Sheffield Memory &
Geriatric Care
Privacy notice
Last updated: 25 September 2026
This notice explains how personal information is collected, used, shared and protected when you contact Dr Pravin Jha, Consultant Geriatrician, when you use this website, or when you (or someone you care for) are seen as a patient of Sheffield Memory & Geriatric Care. It is written for patients, relatives, carers, attorneys and referring clinicians. It covers geriuk.com and any other site we run under the geriuk.com name.
1. Who we are and how to contact us
The data controller is Fulwood Healthcare Limited. The company is registered in England and Wales under company number 08463148, with its registered office at 6 Stumperlowe Hall Road, Sheffield S10 3QR. It is registered with the Information Commissioner’s Office (ICO) under reference ZA230853. The practice trades as Sheffield Memory & Geriatric Care.
Dr Pravin Jha (GMC 4755744) is the clinician responsible for your care and our contact for all data protection matters.
- Email: pravinjha@hotmail.com
- Post: Data Protection, Fulwood Healthcare Limited, 6 Stumperlowe Hall Road, Sheffield S10 3QR
We are a small practice, so the law does not require us to appoint a Data Protection Officer. Dr Jha deals with data protection questions himself.
Hospitals and clinics. I see patients at Spire Claremont Hospital, Circle Thornbury Hospital and LivingCare (Canon Medical Arena) in Sheffield. Each of these keeps its own records of your visit, such as registration, nursing notes, tests and its own billing, and is a separate data controller for those records under its own privacy notice. I keep my own clinical record of your consultations. This notice covers that record.
2. The information we hold
- Identity and contact details: name, date of birth, address, telephone number, email address, NHS number and hospital numbers.
- People involved in your care: details of your next of kin, relatives and carers, and of anyone who holds a Lasting Power of Attorney for you or is your court-appointed deputy.
- Health information: your medical history, medicines, examination findings, cognitive test results (for example ACE-III or MoCA), blood tests, scans and other investigations, diagnoses, treatment plans, clinic letters and reports. We also record what your GP, other clinicians and your family tell us.
- Insurance and payment details: insurer, membership number, authorisation codes, invoices and records of payment. We do not take or store card details. Self-funding patients pay by bank transfer.
- Correspondence: emails, messages, notes of telephone calls and anything you send through the website contact form.
- Website information: see section 11.
When a relative or carer gives us information, including information about their own situation (for example the pressure of caring), we record it in the patient’s record because it is relevant to the patient’s care.
3. Where the information comes from
Most of it comes from you, or from a relative, carer or attorney acting for you. We also receive information from your GP and other doctors, nurses and therapists involved in your care; from hospitals and laboratories that carry out your tests; and from your insurer when it authorises treatment.
4. Why we use it and our legal basis
Data protection law requires a lawful basis for each use of personal information, and an additional condition for health information.
| What we use it for | Lawful basis (UK GDPR Article 6) | Condition for health information (Article 9 and the Data Protection Act 2018) |
|---|---|---|
| Assessing, diagnosing and treating you, and following you up | Contract with you (Art 6(1)(b)). Where someone else arranges or pays for your care, our legitimate interest in providing it (Art 6(1)(f)). | Provision of health care (Art 9(2)(h); DPA 2018 Sch 1 para 2) |
| Writing to your GP and other clinicians involved in your care | As above | Provision of health care (Art 9(2)(h)) |
| Replying to enquiries and arranging appointments | Steps taken at your request before a contract (Art 6(1)(b)), or legitimate interests (Art 6(1)(f)) | Provision of health care (Art 9(2)(h)), where you give us health details |
| Invoicing you or your insurer | Contract (Art 6(1)(b)) | Management of health care services (Art 9(2)(h)) |
| Meeting legal and professional duties, such as GMC requirements, tax and accounting rules and court orders | Legal obligation (Art 6(1)(c)) | Art 9(2)(h), and Art 9(2)(f) or (g) where relevant |
| Protecting you or someone else from serious harm, including safeguarding | Vital interests (Art 6(1)(d)) or legitimate interests (Art 6(1)(f)) | Safeguarding of individuals at risk (Art 9(2)(g); DPA 2018 Sch 1 para 18), or vital interests (Art 9(2)(c)) |
| Handling complaints and defending legal claims | Legitimate interests (Art 6(1)(f)) | Legal claims (Art 9(2)(f)) |
| Clinical audit and improving the service, using anonymised information wherever possible | Legitimate interests (Art 6(1)(f)) | Management of health care services (Art 9(2)(h)) |
| Website analytics | Consent (Art 6(1)(a)) | Not applicable |
| Showing our Google reviews on this website | Legitimate interests (Art 6(1)(f)) | Not applicable |
We also owe you a duty of confidentiality as your doctor. Information is shared only with people who need it to care for you, or where the law or professional guidance allows or requires it.
5. Memory assessment, capacity and people who act for you
Many of my patients come with a relative, and many are having their memory assessed. With your agreement, I will discuss your assessment with the people you choose. If you lack the capacity to decide who should receive your information, I will act in your best interests under the Mental Capacity Act 2005. That includes working with anyone who holds a Lasting Power of Attorney for health and welfare, or a deputy appointed by the Court of Protection, within the authority they hold. You can tell us at any time who we may, or may not, speak to.
6. Who we share information with
- Your GP and other clinicians involved in your care. I normally send your GP a copy of my letter. If you do not want your GP told, please say so and we will talk through what that means for your safety.
- The hospital where you are seen and its imaging, laboratory and pharmacy services, when I request tests or prescribe.
- Your insurer, if you are insured: only what it needs to authorise and pay for your care.
- Relatives, carers and attorneys, with your agreement or as described in section 5.
- The DVLA. If a condition affects your ability to drive safely, I will ask you to tell the DVLA. If you cannot or will not, GMC guidance allows me to tell the DVLA’s medical adviser. I would let you know before doing so.
- Safeguarding and public authorities, when the law requires it or there is a serious risk of harm.
- Service providers who work on our instructions and must keep your information secure and confidential. These include email, IT and secure cloud storage providers; software that helps transcribe and draft clinic letters (I check every letter before it is sent); our website host; and our accountant.
- Our professional advisers and indemnity provider, if we need advice or face a claim or complaint.
- Regulators and courts, such as the GMC, the ICO or a court, when we are legally required to share.
If you choose a video consultation, it runs on the platform you prefer, such as FaceTime, WhatsApp, Zoom, Microsoft Teams or Google Meet, and that platform handles the call data under its own privacy terms. If I want to record or transcribe a consultation to help write the letter, I will ask you first, and you can say no.
We never sell your information, and we do not use it for marketing.
7. Transfers outside the UK
Some of our service providers store or process data outside the UK, for example in the European Economic Area or the United States. Any such transfer has a legal safeguard in place: UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), or the ICO’s International Data Transfer Agreement or Addendum.
8. How long we keep information
- Clinical records: kept in line with the NHS Records Management Code of Practice. For adults this is normally 8 years after your last contact with us, or 8 years after death. Records about mental health conditions, which can include dementia and cognitive assessments, are kept for 20 years after the last contact, or 8 years after death if that is sooner.
- Invoices and financial records: 6 years after the end of the financial year they relate to, as tax law requires.
- Enquiries that do not lead to an appointment: deleted within 12 months.
- Complaints and legal claims: kept for as long as they need to be dealt with, and then for the relevant limitation period.
When the retention period ends, records are securely destroyed.
9. How we protect your information
Records are kept on password-protected, encrypted devices and in secure accounts, and only people who need them for your care or our legal duties can access them. Our service providers are bound by written terms to protect your data and to use it only on our instructions. If a data breach puts your rights at risk, we will tell you and the ICO as the law requires.
10. Your rights
You have the right to:
- ask for a copy of the information we hold about you (a subject access request);
- have inaccurate information corrected. Where a clinical opinion is disputed, we can add your view to the record;
- ask us to delete information. We may have to refuse where we must keep medical records by law or professional rules;
- ask us to restrict how we use your information, or object to our using it on the basis of legitimate interests;
- receive information you gave us in a portable format, where the law allows;
- withdraw consent at any time, where we rely on consent (for example for analytics cookies).
To make a request, email pravinjha@hotmail.com or write to the address in section 1. We may need to confirm your identity first. We will respond within one month, and there is normally no charge. A relative, attorney or deputy can make a request for you if they have the legal authority to act.
11. This website: forms, cookies and analytics
Contact form. When you use the contact form we receive your name, email address, telephone number and message. They are stored on our website and emailed to us, and we use them only to answer you.
Cookies and similar technologies used on this website:
- Essential cookies that make the site and its forms work, and remember your cookie choices. These do not need consent.
- Google Analytics (only with your consent), which tells us how visitors use the site (pages viewed, approximate location, device type). IP addresses are not stored by Google Analytics 4.
- The reviews widget, which displays our Google reviews and may be served from its provider’s servers.
- Visit statistics recorded on our own server by our hosting and website software, such as the page visited, time, browser and IP address, used for security and basic traffic counts.
Google Analytics runs only if you accept it in the cookie banner. You can change your choice at any time through the Cookie settings link in the footer, block cookies in your browser settings, or install Google’s opt-out add-on at tools.google.com/dlpage/gaoptout.
12. Google reviews shown on this website
This website displays reviews that patients and families have left on our Google Business Profile. We retrieve them from Google through the Google Business Profile API, using our own account and read-only access. We store the review text, star rating, date, our reply and the reviewer’s display name, shown as first name and initial, only to display them here. A review deleted or edited on Google is removed or updated here at the next automatic check. Information received from Google APIs is used and transferred in line with the Google API Services User Data Policy, including its Limited Use requirements. We do not sell it, use it for advertising, or share it with anyone else. If you have left a review and want it removed from this website, email us and we will hide it.
13. Complaints
If you are unhappy with how we have handled your information, please contact Dr Jha first. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow SK9 5AF.
14. Changes to this notice
We review this notice regularly and will post any changes on this page. The date at the top shows when it was last updated.