Find A Clinic
Find A Clinic

Patient Privacy Notice

PATIENT PRIVACY NOTICE

Effective: November 2022

DaVita (UK) Limited and DaVita Operations Limited (hereinafter “DaVita UK”, “we”, “our” and “us”) are registered at nit 11 Greenlea Park, Prince Georges Road, London SW19 2JD and act as the data controllers regarding the collection, use, transfer, and processing (together referred

to as “processing”) of certain personally identifiable information about you (“Personal Information”) and is committed to protecting your privacy rights. DaVita UK is now part of the DaVita International Group Company, headquartered in London, and part of DaVita, Inc., a health care provider focused on transforming care delivery to improve quality of life for people receiving dialysis treatment globally. This privacy notice lets you know what happens to any personal data that you give to us, or any that we may

collect from or about you. This privacy notice applies to Personal Information processed by or on behalf of DaVita UK.

What Personal Information do we process?

We may process the following categories of Personal Information in connection with the treatment provided to you:

  1. Master data: identification data, contact details, national identifiers, NHS number, data related to your health insurance status, signature;
  2. Health data: data related to treatment, including admission health checks, diagnoses, test results, treatment protocols, medications, statements or information in medical file, as well as other data related to your health, necessary to perform our medical services, date of death, data related to unexpected (adverse) occurrences, including type of incident;
  3. Third party contact information: identification data, contact details (if provided by you) of a family member or other person indicated by you to be contacted in an

emergency or where such person was authorised by you to access information about your health or to access your medical documentation.

What is the source of my Personal Information?

We collect Personal Information directly from you. However, to the extent that this is necessary for your care, DaVita UK can request your Personal Information including your health data held by your general practitioner or by the hospital treating you. This enables us to receive any central documentation from your general practitioner or a hospital which is required for the current treatment.

 

For what purposes do we use and process Personal Information and what is the legal basis of the Processing?

We process your Personal Information for the purposes outlined in this section (“Treatment Purposes”) and based on the following legal bases:

  1. Necessity for compliance with a legal obligation and necessity for the purpose of medical diagnosis and the provision of health care or treatment
    • To fulfill the legal obligations of DaVita UK as the provider of health care services financed from public funds and to provide health services, to keep and to manage medical records, to settle with referring clinical practitioner or

National Health Services (NHS) provider to report to each as required in relation to managing referrals of patients, DaVita UK processes your master data, health data and third party contact information.

    • To provide medical documentation to patients and other authorised persons, DaVita UK processes your master data, health data and third party contact information.
    • For the purpose of archiving the medical documentation (including provision back to referring clinical practitioner or NHS provider), DaVita UK processes your master data, health data and third party contact information.
    • To conduct internal proceedings aimed at ensuring compliance of DaVita UK and its employees with the law, DaVita UK processes your master data, health data and third party contact information;
    • To run medicine programmes, DaVita UK processes your master data and health data;
    • To carry out Business Improvement analysis for internal monitoring of the quality of treatment and reporting in the case of external monitoring, DaVita UK processes your master data, health data and third party contact information.
  1. Necessity to conclude provide services under any terms with you and for the purpose of medical diagnosis, the provision of health care or treatment
    • To schedule an appointment with you and to remind you about such appointment, DaVita UK processes your master data and health data.
    • To provide you with our medical services, based on any agreement with you, including to conclude such agreement, DaVita UK processes your master data, health data and third party contact information.
    • To provide you with our medical assistance, including the registration process, verification, research and appropriate treatment (within the clinics, outpatient clinics and hospital ward), DaVita UK processes your master data, health data and third party contact information.

 

    • To order patient examinations to external entities for laboratory tests and radiological examinations (as part of a clinic, outpatient clinic or a hospital ward), DaVita UK processes your master data and health data.
    • For the purpose of settlement of services provided to patients who are not covered by national insurance entitlement and who have private insurance, DaVita UK processes your master data and health data.
  1. Necessity for the purposes of our legitimate interests
    • To monitor and improve the quality of services provided by DaVita UK, including verifying the satisfaction of patients with our services, DaVita UK processes your master data and third party contact information;
    • To ensure physical security at DaVita UK’s office and premises, including by the use of CCTV at our reception/entrance, DaVita UK processes your master data;
    • To make settlements with our service providers, DaVita UK processes your master data.
  1. Necessity for the purposes of our legitimate interests and for the establishment, exercise or defense of legal claims
    • For the purposes of establishing, exercising and defending legal claims, including in particular situations also relating to services provided by service providers, DaVita UK may process in particular your master data, health data and third party contact information.
  1. Your consent

In other situations, if we wish to process your Personal Information and we cannot rely on another legal basis, we may ask you to provide your consent to process your personal data for a specific purpose. In such a case, your Personal Information will be processed to the extent and for the purpose specified in the consent. In particular, we may ask you to provide your consent for the processing of your Personal Information for the purpose of pre-screening of patients for the purpose of their initial qualification for any clinical trial.

Whenever your Personal Information is or will be processed based on your consent, you can withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

In the case of minors or adults who lack capacity to provide consent to treatment, please refer to our separate policy on this issue, which is available on our website.

DaVita UK will not process Personal Information for any other purpose incompatible with the purposes outlined in this section, unless it is required or authorised by law, or as authorised by you.

 

Under what conditions is Personal Information transferred to third parties?

DaVita UK may transfer Personal Information to third parties for Treatment Purposes as described on PPN-2 and PPN-3 as follows:

  1. DaVita International Limited. As it hosts its central global management functions in London and is the headquarters of International operations it utilises data centres in Frankfurt and London and may in limited and exceptional circumstances also transfer your Personal Information to DaVita Inc. which is headquartered in Denver, Colorado (USA) and utilises data centres in the USA.
  2. Regulators, authorities, and other third parties. As is necessary for the Treatment Purposes described above, Personal Information may be transferred to regulators, courts, and other authorities (e.g., NHS provider, law enforcement authorities), independent external advisors (e.g., auditors), insurance carriers, including entities in the jurisdictions where DaVita UK or DaVita Inc. is located, as well as persons authorised to represent you or authorised by you to have access to your medical documentation or to information about your health.
  3. Laboratories, general practitioners and hospitals. As is necessary for Treatment Purposes described above, Personal Information may be disclosed to laboratories if a corresponding examination is required and to the extent that this is necessary for your care, DaVita UK can disclose your health data to general practitioner or to the hospital.
  4. Other third parties. Under separate informed consent given by you and for the purpose indicated therein, as well as if permitted by applicable law and as necessary for Treatment Purposes, Personal Information may be shared with one or more third parties to process Personal Information on behalf of DaVita UK and will be subject to contractual obligations to implement appropriate technical and organisational security measures to safeguard the Personal Information, and to process the Personal Information only as instructed.

Under what conditions is Personal Information transferred to third countries?

In order to provide adequate protection for data transfers, DaVita UK has implemented the appropriate safeguards as required by applicable laws. In limited and exceptional situations where special circumstances apply we may transfer your Personal Information to UK and USA based on standard contractual clauses approved by the European Commission.

Details on the transfer of your Personal Information to third countries, the safeguards applied to such transfer, as well as a copy of such safeguards can be obtained by contacting us using the contact details provided in this Notice.

What security measures does DaVita UK implement?

DaVita UK has implemented appropriate technical and organisational security measures to safeguard Personal Information following industry best practice. We ensure the confidentiality and protection of all data is preserved through compliance with legal requirements and data protection legislation.

How long will your Personal Information be stored?

The retention of your Personal Information takes place in accordance with legal retention requirements. Your Personal Information will be processed for the period necessary for purposes indicated on PPN-2 and PPN-3. We will retain your Personal Information for the period defined in our retention schedule unless we agree with you otherwise or we are required due to legal requirements.

What are your rights?

Under the applicable laws, you have the following rights, among others, concerning your Personal Information:

  1. a right to information about your Personal Information stored by DaVita UK i.e. the right to access your Personal Information and the right to obtain a copy of this data;
  2. a right to the rectification (amendment) of your Personal Information if the data is inaccurate or incomplete;
  3. a right to request erasure of your Personal Information (the so-called “right to be forgotten”); in particular if the data is stored unlawfully or the reason or purpose for its collection and storage ceased to exist;
  4. a right to obtain restriction of processing of your Personal Information; in particular if the data is inaccurate, processed unlawfully or when We no longer need to process your Personal Information, and you oppose to the deletion of such data;
  5. a right of data portability of your Personal Information, if (i) the processing takes place on the basis of an agreement concluded with you or on the basis of your consent and (ii) the processing is carried out by automated means; and
  6. subject to the Complaints process below, a right to lodge a complaint with a supervisory authority, i.e. the UK Information Commissioner, if you are unhappy with how your personal data is being handled.

If we have requested your consent for specific processing activities, you have the right to withdraw your consent for processing for that purpose at any time, without affecting the lawfulness of processing based on your consent before its withdrawal.

If you wish to ask DaVita UK a question or would like to exercise any of your rights, you may contact us using contact details listed at the bottom of this Notice or by visiting our website.

Can I object to the processing of my Personal Information?

You have the right to object to the processing of your Personal Information, including profiling, when: (i) there are grounds relating to your particular situation, and (ii) data processing is based on the necessity for purposes of the legitimate interest pursued by DaVita UK, referred to on PPN-2 and PPN-3.

Am I obliged to provide my Personal Information?

  1. In the absence of providing all required Personal Information, depending on the circumstances, it may be not possible to provide you with the medical treatment;
  2. provision of other Personal Information is voluntary, however, if you do not provide such data, depending on the circumstances, it may have an impact on provision of our services to you.

Complaints

If you have a compliant about how we have handled your personal data, you are entitled to lodge that complaint with us by contacting our Data Protection Officer whose details are set out below. We will acknowledge your complaint within 30 days and following investigation provide you with our response without undue delay. If you are still not satisfied, you then have the right to lodge a complaint with the UK Information Commissioner.

How do I contact DaVita UK?

If you wish to contact us in regard to processing of your Personal Information, below you can find our contact details:

DaVita UK: nit 11 Greenlea Park, Prince Georges Road, London SW19 2JD

Data Protection Officer: dataprivacy@davita.com

Changes to this Privacy Notice

We reserve the right to change this Privacy Notice at any time. Where appropriate we will notify you of any material changes relevant to the processing of your personal data. This Notice was last updated in June 2026.