
As a general working standard, we ask that complaints are raised within 12 months of the event giving rise to the complaint, or within 12 months of becoming aware of the matter.
However, this is not an absolute barrier. We may consider complaints made outside this period where there is a reasonable explanation for the delay and it remains possible to investigate the matter fairly and effectively.
Learning from complaints
We regard complaints as an important source of learning and service improvement.
Every complaint is considered not only in relation to the individual circumstances but also for any wider learning that may improve patient safety, clinical practice, communication or our systems and processes.
Where appropriate, a complaint may lead to further clinical audit, a significant event review, changes to procedures or additional training.
Our aim
Our aim is to ensure that every complaint is:
- listened to;
- acknowledged;
- investigated fairly and thoroughly;
- responded to within a reasonable timeframe;
- handled confidentially; and
- used, where appropriate, to improve our service.
If you have a concern, please contact us as soon as possible so that we have the opportunity to address it.
BioFit Health Ltd
Moat Barn, Little Canfield, CM6 1TD
Email: hello@biofithealth.co.uk