This notice tells you how Doccla uses information about you when we are responsible for it. If you are using a Doccla device as part of a service run by an NHS trust, the trust is responsible for your health information and their own privacy notice applies. We handle it for them, on their written instructions. If you are not sure which applies to you, ask us and we will tell you.
We only collect the information needed to care for you, like your contact details, health information, and how you use our service.
We use it to monitor your health, keep your healthcare team up to date, contact you when needed, meet legal requirements, and improve the safety of our service.
Your data is kept safe with strict security measures and shared with your care team, with the suppliers who run our service, and in the limited other situations set out in section 6 — never sold. Your health information is also confidential, and we treat it that way. We may also use your data to keep the service safe and working properly, to improve it, and to support research. Beyond what is needed to deliver your care safely we use anonymised or aggregated information, and we would only use information that identifies you for research if you agreed, or if a study had approval under section 251 of the NHS Act 2006.
We do not ask you to consent to us using your health information to provide your care. The law already allows it, and your care should never depend on a permission you cannot realistically refuse.
You have rights over your data, including seeing it, correcting it, deleting it, limiting its use, or requesting a copy of it (see paragraph 10 below). Questions: dpo@doccla.com
We are Doccla UK Limited (referred to as Doccla, we, us and our in this Privacy Notice), a company incorporated in England and Wales with company registration number 12206481 and whose registered office address is 184 Shepherds Bush Road, Hammersmith, London, England, W6 7NL.
We provide remote health monitoring services to help you manage your health from home. We work closely with your healthcare provider and other members of your care team to make sure you receive safe, effective, and personalised care.
The information set out in this Privacy Notice is provided to individuals whose personal data we process (you or your), in compliance with our obligations under the Data Protection Act 2018, the UK GDPR and the Data (Use and Access) Act 2025.
If you are a visitor to our website, or you contact us on behalf of a healthcare provider, this notice does not apply to you. Please see our Website and Business Contacts Privacy Notice instead.
We are the data controller for your information where we are the organisation responsible for your remote monitoring care, which is usually the case in our proactive care services. This notice describes what we do in that situation.
Where your care is run by an NHS trust and we provide the platform, the devices and non-clinical support, the trust is the data controller and we act as their data processor. We then handle your information only on their written instructions, and their privacy notice explains how your information is used. If you ask us for a copy of your data in that situation, we will pass your request to the trust and help them answer it.
Our contact details are as follows:
We only collect the information we need to look after you properly. This may include:
Generally, the information we hold about you comes from your healthcare provider and records they hold or from you directly by the way that you engage with us, for example by doing any of the following:
Other than health data, we do not ask you for other special category information, such as details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, and genetic and biometric data, and we do not ask you about criminal convictions or offences. Some of this may still appear in the clinical notes and referral letters your care team sends us. Where it does, we handle it under the same conditions and with the same protections as the rest of your health data.
Children’s data: where we provide services in respect of a child, we process the child’s health and other personal data on the lawful bases set out in this Privacy Notice (and not on the basis of consent). Where appropriate, acknowledgements and contact details may be provided by a person with parental responsibility for the child or another person authorised to act on the child’s behalf, and we take account of the child’s age and understanding when handling their data.
We use your information for the following (including the purpose and legal grounds for processing your personal information):
In such scenarios, we will rely on the following additional lawful basis for the processing of your health data:
Keeping the service safe and working properly. We use your health information to investigate faults, check that our alerts and monitoring work correctly, audit the care we provide, and carry out the safety monitoring the law requires for our medical devices. This is part of looking after you safely, not product research (Legal basis: Article 6(1)(e), and Article 6(1)(c) where the law requires it; Article 9(2)(h) for the management of health care systems and services and Article 9(2)(i) for ensuring high standards of quality and safety of health care and medical devices, read with paragraphs 2 and 3 of Part 1 of Schedule 1 to the Data Protection Act 2018).
Designing new features. Where we design new products or features to improve our care beyond what is needed to deliver your care safely, we use anonymised or aggregated data, which falls outside data protection law. For research, we would only use information that identifies you with your agreement, or where a study has approval under section 251 of the NHS Act 2006, because an Article 9 condition alone does not answer the duty of confidentiality we owe you.
We take great care to protect your information. We handle your data in line with data protection laws and follow recognised industry best practices, including by taking appropriate technical and organisational measures to guard against unauthorised or unlawful processing, accidental loss, destruction or damage. For example:
However, while we will do our best to protect your personal information, we cannot guarantee the security of your information which is transmitted via an internet or similar connection.
We share your health information with the people looking after you, when it is necessary for your care. That includes:
We do this under Article 9(2)(h) UK GDPR, read with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, together with the Article 6 grounds set out in paragraph 4. We do not ask for your consent, because the law already allows it and your care should not depend on a permission you cannot realistically refuse.
Separately from data protection law, your health information is confidential. We share it within your care team on the basis of the relationship you have with them, which is how care across the NHS normally works. We would not share it outside your care team without telling you, unless the law required it or there was a serious risk to your safety or someone else's.
If you have asked us to involve a family member, carer or someone holding a Health and Welfare Lasting Power of Attorney, we record that and follow it. You can change your mind at any time.
If you would rather we did not share your information with a particular person or organisation, tell us. We will respect that wherever we safely can, and we will tell you if it would affect your care.
We also use other companies to operate our platform, for example hosting, our clinical record system and our customer support system. They act only on our written instructions, under a contract that requires them to protect your information to the same standard we do, and they may not use it for their own purposes. We check them before we appoint them and we keep a record of who they are, which you can ask us for.
Outside your care, we may share your personal data:
We do not share your health information for any purpose beyond your individual care without a lawful basis for doing so. Where the national data opt-out applies, we respect it: it covers uses of your information for research and planning beyond your own care.
We never sell your information.
We may use your data in an anonymised and/or aggregated format — information that cannot identify you — to:
Such data will be anonymised and/or aggregated such that the data is not linked to you and you cannot be identified from the data.Where data cannot be fully anonymised and remains health data, we use it only to keep the service safe and working properly, or with your agreement, or where a research study has approval under section 251 of the NHS Act 2006.
We will not transfer personal data relating to you to a country which is outside the UK and EEA unless:
Where your care is commissioned by the NHS, we keep your health information in the United Kingdom unless the trust has agreed otherwise in writing.
We have systems in place to periodically review and delete data that is no longer being used by us for the purposes set out in this Privacy Notice. We follow the retention periods in the Records Management Code of Practice for Health and Social Care (NHS England, 2023), which for most adult health records is eight years after your last contact with the service. Unless the law requires us to keep it for longer, we keep your health records for the periods in that Code, and we keep other information only for as long as we need it. Those periods run on after your care with us ends.
If services are being provided to you pursuant to an agreement between us and your healthcare provider, we will retain your personal information for the duration of our contract with your healthcare provider, and then return or delete it as that agreement requires.
In relation to your health data, where we have an obligation to retain this data (for example, for health and safety purposes) we will retain such data for the duration required by our obligation.
Stopping the service does not delete the records we are required to keep. We will tell you plainly what we keep and for how long if you ask.
Where we no longer need your personal information, we will dispose of it in a secure manner.
In some circumstances you can ask us to delete your data: see the Your Rights section at paragraph 10 below for further information.
In some circumstances we will anonymise and/or aggregate your personal data for research or statistical purposes, in which case we may use this anonymised and/or aggregated information indefinitely without further notice to you.
In respect of the personal data about you that we are processing in accordance with the Data Protection Act 2018 and the GDPR, in certain circumstances (and provided that exemptions do not apply) you will have the following rights over your personal information:
We will respond within one month. If your request is complex we may take up to two months longer; we will tell you within that first month if that happens, and why. Some limits apply to health records in particular: we may withhold information that would be likely to cause serious harm to anyone's physical or mental health, or that identifies another person, and we take advice from the appropriate health professional before we answer.
The national data opt-out: if you have told the NHS that you do not want your confidential patient information used for research and planning, we respect that choice. It does not affect the care you receive.
If your care is run by an NHS trust and we are handling your information for them, send your request to us or to the trust. If you send it to us we will pass it on and help them answer it.
If you are receiving marketing communications from us, you have the right to unsubscribe from such communications at any time by following the link in the footer of the last email you received from us or by sending your request with detailed instructions to us (see contact details above).
Please note that we do not rely on your consent to process the health data that is necessary to provide your care. Where you have given consent for an optional purpose (for example, marketing) and you later withdraw it, this will not affect your care, although it may mean you no longer receive that optional element.
If you consider our use of your personal information to be unlawful, you have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office. Please see further information on their website: www.ico.org.uk. We would rather you came to us first, at dpo@doccla.com, so that we can put it right.
If you want to use any of these rights, please email: dpo@doccla.com
We do not make decisions about your care by automated means alone, without a person involved.
We may amend this Privacy Notice from time to time, for example to keep it up to date, to implement minor technical adjustments and improvements or to comply with legal requirements. We will always publish the current version of this Privacy Notice on our website, and the “last updated” line below tells you when we last changed it. If we make a change that significantly affects how we use your information, we will tell you directly.
Last updated: October 2026
Version 1.4: October 2026