Privacy Policy

Spark UK Medical Limited is a provider of clinical, patient transport, event medical, and healthcare-related services. We act as a Data Controller in relation to the personal information that we collect and process.

Contact: dataprotection@sparkmedical.co.uk · Unit 34 Thursby Road, Bromborough, Wirral, CH62 3PW

Information you provide directly: name, postal address, email address, telephone number, information submitted through forms, surveys, enquiries, complaints or feedback, employment and recruitment information, and information provided during service delivery.

Information collected automatically: IP address, browser type, device information, operating system details, website usage data, and cookie and analytics information.

Operational and clinical information: patient records, medical information, patient care records, incident reports, safeguarding information, service delivery records, clinical assessments, and transport and treatment documentation. This is processed in accordance with applicable healthcare, regulatory, and data protection requirements.

Spark Medical may operate CCTV systems within vehicles, facilities, and operational environments for safety, security, and incident investigation purposes. CCTV may be used for patient safety, staff and crew safety, vehicle and premises security, crime prevention and detection, and investigation of formally reported incidents. CCTV is not routinely used for employee performance monitoring. Access is restricted to authorised personnel and subject to audit. Footage may be disclosed where legally required, for investigation of a formal complaint or incident, or in response to a valid Data Subject Access Request.

We may use your personal information to: deliver healthcare, transport, and event medical services; assess, treat, and support patients; respond to enquiries; manage service contracts and bookings; recruit and manage personnel; meet legal, regulatory, and professional obligations; manage complaints and incidents; maintain patient, staff, and public safety; operate CCTV systems; improve our services and website; and protect our systems and prevent fraud or misuse.

We process personal information under one or more lawful bases: consent, contractual necessity, legal obligation, vital interests, legitimate interests, and public task where applicable to healthcare services.

Special Category Data (Article 9 UK GDPR): As a provider of clinical services, we may process special category personal data including health information and medical records, where an Article 9 condition applies — provision of health or social care, medical assessment and treatment, patient safety and safeguarding, public health purposes, protection of vital interests, establishment or defence of legal claims, or explicit consent. Additional safeguards are applied in accordance with UK GDPR, the Data Protection Act 2018, and NHS standards.

We may share personal information with NHS organisations, clinical partners, healthcare providers, emergency services, regulatory authorities (including the CQC and ICO), law enforcement agencies where legally required, professional advisers, and secure technology, communications, hosting, and storage providers acting on our behalf. We do not sell personal data to third parties.

To support our operations, Spark Medical may use secure cloud-based software, databases, communication tools, automation platforms, and application development services operated by approved third-party providers. These providers act as Data Processors on our behalf while Spark Medical remains the Data Controller. This may include the use of Base44, a managed application platform used to develop, host, support, and maintain internal and customer-facing systems.

Personal information may be stored, processed, transmitted, or backed up within the United Kingdom, the EEA, the United States, and other jurisdictions used by approved providers. Where personal information is transferred internationally, appropriate safeguards are implemented consistent with UK GDPR, including UK International Data Transfer Agreements, the UK Addendum to EU Standard Contractual Clauses, Adequacy Regulations, and the EU-US Data Privacy Framework.

We require service providers to implement appropriate technical and organisational measures including encryption, access controls, monitoring, authentication systems, staff training, and security audits. Where cloud-hosted systems process health information or other special category data, additional safeguards are applied in accordance with UK GDPR, the Data Protection Act 2018, and NHS guidance. Further information regarding Base44’s data processing practices is available at https://base44.com/dpa.

We retain personal information only for as long as necessary and in accordance with legal, contractual, regulatory, clinical, and operational requirements. Clinical records are retained in line with NHS retention schedules; incident reports in accordance with regulatory requirements; employment records in accordance with employment legislation; and CCTV footage typically for up to 30 days unless required for investigation or legal proceedings.

Under UK GDPR, you may have the right to: access your personal information; rectify inaccurate information; request erasure where applicable; restrict processing; object to processing; data portability; and withdraw consent where consent is relied upon. Requests should be directed to dataprotection@sparkmedical.co.uk. You also have the right to complain to the Information Commissioner’s Office (ICO).

Our website uses cookies and similar technologies to improve website functionality, user experience, performance monitoring, and analytics.

Spark Medical maintains organisational, technical, and physical security measures designed to protect personal information from unauthorised access, misuse, loss, alteration, and disclosure. Our security controls are regularly reviewed and updated.

We may amend this Privacy Statement from time to time to reflect changes in legislation, regulatory guidance, technology, or our services. The most current version will always be available on our website.