Privacy Notice — Later Life Medicine
 

Last updated: 8 September 2026

1. Who we are

ELM Medical Services Ltd, trading as Later Life Medicine, is the data controller for the personal information we process in connection with our services.

Registered/business address:
Cortlandt, George Street
Hailsham
East Sussex
England
BN27 1AE

Email: info@laterlifemedicine.co.uk
Website: www.laterlifemedicine.co.uk

Later Life Medicine provides private specialist geriatric medicine services, including assessment and management of frailty, multimorbidity, cognitive and memory concerns, medication complexity, falls and mobility problems, functional deterioration and complex or uncertain illness. Services may be provided in clinic or through domiciliary assessments.

We are registered with the Information Commissioner's Office (ICO) for data protection purposes.
 

2. What personal information we collect

Depending on the services provided, we may process:

• Your name, date of birth and contact details.

• Information about your GP, hospital or other healthcare providers.

• Medical history, diagnoses, symptoms, medications, allergies, investigations, treatment and other health information.

• Information concerning mobility, function, cognition, capacity, care needs and social circumstances where relevant to your assessment or care.

• Information provided by relatives, carers or representatives where appropriate.

• Referral letters, clinical correspondence, reports and other information relevant to your care.

• Appointment and administrative information.

• Insurance, payment and billing information.

• Information relating to complaints, incidents, legal matters or regulatory requirements.

• Information provided through correspondence with the practice, including email.

Health information is special category personal data under UK data protection law and is subject to additional legal protections.
 

3. Where we obtain information

We may obtain personal information directly from you or from:

• Relatives, carers or authorised representatives.

• Your GP or other healthcare professionals.

• Hospitals and other healthcare organisations.

• Insurers or organisations responsible for payment.

• Reports, referrals and clinical correspondence.

• Our website and email communications.

• Other lawful sources where this is necessary for your care or for our legal and regulatory responsibilities.

Where information is obtained from another source, we will provide the relevant privacy information within the timescales required by data protection law.
 

4. How we use your information

We process personal information where necessary to:

• Assess, diagnose, advise on and provide healthcare.

• Arrange and manage appointments.

• Communicate with you about your care.

• Communicate with other healthcare professionals involved in your care.

• Make referrals and obtain relevant clinical information.

• Maintain accurate clinical records.

• Provide second opinions and ongoing specialist care.

• Process payments and insurance claims.

• Respond to complaints and manage incidents.

• Meet legal, professional and regulatory obligations.

• Protect the security of our systems, records and services.

• Establish, exercise or defend legal claims where necessary.

We will only use your information for purposes that are compatible with the purposes for which it was collected, or where otherwise permitted or required by law.
 

5. Our lawful bases for processing

Under UK GDPR, we must have a lawful basis for processing personal data.

Depending on the circumstances, we may rely on:

• Performance of a contract, where processing is necessary to provide services that you have requested.

• Legal obligation, where we are required to process information to comply with the law.

• Legitimate interests, where processing is necessary for the legitimate interests of the practice and those interests are not overridden by your rights and interests.

Because health information is special category data, an additional condition under Article 9 UK GDPR is required. For the provision of healthcare, we generally rely on the health or social care condition under Article 9(2)(h), subject to the applicable safeguards and professional confidentiality requirements.

We do not generally rely on consent as the lawful basis for routine healthcare processing. Where we do rely on consent for a particular activity, you may withdraw that consent, although this will not affect processing already carried out lawfully before withdrawal.
 

6. Confidentiality and sharing information

We take medical confidentiality seriously.

We may share relevant personal information with healthcare professionals and organisations where this is necessary and lawful for your care, including:

• Your GP.

• Other doctors or healthcare professionals involved in your care.

• Hospitals or other healthcare organisations.

• Relatives, carers or representatives where appropriate and lawful.

• Insurers or organisations responsible for payment, where appropriate.

• Legal, regulatory or statutory bodies where we are legally required or permitted to disclose information.

We aim to disclose only information that is relevant and necessary for the particular purpose.

Where another organisation acts as a separate data controller, that organisation is responsible for its own processing of your information and should provide its own privacy information.

We will not disclose confidential information simply because someone requests it. We will consider confidentiality, legal requirements, professional obligations and, where relevant, your wishes and capacity.
 

7. Email and electronic communication

You may contact Later Life Medicine by email.

Email is not an emergency communication method and messages may not be read immediately. If you require urgent medical assistance, you should contact the appropriate emergency or urgent-care service.

Email is not completely risk-free. You should consider this when sending sensitive information electronically.

Where you send clinical information to the practice by email, information that is relevant to your care may be reviewed and incorporated into your clinical record.

We will seek to use secure and appropriate systems and will limit access to authorised individuals.
 

8. Clinical records

Your principal clinical record is maintained using WriteUpp, our clinical record system.

WriteUpp provides security measures including encryption, two-factor authentication and secure hosting. Clinical information is hosted within the European Union, including Microsoft Azure infrastructure in Dublin, Ireland, with appropriate safeguards for data protection.

Information contained in clinical correspondence, including relevant emails, may be transferred into the clinical record where appropriate.

Email is therefore treated as a communication channel rather than the principal long-term clinical record.
 

9. Our email and IT systems

We use Google Workspace for our practice email and related business services.

We use appropriate technical and organisational measures to protect information, including:

• Individual user accounts.

• Two-step verification.

• Access controls.

• Encryption and secure transmission.

• Secure clinical record systems.

• Device security.

• Software updates.

• Firewall protection.

• Appropriate password and authentication controls.

• Limiting access to information to those who need it.

Google may process or store information in countries where Google or its service providers operate. Where UK personal data is transferred internationally, we use the safeguards required by applicable UK data protection law.
 

10. Website and cookies

Our website may use cookies and similar technologies that are necessary for the operation, security and functionality of the website.

Where non-essential cookies or similar technologies are used, we will seek your consent where required by law. You can manage your cookie preferences through the cookie consent mechanism provided on our website.

The website may also collect limited technical information, such as information relating to your device, browser and use of the website, where this is necessary for website operation, security or other lawful purposes.
 

11. Payments and insurance

Where payment is made directly to Later Life Medicine, we may process information necessary to administer the payment and maintain appropriate financial records.

Where healthcare services are funded or reimbursed by an insurer or another organisation, we may share relevant information with that organisation where necessary and lawful to administer the payment or claim.

We will seek to limit information shared for these purposes to what is relevant and necessary.

12. International transfers

Some of the technology and service providers we use may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will comply with applicable UK data protection law and ensure that appropriate safeguards are in place where required.
 

13. How long we keep information

We retain personal information only for as long as it is necessary for the purposes for which it is processed, taking account of our legal, professional, regulatory and clinical responsibilities.

Clinical records are retained for an appropriate period having regard to:

• The nature of the clinical record and the patient's condition.

• The patient's ongoing care.

• Applicable professional guidance.

• Applicable health-record retention guidance.

• Legal and regulatory requirements.

• Complaints, litigation or other circumstances where information may need to be retained.

Clinical records will not routinely be deleted simply because an episode of care has ended.

Emails and other administrative correspondence are not intended to be retained indefinitely where they merely duplicate information already held in the clinical record. They may nevertheless be retained where necessary for clinical, administrative, legal, regulatory, complaint or evidential purposes.

We periodically review information where appropriate and securely delete or anonymise information when it is no longer required.
 

14. Keeping your information secure

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction, alteration or disclosure.

These measures include appropriate authentication and access controls, secure systems, encryption, device security, software updates and procedures for responding to information-security incidents.

No electronic system can be guaranteed to be completely secure, but we seek to maintain appropriate safeguards proportionate to the sensitivity of the information we process.
 

15. Your data protection rights

Depending on the circumstances, you have rights under UK data protection law including the right to:

• Request access to the personal information we hold about you.

• Ask us to correct inaccurate or incomplete information.

• Request restriction of processing in certain circumstances.

• Object to certain processing.

• Request erasure where the legal requirements for erasure are met.

• Request data portability where applicable.

• Withdraw consent where processing is based on consent.

These rights are subject to legal exceptions and limitations. In particular, the right to erasure and some other rights may not apply in the same way to information that we are required or entitled to retain as part of a medical record.

To exercise your rights, please contact:

info@laterlifemedicine.co.uk

We may need to verify your identity before responding to a request.
 

16. Complaints

If you have concerns about how we have handled your personal information, please contact us first at:

info@laterlifemedicine.co.uk

We will investigate your concern and seek to resolve it.

You also have the right to complain to the Information Commissioner's Office (ICO) if you believe that your personal information has been handled unlawfully.
 

17. Changes to this privacy notice

We may update this Privacy Notice from time to time to reflect changes to our services, technology, legal requirements or data-processing arrangements.

The latest version will be published on our website and will show the date on which it was last updated.

ELM Medical Services Ltd trading as Later Life Medicine
Cortlandt, George Street, Hailsham, East Sussex, England, BN27 1AE
Email: info@laterlifemedicine.co.uk
Website: www.laterlifemedicine.co.uk