BookYourGP Privacy Notice and Cookie Policy
Last updated: 25 August 2026
1. About BookYourGP
BookYourGP is provided by Hummingbirds Medical Limited.
Hummingbirds Medical Limited is incorporated and registered in England and Wales with company number 10669303 and has its registered office at:
41 Elm Drive
Killingbeck
Leeds
England
LS14 6FQ
Hummingbirds Medical Limited is registered with the Information Commissioner's Office under registration number ZA248356.
You can contact us at:
This notice explains how personal information is processed when you use BookYourGP.
2. Who is responsible for your personal information?
When BookYourGP is provided to you by your GP practice or another healthcare organisation, that organisation is normally the data controller for personal information processed as part of your healthcare.
The data controller determines why your personal information is processed and the lawful basis for that processing.
Hummingbirds Medical Limited acts as a data processor on behalf of your GP practice or healthcare organisation.
This means that, when providing BookYourGP, we process your personal information on the instructions of the healthcare organisation responsible for your care and in accordance with our contractual and legal obligations.
Hummingbirds Medical Limited may act as a data controller in its own right for limited processing undertaken for our own purposes, for example where someone contacts us directly with a business enquiry or where processing is required to meet our own legal or regulatory obligations.
3. What information does BookYourGP process?
The information processed through BookYourGP depends on how your GP practice or healthcare organisation uses the service.
It may include:
your name;
date of birth;
NHS number or other healthcare identifiers;
postal address;
email address;
telephone number;
your GP practice or healthcare provider;
information about appointments;
information about recalls, reviews and monitoring;
information about communications sent to you or received from you;
information you provide through BookYourGP;
information relating to your health, medication, investigations, monitoring or healthcare;
information obtained from your electronic health record;
information written back to your electronic health record;
account and authentication information; and
audit, security and technical information required for the safe operation of BookYourGP.
Information concerning your health is special category personal data and is subject to additional protection under data protection law.
4. Where does this information come from?
Personal information processed through BookYourGP may be provided:
by your GP practice or healthcare organisation;
from your electronic health record;
directly by you when you use BookYourGP;
through communications between you and your healthcare provider; and
through other systems authorised by your healthcare provider and used in connection with your care.
Where Hummingbirds Medical Limited receives personal information from your GP practice or healthcare organisation, we process that information on its behalf.
5. Why is your information processed?
Your GP practice or healthcare organisation may use BookYourGP to help deliver and manage healthcare services.
Depending on how BookYourGP is configured by your healthcare organisation, your personal information may be processed to:
identify patients requiring monitoring, review or follow-up;
support recall and monitoring programmes;
contact you about your healthcare;
provide information about monitoring, reviews or appointments;
provide access to relevant appointment-booking or healthcare workflows;
receive and record responses from you;
support the completion of clinical monitoring and review requirements;
record whether required healthcare activity has been completed, remains outstanding or requires further action;
provide authorised healthcare professionals with information relevant to your care;
add appropriate information to your electronic health record;
maintain appropriate clinical and operational records;
maintain an audit trail of activity;
protect the security and integrity of the service; and
provide the BookYourGP service to your GP practice or healthcare organisation.
Your GP practice or healthcare organisation determines the purposes and lawful basis for processing your personal information for the provision of your healthcare.
You can find further information about how your healthcare organisation uses your personal information in its own privacy notice.
6. Hummingbirds Medical Limited as a data processor
When Hummingbirds Medical Limited processes your healthcare information through BookYourGP, we do so on behalf of your GP practice or healthcare organisation.
We do not use your healthcare information for our own marketing purposes.
We do not sell your personal information.
We do not use patient information processed through BookYourGP for advertising.
We process such information only as necessary to provide, secure and support the BookYourGP service and in accordance with the instructions of the relevant data controller, except where we are required by law to do otherwise.
7. When Hummingbirds Medical Limited acts as a data controller
There are limited circumstances in which Hummingbirds Medical Limited processes personal information for purposes that we determine ourselves.
These may include:
Enquiries
If you contact Hummingbirds Medical Limited directly, we may process information including your:
name;
organisation;
email address;
telephone number; and
information contained within your enquiry.
We use this information to respond to you and manage our relationship with you.
Where appropriate, our lawful basis is our legitimate interest in responding to enquiries and operating our business.
Legal, regulatory and security obligations
We may process personal information where necessary to:
comply with legal or regulatory obligations;
establish, exercise or defend legal claims;
investigate security incidents;
prevent or investigate unauthorised access or misuse; or
protect the security, integrity and availability of our systems.
The applicable lawful basis will depend on the circumstances and may include compliance with a legal obligation or our legitimate interests in operating and protecting a secure healthcare technology service.
8. Who can access your information?
Access to information processed through BookYourGP is restricted to authorised persons and systems.
Depending on the circumstances, this may include:
authorised members of your GP practice or healthcare organisation;
appropriately authorised Hummingbirds Medical Limited personnel where access is necessary to provide or support the service; and
organisations providing services to us as authorised sub-processors where this is necessary for the operation of BookYourGP.
Where another organisation processes personal information on our behalf, appropriate contractual and data protection requirements apply.
We do not disclose patient information to third parties for advertising or for those third parties' own marketing purposes.
We may disclose information where required to do so by law.
9. Where is your information stored?
BookYourGP patient data is hosted and processed in the United Kingdom.
Our production hosting infrastructure is provided through Amazon Web Services in its London region.
We do not transfer BookYourGP patient data outside the United Kingdom.
10. How long is your information retained?
Where Hummingbirds Medical Limited acts as a data processor, information is retained in accordance with the instructions of the relevant GP practice or healthcare organisation and our contractual obligations to that organisation.
We do not retain personal information for longer than is required for the purposes for which it is processed.
Different categories of information may need to be retained for different periods depending on their purpose and applicable healthcare, legal, regulatory, contractual, clinical safety and information-governance requirements.
Where Hummingbirds Medical Limited acts as a data controller, information is retained in accordance with our applicable retention requirements and only for as long as reasonably necessary for the relevant purpose.
11. How do we protect your information?
Protecting personal and healthcare information is fundamental to the operation of BookYourGP.
We use appropriate technical and organisational measures designed to protect personal information against:
unauthorised access;
unlawful processing;
accidental loss;
destruction;
alteration; and
unauthorised disclosure.
Access to BookYourGP and the information processed through it is restricted to appropriately authorised users and systems.
BookYourGP maintains audit information relating to use of the service where required for security, operational, clinical safety or information-governance purposes.
Where you are provided with authentication credentials, you are responsible for keeping those credentials secure and must not allow another person to use them.
12. Your data protection rights
Data protection law gives individuals a number of rights in relation to their personal information.
Depending on the circumstances and the lawful basis for processing, these may include the right to:
be informed about how your personal information is used;
request access to your personal information;
request correction of inaccurate or incomplete information;
request restriction of processing in certain circumstances;
request erasure of personal information where the right to erasure applies;
object to certain types of processing;
receive certain personal information in a portable format where the right to data portability applies; and
withdraw consent where processing is based on consent.
These rights are not absolute and not every right applies to every type of processing.
Requests about your healthcare information
Where your information is processed through BookYourGP on behalf of your GP practice or healthcare organisation, that organisation is normally the data controller.
You should therefore normally contact your GP practice or healthcare organisation if you wish to exercise your data protection rights in relation to your healthcare information.
Hummingbirds Medical Limited will assist the relevant healthcare organisation with requests concerning personal information processed through BookYourGP where required.
Information controlled directly by Hummingbirds Medical Limited
Where Hummingbirds Medical Limited is the data controller for the information concerned, you can contact us at:
13. Your right to object
Where Hummingbirds Medical Limited processes personal information on the basis of legitimate interests, you may have the right to object to that processing on grounds relating to your particular situation.
You have the right to object at any time to the use of your personal information for direct marketing purposes.
We do not use patient healthcare information processed through BookYourGP for direct marketing.
14. Complaints
If your concern relates to the use of your healthcare information by your GP practice or healthcare organisation, you should normally contact that organisation in the first instance.
If your concern relates specifically to Hummingbirds Medical Limited or the operation of BookYourGP, you can contact us at:
You also have the right to complain to the Information Commissioner's Office, the UK's independent regulator for data protection.
Information about your rights and how to make a complaint is available from the Information Commissioner's Office.
Cookie Policy
15. What are cookies?
Cookies are small pieces of information stored on your device when you use a website or online service.
They can be used for purposes including maintaining a secure user session, authentication and enabling the functions of an online service.
16. What cookies does BookYourGP use?
BookYourGP uses only cookies that are strictly necessary for the safe and effective operation of the service.
We do not use:
analytics cookies;
performance-tracking cookies;
advertising cookies;
targeting cookies; or
cookies used to build advertising or marketing profiles.
Strictly necessary cookies may be used for purposes such as:
securely authenticating users;
maintaining a user's secure session;
protecting accounts and information from unauthorised access;
maintaining the security and integrity of BookYourGP; and
providing functions specifically requested by the user.
These cookies are necessary for BookYourGP to operate correctly.
17. Consent for cookies
Strictly necessary cookies do not require consent where they are essential to provide the online service requested by the user.
BookYourGP therefore does not ask users to consent to analytics, advertising or targeting cookies because we do not use them.
Information about the strictly necessary cookies used by BookYourGP is provided in this notice so that users understand what information is stored on their device and why.
18. Blocking strictly necessary cookies
You can configure your browser to block cookies.
However, because the cookies used by BookYourGP are necessary for the secure operation of the service, blocking them may prevent BookYourGP from working correctly or may prevent you from signing in or maintaining a secure session.
19. Links to other websites
BookYourGP may contain links to websites or services operated by other organisations.
Hummingbirds Medical Limited does not control those websites or services and this Privacy Notice does not govern how those organisations process personal information or use cookies.
You should review the privacy information provided by the relevant organisation when using an external website or service.
20. Changes to this notice
We may update this Privacy Notice and Cookie Policy where necessary to reflect:
changes to BookYourGP;
changes in how personal information is processed;
changes to our suppliers or infrastructure;
changes to applicable law or regulatory guidance; or
changes to our information-governance requirements.
The current version will be made available through BookYourGP and will state when it was last updated.
Where a material change affects how personal information is processed, we will take appropriate steps to bring that change to the attention of affected users.
Authorised use of BookYourGP
Access to BookYourGP and any information available through it is restricted to authorised users.
Unauthorised access, attempted unauthorised access, misuse of credentials, interference with the service or unauthorised use of information may result in access being suspended or terminated and may constitute an offence under applicable law, including the Computer Misuse Act 1990.
Authorised users must:
use BookYourGP only for authorised purposes;
keep authentication credentials secure;
not allow another person to use their credentials;
comply with applicable confidentiality and information-governance requirements; and
report suspected unauthorised access or security incidents through the appropriate route.
Access to and use of BookYourGP may be logged and audited for security, clinical governance, clinical safety, operational and regulatory purposes.
Hummingbirds Medical Limited
Company number: 10669303
ICO registration number: ZA248356
Email: info@hummingbirdsmedical.com
© 2026 Hummingbirds Medical Limited