Issued 6th October 2026

This notice explains how ROC Clinic collects, uses, shares and protects your personal and health information, and the choices and rights you have. It applies to patients at our Aberdeen and London clinics, to people we see for occupational health, and to visitors to this website.

At a glance

• We use your information to look after your health, and only share it with people involved in your care, with your permission, or where the law requires it.
• With your agreement, your clinician may record your consultation so that AI can help write your notes. We always ask first, you can say no at any time, and your clinician checks every note.
• Recordings stay in the UK, are never used to train AI, and are deleted within 7 days.
• We keep medical records for 30 years.
• You can ask to see, correct or delete your information, and you can complain to us or to the Information Commissioner’s Office.

Questions? Contact our Data Protection Officer, Dr Cristina Romete, at cristina.romete@rochealthservices.com.

Who we are

ROC Clinic is a trading name of ROC Clinics UK Ltd (company number 14987327), registered office c/o Thrings LLP, 6 Drakes Meadow, Swindon, SN3 3LL. We are the data controller for your information, which means we decide how it is used and are responsible for protecting it.

We are registered with the Information Commissioner’s Office (registration number [ICO number]). In England we are regulated by the Care Quality Commission, and in Scotland by Healthcare Improvement Scotland.

Our Data Protection Officer is Dr Cristina Romete (cristina.romete@rochealthservices.com).

What information we collect

• Your contact details: name, address, email address and phone number
• Your date of birth
• Your medical history and the reason for your visit
• How you would like us to contact you
• Medical notes, diagnoses, test results and records of your consultations
• If you agree to it, an audio recording and transcript of your consultation (see “AI-assisted consultation notes”)
• Payment and billing details, and insurance or employer details where relevant

We may also receive information about you from hospitals, consultants, your NHS GP, laboratories, other professionals involved in your care, your health insurer or, for occupational health, your employer.

Your patient record

Your patient record is held securely on Semble, our patient management system, which acts as our data processor. Healthcare professionals involved in your direct care may read and add to it. When you register, we ask how you would like your information to be shared.

AI-assisted consultation notes

With your agreement, your clinician may record your consultation so that AI can transcribe it and draft your clinical notes. This means your clinician can give you their full attention instead of typing.

We always ask first

• Your clinician will ask you before recording starts. Nothing is recorded unless you agree.
• You can agree out loud at the start of the recording, or in writing if you prefer. We note your agreement in your record.
• You can say no, or ask your clinician to stop at any time, without giving a reason. The recording is then stopped and deleted. Your care is not affected in any way.
• For a child, a parent or guardian is asked to agree.

How it works

1. Your clinician records the consultation using our secure dictation system.
2. Microsoft Azure AI Speech turns the recording into a written transcript.
3. A Microsoft Azure OpenAI model drafts a structured note from the transcript.
4. Your clinician reads, corrects and approves every part of the note, then saves it to your record. Nothing is added to your record automatically.

The AI does not diagnose you, suggest treatment or make decisions about your care. Your clinician remains fully responsible for your notes and your care.

How your information is protected

• Recordings, transcripts and drafts are processed and stored in Microsoft’s UK data centres and do not leave the UK.
• Your information is never used to train or improve AI models.
• Microsoft does not keep your consultation content for monitoring, and Microsoft staff do not review it.
• Everything is encrypted with keys we control, and access is logged.
• Microsoft acts as our data processor under a written data protection contract.

How long it is kept

We completed a Data Protection Impact Assessment before introducing this service. If you have any questions, speak to your clinician or contact our Data Protection Officer.

How we use your information

• To provide, plan and manage your healthcare, including consultations, tests and treatment
• To keep accurate clinical records, including with AI-assisted notes where you agree
• To communicate with you and with other professionals involved in your care
• To manage appointments, billing and payments
• To check and improve the quality and safety of our services
• To meet our legal and regulatory obligations

We will never use your confidential health information for any other purpose without your explicit consent. Sometimes we use anonymised information, which cannot identify you, for audit or service planning.

Who we share your information with

• People involved in your care: hospital doctors, consultants and nurses, your NHS GP, pharmacists, laboratories (such as The Doctors Laboratory), dentists, mental health professionals and other healthcare professionals.
• Our service providers: including Semble (patient records), Microsoft Azure (AI-assisted notes, hosted in the UK), and IT, email and payment providers. They act only on our instructions, under contracts that protect your information.
• Where the law requires it: for example the police, courts, regulators such as the General Medical Council, Care Quality Commission or Healthcare Improvement Scotland, or public health bodies.
• Anyone you ask us to share with, such as your insurer or solicitor. We will check with you before releasing your record.

Occupational health

If your employer has arranged an occupational health assessment, we will explain at the start what information goes back to them. Your employer normally receives a report on your fitness for work and any recommended adjustments, not your detailed medical notes. We will usually offer you the chance to see the report before it is sent. Where the Access to Medical Reports Act 1988 applies, you also have specific legal rights, including to ask for changes or to stop it being sent.

Our legal basis

The law requires us to have a legal basis to use your information. We rely on:

• Contract: to provide the services you have booked with us.
• Legitimate interests: to run our clinic, including AI-assisted notes (with your agreement) and occupational health services arranged by an employer.
• Legal obligation: where the law requires us to keep or share information.
• Vital interests: in an emergency, if you cannot give consent.
• Consent: for optional uses, such as marketing. You can withdraw consent at any time.

Health information needs extra protection. We use it mainly to provide health care, by or under the responsibility of health professionals who owe you a duty of confidentiality (UK GDPR Article 9(2)(h)), and also, where relevant, for occupational medicine, in emergencies, for public health, to defend legal claims, or with your explicit consent.

How long we keep your information

We keep medical records for 30 years. AI consultation recordings, transcripts and drafts are deleted within 7 days. Other information, such as website enquiries, is kept only as long as we need it.

Keeping your information in the UK and secure

We aim to keep your information in the UK. If a supplier ever processes it outside the UK, we make sure it is protected to UK standards. Our AI-assisted notes service is hosted entirely in the UK.

We protect your information with access controls, encryption and secure, contracted suppliers. Our staff are trained in data protection and confidentiality, and we assess the risks before introducing any new technology.

Your rights

To use any of these rights, contact our Data Protection Officer. We will reply within one month, normally free of charge.

• See your information: ask for a copy of what we hold. If an AI recording or transcript still exists (within 7 days), we will include it.
• Correct it: ask us to fix anything inaccurate or incomplete.
• Delete it: ask us to delete your information, including asking for an AI recording to be deleted early. We may need to keep medical records the law requires us to hold.
• Restrict or object: ask us to limit or stop certain uses, including AI-assisted notes.
• Move it: ask us to send your information to another organisation electronically.
• Automated decisions: we do not make decisions about you by automated means alone. AI only helps prepare notes that your clinician reviews.
• Withdraw consent: where we rely on consent, you can withdraw it at any time.

Other people mentioned in your record

If you mention other people during a consultation, such as a partner or family member, this may be recorded, including in an AI transcript. We protect their privacy too, and may remove references to them before releasing your record to anyone.

Children

There is a separate privacy notice for children.

Translation

If English is not your first language, you can ask our Data Protection Officer for a translation of this notice.

Complaints

If you are unhappy with how we have handled your information, please contact our Data Protection Officer, or our Clinic Managers at info@rochealthservices.com. You may also access the Complaints Policy and submit a complaint by accessing this link: https://rocprivateclinic.com/complaints/

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Our website and cookies

This notice covers the ROC Clinic website only; other websites we link to have their own privacy notices. We collect information you choose to give us through the website, such as enquiry and booking forms and feedback.

We use cookies, with your consent where required. These include analytics cookies (Google Analytics and HubSpot) to understand how our site is used, and advertising and social media cookies (Google, Facebook and LinkedIn). You can change your choices at any time using the cookie settings on this site or in your browser.

Keeping in touch

Please tell us if your contact details change. We may contact you by phone, text or email about appointments, results and your care, and will ask how you prefer to be contacted, including whether you would like encrypted email.

Changes to this notice

We review this notice regularly. A copy is available in our clinics and on request. This notice was last updated on 6th October 2026.