Privacy Notice
Last updated: 2 August 2026
1. Scope of this notice
This notice explains how Ullah Health Ltd uses personal information relating to website visitors, people making business enquiries, representatives of healthcare organisations, agencies and professional contacts, suppliers and advisers, and people making a complaint or exercising a data-protection right.
This is principally a website and business-contact privacy notice. Separate or additional information may be provided where Ullah Health Ltd processes information relating to clinicians, workers, employees or other categories of individuals. Clinical information processed within a host healthcare organisation's systems during a locum assignment is also subject to that organisation's privacy information and governance arrangements.
2. Who we are
Ullah Health Ltd is the controller responsible for personal information processed for its own business purposes under this notice.
Company number: 17350496
Registered office:
71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom
Privacy contact: contact@ullahhealth.com (subject line Privacy enquiry).
3. Information we may collect
Depending on the interaction, we may collect: name; job title; organisation; business email address; telephone number; business address; enquiry details; proposed assignment details; correspondence; contract and booking information; invoicing and payment information; complaint information; information relating to a data-protection request; website security and server-log information; Internet Protocol address; browser, device and basic technical information; cookie preferences; and information supplied by an agency, practice, provider or professional adviser. We collect only information reasonably necessary for the relevant purpose.
4. Patient and special-category information
The public website is not intended to collect patient-identifiable information or medical information. Users must not submit clinical records, patient names, NHS numbers, medical photographs, investigation results or detailed medical histories through the public contact form or general business email. If special-category or confidential information is received unexpectedly, Ullah Health Ltd will assess what action is appropriate, which may include restricting access, securely deleting unnecessary information or directing the sender to an authorised secure channel. During clinical assignments, patient information should be processed through the host organisation's approved clinical systems and in accordance with the applicable clinical, confidentiality and information-governance arrangements.
5. How we obtain information
We may obtain information directly from the individual; through the website contact form; by email, telephone or professional correspondence; from a healthcare organisation or agency; from an accountant, legal adviser or other authorised representative; from professional or regulatory registers; from publicly accessible company information; and automatically through basic website security logs and technologies. Where information is obtained from another source, we will provide relevant privacy information where required.
6. Purposes and lawful bases
Responding to enquiries
To receive, assess and respond to business enquiries. Lawful basis: legitimate interests in operating the business and responding to professional communications, and steps requested before entering a contract where applicable.
Discussing and arranging engagements
To assess proposed assignments, conduct due diligence, agree terms and administer bookings. Lawful basis: steps before entering a contract, performance of a contract, legitimate interests and compliance with applicable obligations.
Business administration
To maintain business correspondence, manage suppliers, administer services and maintain operational records. Lawful basis: legitimate interests and performance of a contract.
Accounting, taxation and payments
To issue and process invoices, maintain accounting records, administer payments and comply with taxation and company-law obligations. Lawful basis: legal obligation, performance of a contract and legitimate interests.
Professional and regulatory compliance
To verify professional information, cooperate with healthcare organisations, manage risk, and respond to regulators or lawful authorities. Lawful basis: legal obligation, legitimate interests and, where applicable, the establishment, exercise or defence of legal claims.
Complaints and disputes
To investigate and respond to complaints, incidents, disputes and legal matters. Lawful basis: legitimate interests, legal obligation and the establishment, exercise or defence of legal claims.
Website security
To protect the website, forms, email systems and users against misuse, fraud, spam and security threats. Lawful basis: legitimate interests in maintaining secure systems and protecting information.
Optional analytics
To understand how visitors use the website and improve its performance. Lawful basis: consent where consent is required. Optional analytics do not activate until valid consent has been obtained.
7. Legitimate interests
Where legitimate interests are relied upon, these may include operating and protecting the business, responding to professional communications, assessing proposed assignments, maintaining appropriate records, preventing fraud and misuse, establishing or defending legal rights, improving business processes, and ensuring the security of systems. We consider whether those interests are necessary and appropriately balanced against the rights and interests of the individual.
8. When information must be provided
Some information may be necessary to respond meaningfully to an enquiry, conduct professional due diligence, enter or perform an agreement, process an invoice, or meet a legal or regulatory requirement. Where required information is not provided, Ullah Health Ltd may be unable to progress an enquiry or engagement.
9. Who information may be shared with
Where reasonably necessary, information may be shared with website, hosting, security and email service providers; IT support providers; accountants, bookkeepers and tax advisers; legal advisers; professional indemnity advisers or organisations; banks and payment providers; healthcare organisations; approved agencies and intermediaries; professional regulators; government bodies, tax authorities, law-enforcement bodies or courts where lawfully required; and insurers or other authorised professional advisers where applicable. Service providers acting on our behalf are expected to process information only for authorised purposes and to apply appropriate safeguards. Ullah Health Ltd does not sell personal information.
10. International transfers
Some technology providers may process information outside the United Kingdom. Where personal information is transferred internationally, Ullah Health Ltd will use an appropriate lawful transfer mechanism where required. This may include adequacy regulations, recognised contractual safeguards or another lawful exception. Information about relevant safeguards may be requested by contacting contact@ullahhealth.com.
Before publication: confirm the actual hosting, email, form, security, backup and analytics providers and ensure this section accurately reflects their processing locations and contractual arrangements.
11. Retention
Personal information is kept only for as long as reasonably necessary. Indicative periods are:
- Enquiries that do not progress: ordinarily up to 12 months after the last meaningful contact
- Contract and engagement records: ordinarily six years after the engagement or relationship ends
- Accounting, invoice and taxation records: at least six years from the end of the relevant company financial year, or longer where required
- Complaint and dispute records: for the period reasonably required to investigate, respond and manage any legal or regulatory consequences
- Data-protection request records: for the period required to demonstrate an appropriate response
- Website security logs: only for the period reasonably required for security, diagnostics and incident investigation
- Cookie preferences: for the period stated in the Cookie Notice
Information may be kept longer where required by law, a regulator, litigation, an investigation or a legal hold.
12. Security
Ullah Health Ltd uses proportionate technical and organisational measures intended to protect personal information. These may include access controls, strong authentication, encryption in transit, secure hosting, system updates, restricted administrative access, backups, anti-spam and abuse controls, and appropriate supplier due diligence. No electronic transmission or storage system can be guaranteed to be completely secure.
13. Individual rights
Depending on the circumstances and lawful basis, individuals may have the right to request access to their personal information; request correction of inaccurate information; request erasure; request restriction of processing; object to processing; request data portability; withdraw consent where processing relies on consent; and complain about the use of their information. Some rights are subject to legal conditions and exemptions.
14. Right to object
Individuals have the right to object to processing based on legitimate interests in certain circumstances. An objection may be sent to contact@ullahhealth.com with the subject line Data protection objection. We will consider the individual's circumstances and whether there are compelling legitimate grounds to continue the processing.
15. Automated decision-making
Ullah Health Ltd does not use website information to make decisions based solely on automated processing that produce legal or similarly significant effects.
16. Data-protection complaints
Data-protection complaints may be submitted to contact@ullahhealth.com (subject line Data protection complaint). Ullah Health Ltd will provide a clear means of making a complaint, acknowledge receipt within 30 days, take appropriate steps to investigate, keep the complainant informed and communicate the outcome without undue delay. The company may request reasonable proof of identity or authority where necessary.
17. Complaints to the Information Commissioner
Individuals may complain to the Information Commissioner's Office, the United Kingdom's data-protection regulator. Information is available from the ICO website. We would normally appreciate the opportunity to consider the concern first.
18. Cookies and website technologies
Information about cookies and similar technologies is provided in the Cookie Notice. Optional analytics, advertising or tracking technologies are not activated before any consent required by law has been obtained.
19. Changes to this notice
This notice may be updated to reflect changes in law, technology or business practices. The current version will be published on this page with its revision date.
20. Contact
Ullah Health Ltd
71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom
Email: contact@ullahhealth.com