Legal
Privacy notice
Patients trust their hospitals — and us — with information about their health. This notice explains, in plain terms, what we collect, why, and the choices you have.
In short
- This website sets no cookies and runs no advertising. We measure visits with Cloudflare Web Analytics, which doesn’t use cookies, doesn’t build a profile of you and doesn’t follow you to other websites.
- If you contact us, we use what you send only to reply and follow up.
- If you have surgery covered by Arthur, we receive the information needed to settle eligible care with your hospital — including health information — and we protect it accordingly.
- We never sell personal information.
01Who we are
Arthur is a trading name of Arthur Health Ltd, a company based in London (“Arthur”, “we”, “us”). For the purposes of UK data protection law, we are the controller of the personal information described in this notice.
You can contact us about anything in this notice at hello@arthurhealth.co.uk.
02Whose information this covers
This notice covers two groups of people:
- Visitors and enquirers — anyone who uses this website or gets in touch with us, including people at hospitals and surgeons’ practices.
- Patients — self-paying patients whose surgery is covered by Arthur through a partner hospital.
03Information from this website
Enquiry form and email
Our enquiry form doesn’t send anything to us by itself: it opens your own email program with your message ready to send. If you send it, or email us directly, we receive your name, organisation, role, email address and whatever you choose to write.
Technical information
Like every website, ours is delivered by servers that receive your IP address and basic browser information in order to show you the page. Our website is hosted by Cloudflare, which may keep short-lived logs of these requests for security and to keep the site running. Our typefaces are served from our own website, so your browser doesn’t contact Google or any other font service.
05Information about patients
When a patient covered by Arthur needs further care after surgery, the treating hospital invoices us directly. To assess and settle that invoice we receive:
- identity details — your name, date of birth and hospital reference;
- details of your covered procedure and its date;
- health information about the complication and the care provided, as needed to confirm that the care is eligible;
- the invoice itself.
Health information is a special category of personal data. We collect only what is needed to settle eligible care, and we share it only as described in section 7.
06Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Replying to enquiries and following up | Our legitimate interests in responding to people who contact us and developing partnerships |
| Keeping the website secure and working | Our legitimate interests in running a safe, reliable website |
| Understanding how the website is used, to improve it | Our legitimate interests in improving our website, using cookie-free analytics |
| Assessing and settling eligible care for patients | Performance of the insurance arrangement; for health information, the insurance condition in the Data Protection Act 2018, and where needed to establish or defend legal claims |
| Meeting legal and regulatory obligations | Legal obligation |
08Where it’s stored, and how we protect it
We store personal information in the UK or the European Economic Area where we can. If a provider processes it elsewhere, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision.
Access to patient information is limited to the people who need it to settle care. We use encryption in transit, access controls and multi-factor authentication to protect the systems it’s held in.
09How long we keep it
| Information | How long |
|---|---|
| Enquiries and correspondence | Up to two years after our last contact, unless it becomes part of a partnership |
| Patient and invoice records | For as long as required by insurance and financial regulation — normally seven years after the end of cover |
| Website server logs | Kept by our hosting provider for a short period only, normally no more than 30 days |
10Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete it, or to restrict how we use it;
- object to our using it on the basis of our legitimate interests;
- ask us to transfer it to another organisation, where that applies.
To use any of these rights, email hello@arthurhealth.co.uk. We will reply within one month. There’s no charge.
If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
11Changes to this notice
We’ll update this notice when what we do changes. The date at the top shows when it was last revised. If a change affects you significantly, we’ll tell you.