Privacy Policy / Website Terms of Use

https://www.ab-medical.co.uk

Privacy Policy & Website Terms

Last updated: 12 October 2026

A B Medical Services (UK) Ltd respects your privacy. This notice explains how we collect, use, share and retain personal information when you contact us, use our services, apply to work with us or visit our website.

1. Who we are

A B Medical Services (UK) Ltd provides pre-hospital care, ambulance services, event medical cover, medical repatriation and workplace drug and alcohol testing.

We act as a data controller where we determine how and why personal information is used. Where services are commissioned by another organisation, our responsibilities depend on the particular arrangements.

Company number: 08790719
ICO registration number: ZA030863

Privacy enquiries should be addressed to the Managing Director:

Email: operations@ab-medical.co.uk
Telephone: 03443 100 150
Post: A B Medical Services (UK) Ltd, 6 Flintstead, Ridgley Road, Chiddingfold, Surrey, GU8 4ES

2. Information we collect

Depending on the service or relationship, we collect:

• Names, addresses, telephone numbers and email addresses.

• Enquiries, quotations, bookings, correspondence and service arrangements.

• Patient identification, medical history, clinical observations, treatment, medicines and care requirements.

• Next-of-kin, representative and emergency contact details.

• Travel and identification information needed for repatriation.

• Workplace drug and alcohol testing information and results.

• Recruitment information, qualifications, professional registration, employment history, references and identity documents.

• Relevant DBS information, DBS Update Service results and DVLA driving records.

• Staff training and operational records.

• Invoices and payment information.

• Feedback, complaints, incident reports and data protection requests.

• CCTV, dashcam and patient-compartment video and audio recordings.

• Website technical information, cookie identifiers and analytics information.

Please provide only information relevant to the purpose. Contact us before sending extensive medical records so we can discuss an appropriate method.

If necessary information is not provided, we may be unable to arrange a service, deliver care safely or assess an application.

3. Where information comes from

We receive information directly through website forms, emails, telephone calls, bookings and clinical interactions.

Where necessary, we also receive information from representatives, healthcare providers, referring organisations, insurers, assistance companies, commissioning employers, laboratories and referees.

Staff verification information may come from the DBS Update Service, HCPC registration records and DVLA driving records.

If you provide information about someone else, please ensure you have appropriate authority and make relevant privacy information available to them.

4. How we use information

We use relevant information to:

• Respond to enquiries and prepare quotations.

• Arrange and deliver treatment, transport and other services.

• Maintain clinical records and support continuity of care.

• Coordinate international care and medical repatriation.

• Conduct workplace testing for safety and fitness-for-work purposes.

• Assess applications and verify suitability, qualifications, registration and driving authorisation.

• Manage training, staffing, customer relationships and operational planning.

• Prepare event plans and risk assessments.

• Administer bookings, invoices and payments.

• Investigate incidents, complaints and safeguarding concerns.

• Audit care and meet legal and regulatory obligations.

• Handle information-rights requests.

• Protect people, premises, vehicles and systems.

• Understand website performance and advertising activity, subject to applicable consent choices.

Hypnotherapy records managed by One Solution Hypnotherapy are covered by that organisation’s privacy information.

5. Our lawful bases

We identify the appropriate lawful basis according to the purpose and circumstances of the processing.

Enquiries and bookings

For services requested by an individual for themselves, we process information where necessary to take steps at their request before entering into a contract or to perform that contract.

For business contacts and arrangements made on another person’s behalf, we rely on legitimate interests in responding to enquiries and coordinating services, where those interests are not overridden by the individual’s rights.

Patient care

We process information where necessary for legitimate interests in delivering safe care and managing services, or to meet applicable legal obligations. Vital interests may apply in emergencies where its requirements are met.

For necessary healthcare processing, the additional condition is Article 9(2)(h) of the UK GDPR and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018, subject to the required professional confidentiality safeguards.

Consent to treatment is separate from the data protection basis for handling information.

Recruitment and staff checks

We use information to assess suitability and arrange employment or engagement. Relevant checks also support legal recruitment obligations, including Regulation 19 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014.

Enhanced DBS checks and adults’ and children’s barred-list checks are undertaken only where the role is eligible. We use the DBS Update Service where applicable.

For relevant criminal-offence information needed to meet legal obligations relating to employment or engagement, the applicable grounds are Article 6(1)(c) of the UK GDPR, together with Article 10 and Schedule 1, Part 1, paragraph 1 of the Data Protection Act 2018.

Workplace drug and alcohol testing

We process information for legitimate interests in providing commissioned testing to support workplace safety and assess fitness for work.

Where processing is necessary for occupational medicine or assessing fitness for work and the required professional confidentiality safeguards apply, the additional condition is Article 9(2)(h) of the UK GDPR and Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018.

Agreement to testing and the proposed disclosure of results is recorded separately from the data protection grounds for processing information.

CCTV and safety recordings

We rely on legitimate interests in protecting people, premises and vehicles, preventing crime and investigating safety incidents.

Recordings that reveal health information or concern alleged offences are subject to additional data protection requirements. The applicable condition depends on the information and the purpose for which it is used.

Legal obligations and consent

We process information where necessary to meet specific accounting, recruitment, safeguarding and regulatory obligations.

We rely on consent for website technologies where required. Consent may be withdrawn without affecting processing already lawfully carried out.

6. Who we share information with

We share relevant information where necessary and lawful with:

• Healthcare professionals, hospitals, ambulance services and other care providers.

• Referring, commissioning or coordinating organisations.

• Insurers and assistance companies involved in the service.

• Transport providers and agencies involved in a patient’s care or transfer.

• Laboratories and other providers supporting workplace testing.

• Suppliers supporting our clinical, operational, website and communication systems.

• Regulators, safeguarding bodies, police and other authorities where disclosure is required or otherwise justified.

• Professional advisers and insurers where needed for advice, investigations or claims.

We limit disclosures to information necessary for the purpose. An employer or event organiser’s involvement does not automatically entitle them to a patient’s full clinical record.

Workplace testing and The Doctors Laboratory

A B Medical Services (UK) Ltd may collect samples and send them to The Doctors Laboratory for analysis, or arrange for individuals to attend its clinic for sample collection and testing.

We share information necessary to arrange testing, identify samples and receive results. Where The Doctors Laboratory determines how information is used for its own clinical or laboratory services, its own privacy notice applies to that processing.

Before testing, the testing team or clinic explains the procedure and proposed recipients of the results and records the participant’s agreement. The booking requester’s declaration does not replace the participant’s own agreement.

Results are disclosed to the tested individual, commissioning employer or other authorised requesting organisation, as applicable to the agreed arrangements and where lawful.

A B Medical Services (UK) Ltd remains responsible for the booking information, testing records and results that we hold.

Salus3 Cloud

We use Salus3 Cloud, provided by 8bits1byte Limited (8b1b), for clinical records, recruitment, HR, training, customer relationship management, risk assessments, incidents, feedback, complaints, event planning and data protection requests.

The system also supports relevant DBS Update Service, HCPC and DVLA checks.

Our contractual arrangements include a Data Processing Addendum governing processing on our behalf. All information held within our Salus3 Cloud system is stored in the UK.

Website hosting and email

Our website and hosting backups are stored by SiteGround in London, UK, as confirmed by SiteGround for our account.

SiteGround Hosting Ltd processes hosted information on our behalf under its Data Processing Agreement. It uses group companies and other subprocessors to support hosting, security and support services.

Business emails received through SiteGround are forwarded to our Google Gmail account. Correspondence may contain enquiry, booking, patient or recruitment information. We also use NHS.net for some communications.

7. International information sharing

When arranging international care or medical repatriation, we may share necessary information with receiving clinicians, overseas ambulance providers and other transport providers.

Clinical information is limited to what is needed for care and safe transfer. Non-clinical transport providers receive necessary journey, contact and accessibility details.

We document relevant disclosures and their purpose in our CRM platform and clinical records.

Transfers outside the UK are subject to additional legal requirements. Depending on the destination and circumstances, an applicable mechanism may be UK adequacy regulations, appropriate contractual safeguards or a specific legal exception, including a necessary transfer relating to a contract with the patient or a contract made in their interests.

Our technology providers may also process information outside the UK. SiteGround’s arrangements may involve overseas processing or access, including through content delivery services. Its agreement incorporates contractual transfer safeguards, including the UK International Data Transfer Agreement for applicable transfers.

Google services may process information outside the UK. Our standard Gmail account is separate from SiteGround’s contractual processing arrangements.

Contact us for further information about relevant transfers and safeguards, or to request a copy of applicable safeguards, subject to appropriate redaction of confidential information.

8. How long we keep information

Record category	Normal retention period
Adult patient records	10 years from the end of the relevant episode of care
Children’s patient records	Until age 28, or 10 years after the episode of care ends, whichever is later
General enquiries not resulting in bookings	One year after the enquiry closes
Non-clinical booking records and invoices, including subcontractor invoices	Seven years from the associated invoice date
Event plans and event risk assessments	Seven years after the event
Complaints and incident records	10 years after the investigation closes
Unsuccessful applications and associated recruitment records	One year after communicating the recruitment outcome
Unsuccessful applicants’ DBS certificate copies	Securely deleted within six months of the recruitment decision
General HR and training files	Normally six months after employment or engagement ends
Engaged staff’s DBS certificate copies	During employment or engagement, then normally six months after leaving
Workplace testing records and results	One year from the test date
Google Analytics user and event data covered by its retention controls	14 months, without resetting the period on new activity
SiteGround Security Optimizer activity logs	A configured lifetime of 12 days, with older events deleted daily

Different record categories within the same file may have different retention periods. Relevant records may be retained longer where necessary for legal obligations, investigations or claims.

Google Analytics retention controls do not apply to standard aggregated reports, which may remain available longer.

Hosting backups

Our hosting plan includes up to 30 rolling daily backup copies. These may contain website files, databases and email data. The oldest copy is normally removed when a new daily copy is created.

Following deletion of hosted information or termination of the service, SiteGround’s agreement allows up to 60 calendar days for deletion of relevant backup data, subject to applicable legal retention requirements.

Technical logs

Separate server access and error logs support website operation, security and troubleshooting. Their availability does not necessarily indicate their deletion period.

9. CCTV, dashcams and audio recording

We use premises CCTV and vehicle cameras for security, crime prevention, road incident investigation, and staff and patient safety.

Premises and office CCTV

Cameras record continuously. Older footage is automatically overwritten when storage capacity is reached, usually after approximately 30–45 days.

Vehicle CCTV

Routine vehicle footage is automatically overwritten when recording storage reaches capacity. The period varies with vehicle use and recording volume. Footage may remain longer on vehicles used infrequently.

Patient-compartment recording

The system maintains a temporary 30-second rolling buffer. Unless recording is activated, this is overwritten and is not available for viewing.

A clinician can activate recording using the panic strip during a safety incident, such as aggression or an attack. This preserves the preceding 30 seconds and starts ongoing video and audio recording, accompanied by a repeated audible warning.

Recording can also be activated silently from the driver’s cab for crime prevention. It is not used routinely to monitor clinical treatment.

Access and preserved footage

Recording equipment is physically secured behind locked cages. Retrieval requires authorised access and suitable computer equipment.

Access is restricted to authorised Managing Directors and trained Operations Managers for crime prevention and safety purposes.

Relevant footage may be preserved separately while an incident, complaint, insurance claim or legal proceedings remain ongoing. Once concluded, we review whether continued retention is necessary and securely delete footage no longer required.

10. Protecting information

We use organisational and technical measures appropriate to the information and risks, including access restrictions, confidentiality requirements and controlled handling procedures.

No method of transmission or storage is completely risk-free.

11. Your rights and automated decisions

Depending on the circumstances and lawful basis, you may have rights to:

• Access your personal information.

• Correct inaccurate or incomplete information.

• Request erasure.

• Restrict processing.

• Receive certain information in a portable format.

• Withdraw consent where processing relies on consent.

You may object to processing based on legitimate interests on grounds relating to your situation. You can object to direct marketing at any time.

Rights are subject to legal conditions and exemptions. For example, clinical records do not automatically have to be deleted following an erasure request.

Requests can be made verbally or in writing using our contact details. We may need to verify identity.

Subject access requests are normally free and answered within one month, subject to permitted extensions and other applicable provisions. Where additional time or a fee is lawfully applicable, we will explain this.

Clinical and recruitment decisions are made by people. We do not make decisions with legal or similarly significant effects based solely on automated processing.

12. Privacy concerns and complaints

Contact the Managing Director if you have concerns about how we handle information.

You may also complain directly to the Information Commissioner’s Office without first completing our complaints procedure.

Website: ico.org.uk
Telephone: 0303 123 1113

13. Cookies and similar technologies

We use Clickio to manage website cookie choices. Visitors can accept optional cookies, reject them or manage individual preferences through the consent banner.

You can review or change your choices at any time using the cookie preferences button at the bottom left of the website.

Our website includes Google Analytics and Google Ads tags, managed through Google Tag Manager. Google Consent Mode communicates your consent choices to supported Google tags.

For details of cookies and similar technologies, their purposes, providers, durations and available controls, please read our Cookie Policy.

14. External websites and embedded content

Our website may link to external websites or include third-party content.

These services have their own privacy practices. Review their privacy information when interacting with them. Technologies requiring consent remain subject to applicable consent controls.

15. Website terms of use

Website information

Website information describes our organisation and services. It does not replace an individual clinical assessment or advice from an appropriate healthcare professional.

Our website and forms are not emergency response channels. In a UK medical emergency, call 999 or 112.

Bookings

Submitting an enquiry or booking request does not by itself confirm a booking. Services are subject to the agreed quotation, confirmation and our Terms and Conditions of Service.

Acceptable use

You must not use the website unlawfully, attempt unauthorised access, introduce malicious software or interfere with its operation.

Copyright

Content belongs to A B Medical Services (UK) Ltd or is used with permission, unless otherwise stated.

You may view, download or print content for personal reference or to consider our services. Other reproduction or commercial use requires the relevant rights holder’s permission.

Accuracy and availability

We take reasonable care over accuracy, but information may change and the website may occasionally be unavailable. Contact us to confirm details material to a service decision.

Nothing in these terms excludes liability that cannot lawfully be excluded, including liability for death or personal injury caused by negligence, or affects your statutory rights.

16. Changes to this notice

We review this notice and update it when our practices or requirements change. The latest revision date appears above.

Significant changes will be brought to your attention where required.