Privacy policy

The Private GP Forum publishes general information for GPs and other professionals working in, or considering, private general practice. It does not give medical advice to patients. This policy explains how we handle personal data when you use the site, subscribe to our newsletter, The Beat, or contact us. Please also read our cookies policy and terms and conditions.

Who we are

The Private GP Forum (www.theprivategpforum.co.uk) is run by Healthwatch Limited. Healthwatch Limited is the “controller” of your personal data, which means we decide how and why it is used and we are responsible for looking after it. In this policy, “we”, “us” and “our” mean Healthwatch Limited.

• Company number: 06997189
• Registered office: Mayfield Clinic, 256 Banbury Road, Oxford, England, OX2 7DE
• ICO registration number: Z269672X
• Email: hello@theprivategpforum.co.uk

Please send any question about this policy or your data to the email address above.

The personal data we collect

You can read the site without giving us any personal data. We collect personal data only in these cases.

If you subscribe to The Beat

• Your email address.
• A record of your consent: the wording you agreed to, the page you signed up on, when you signed up and confirmed, and whether you are subscribed, waiting to confirm or unsubscribed.

If you subscribed to The Beat on Substack

We moved The Beat from Substack to this site in September 2026. We copied across your email address, your name and country if you gave them to Substack, and the date you first subscribed. If you had a paid Substack plan, we also copied the type of plan and the date it ends, so we can honour it. We did not copy your reading or engagement history.

If you email us

Your name, email address and anything you include in your message. Please don’t send us information about patients or your own health.

If you accept analytics cookies

A random identifier stored in a cookie, the pages you view, the site that referred you, the links you click (including links to other websites), and your device, browser and approximate location (country or city, worked out from your IP address). We don’t record your screen or anything you type, and we don’t use analytics to identify you by name. See our cookies policy for the details.

When you visit the site

Like any website, our servers receive technical information with each request, such as your IP address, browser type, the page requested and the time. Our hosting provider keeps this in short-lived server logs. When you sign up to The Beat we also use your IP address, held briefly in memory and not stored, to limit repeated sign-up attempts.

What we don’t collect

There are no user accounts and no payments on this site. We don’t ask for health information or any other special category data.

How we use your data and our lawful basis

UK data protection law (the UK GDPR and the Data Protection Act 2018) says we must have a lawful basis for each use of your data. These are ours.

• Sending The Beat. We use your email address to send our monthly newsletter and, rarely, messages about the newsletter itself. Lawful basis: your consent (UK GDPR Article 6(1)(a)), which you give when you sign up and confirm your email address. Sending marketing emails also requires consent under the Privacy and Electronic Communications Regulations (PECR).
• Honouring paid Substack plans. If you had a paid Substack plan, we keep its type and end date so we can give you what you paid for until it ends. Lawful basis: our legitimate interests in keeping our promise to existing subscribers.
• Analytics. We use analytics cookies to understand which pages and links are used, so we can improve our guides. Lawful basis: your consent (UK GDPR Article 6(1)(a) and PECR). Analytics only run after you choose “Accept analytics”.
• Replying to you. We use what you send us to answer your question, consider a correction or deal with your request. Lawful basis: our legitimate interests in responding to the people who contact us.
• Running and protecting the site. We use server logs and sign-up rate limits to keep the site working, secure and free of abuse. Lawful basis: our legitimate interests in running a secure website.
• Legal obligations. We may use or keep data where the law requires it, for example to respond to a lawful request from a regulator. Lawful basis: legal obligation (Article 6(1)(c)).

Where we rely on legitimate interests, we have considered your interests and rights and believe that the use is expected and has little impact on you. You can object at any time (see your rights).

We don’t sell your personal data, and we don’t make decisions about you by purely automated means.

If you subscribed on Substack

You agreed to receive The Beat when you subscribed on Substack. We now send the same newsletter from this site instead, so we rely on that consent. Every issue has a link to unsubscribe.

If you don’t want to receive The Beat from us, unsubscribe using the link in any email or email hello@theprivategpforum.co.uk. Past issues remain on Substack as an archive, and Substack handles any data it holds under its own privacy policy. If you paid for a Substack plan, Substack and its payment provider handled the payment: we never received your card details.

Who we share your data with

We use trusted service providers (“processors”) to run the site and the newsletter. They may only use your data on our instructions and must keep it secure.

• Vercel hosts the website and keeps its server logs.
• Supabase hosts the database that holds the newsletter list, in London (UK).
• Resend sends our emails, including The Beat and sign-up confirmations, from the EU (Ireland).
• Microsoft (Microsoft 365) runs our email inbox, so it handles emails you send us.
• PostHog provides website analytics, stored in its EU cloud in a project used only for this website. Only with your consent.
• Google (Google Analytics) provides website analytics. Only with your consent.

We may also share data with our professional advisers (such as lawyers and accountants), with regulators, the police or courts where the law requires it, and with a buyer or successor if the site or our business is sold or reorganised. In that case the new owner would have to use your data in line with this policy.

International transfers

Most of our data is stored in the UK or the European Economic Area (EEA). The UK government has confirmed that EEA countries protect personal data adequately. Some of our providers, such as Vercel and Google, are based in the United States or may access data from outside the UK.

Where personal data is transferred outside the UK, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified) or on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Email hello@theprivategpforum.co.uk for more information.

How long we keep your data

• Newsletter: while you are subscribed. If you unsubscribe, we keep your email address, the date and the fact you unsubscribed on a suppression list, so that we don’t email you again by mistake. If you never confirm your sign-up, we don’t send you The Beat and we automatically delete unconfirmed sign-ups after 30 days.
• Paid Substack plan details: until the plan ends.
• Emails you send us: for as long as we need to deal with your message, and for a reasonable period afterwards in case you follow up.
• Analytics: for the period set in each tool’s data retention settings, after which it is deleted or kept only in aggregate. Analytics cookies expire as set out in our cookies policy.
• Server logs: for a short period, set by our hosting provider, for security and fixing faults.

Your rights

Under UK data protection law you have the right to:

• be told how we use your data (this policy)
• get a copy of the personal data we hold about you (access)
• have inaccurate data corrected (rectification)
• have your data deleted (erasure)
• ask us to limit how we use your data (restriction)
• object to our use of your data where we rely on legitimate interests
• receive the data you gave us in a reusable format, or have it sent to someone else (portability)
• withdraw your consent at any time

Some rights apply only in certain circumstances. To use any of them, email hello@theprivategpforum.co.uk. It’s free, and we will reply within one month. We may ask you to confirm your identity first.

Withdrawing consent

To stop receiving The Beat, use the unsubscribe link in any email or email us. To stop analytics, choose “Cookie settings” at the bottom of any page and switch analytics off. Withdrawing consent doesn’t affect anything we did with your data before you withdrew it.

Cookies

We use one strictly necessary cookie to remember your cookie choice, and analytics cookies only if you accept them. Our cookies policy lists every cookie and explains how to change your choice.

Links to other websites

The site links to other websites, including suppliers and products in our systems directory. Those sites have their own privacy and cookie policies, and we are not responsible for how they use your data. Some links include tracking parameters in the address (such as “utm_source”) that tell the other site the visit came from us. They don’t contain your personal details.

Keeping your data secure

We use appropriate technical and organisational measures to protect your data. The site is served over HTTPS, the newsletter list can be read only by our own server code and authorised staff, and our providers are bound to keep data secure. No website can be completely secure, so please contact us straight away if you think your data has been put at risk.

Children

This site is for healthcare professionals. It is not intended for anyone under 18, and we don’t knowingly collect data from children. If you think a child has given us their details, email us and we will delete them.

Changes to this policy

We may update this policy, for example when we add a new feature or service provider. We will change the “Last updated” date at the top of this page, and where a change is significant we will tell subscribers by email or show a notice on the site.

How to complain

If you are unhappy with how we have used your data, please email hello@theprivategpforum.co.uk first so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection: visit ico.org.uk/make-a-complaint or call 0303 123 1113.