Privacy and Cookie Policy

Last updated: 30 July 2026

Hummingbirds Medical Limited is committed to protecting your privacy and handling personal data lawfully, fairly and transparently. This policy explains how we use personal data when we act as a data controller in connection with the public website at https://hummingbirdsmedical.com and any of its subdomains that link to this policy.

This policy concerns the public website and business enquiries. It does not describe the processing of patient information within BookYourGP on behalf of GP practices or other healthcare organisations. For that processing, the relevant healthcare organisation is normally the data controller and Hummingbirds Medical Limited acts as its data processor under a written data processing agreement. Patients should contact their GP practice or other relevant healthcare organisation about the use of their clinical information.

1. Who we are

Hummingbirds Medical Limited is a company incorporated and registered in England and Wales with company number 10669303. Our registered office is:

41 Elm Drive
Killingbeck
Leeds
England
LS14 6FQ

For the processing described in this policy, Hummingbirds Medical Limited is the data controller.

You can contact us at [email protected].

We are registered with the Information Commissioner's Office under registration number ZA248356.

2. Personal data we collect

We may collect and process the following categories of personal data:

• Enquiry and contact data: your name, job title, organisation, email address, telephone number and the content of messages you send to us.
• Business relationship data: information relating to meetings, demonstrations, proposals, purchases, support requests and our communications with you.
• Technical and usage data: your IP address, browser and device information, approximate location, referring page, pages visited, dates and times of visits, and information collected through server logs and cookies.
• Correspondence: any other information you choose to provide when you contact us.

Please do not submit patient information, medical information or other special category personal data through the public website or by using a general enquiry email address unless we have specifically asked you to do so through an approved secure route.

3. How and why we use personal data

Where we rely on legitimate interests, we consider whether our use is necessary and balance our interests against your rights and reasonable expectations. You may ask us for further information about this assessment.

4. Marketing

We may use business contact details to send relevant information about our products or services where permitted by law. We will obtain consent where consent is required. You can object to direct marketing at any time by replying to the message, using any unsubscribe option provided, or emailing [email protected].

We do not sell your personal data.

5. Sharing personal data

We may share personal data only where reasonably necessary with:

• website hosting, information technology, security, communications, email and analytics service providers;
• professional advisers, including accountants, auditors, insurers and legal advisers;
• regulators, courts, law enforcement bodies or other authorities where disclosure is required or permitted by law;
• a prospective buyer, investor or successor if our business or assets are reorganised, sold or transferred, subject to appropriate confidentiality safeguards; and
• other parties where you ask us to make the disclosure or give valid consent.

Service providers that process personal data for us must act on our instructions, protect the data and use it only for the agreed purpose.

6. International transfers

Some service providers, including Google in connection with Google Analytics, may process personal data outside the United Kingdom. Where personal data is transferred to a country that is not covered by UK adequacy regulations, we use an applicable lawful transfer mechanism and appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the European Commission's standard contractual clauses, or another mechanism permitted by UK data protection law.

You may contact us for further information about the safeguards relevant to your personal data.

7. Retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and reporting requirements. We apply the following general retention periods:

• general enquiries that do not lead to a customer or supplier relationship: normally up to 24 months after our last substantive contact;
• records relating to a customer, supplier or contractual relationship: normally for the duration of the relationship and up to seven years afterwards;
• security and server logs: normally up to 12 months, unless they are required for the investigation of an incident or legal claim; and
• Google Analytics cookies: for the periods shown in the cookie table below.

We may retain information for longer where required by law, regulation, an active dispute or a legal claim. We may retain anonymised information that no longer identifies an individual.

8. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or destruction. Access to personal data is restricted to people and service providers that need it for authorised purposes and are subject to appropriate duties of confidentiality.

No internet transmission is completely secure. Please do not send confidential patient or clinical information through the public website or ordinary email.

9. Your data protection rights

Depending on the circumstances, you may have the right to:

• ask for confirmation that we process your personal data and receive a copy of it;
• ask us to correct inaccurate or incomplete personal data;
• ask us to erase personal data;
• ask us to restrict the processing of personal data;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing;
• receive personal data you provided to us in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller, where the right to data portability applies;
• withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where that right applies.

These rights are not absolute and exemptions may apply. We may need to verify your identity before acting on a request. There is normally no charge for exercising your rights, although the law allows a reasonable fee or refusal in limited circumstances, including where a request is manifestly unfounded or excessive.

To exercise a right, contact [email protected]. We will respond within the period required by applicable data protection law.

10. Complaints

If you have concerns about how we use your personal data, please contact us first at [email protected] so that we can investigate and respond.

You also have the right to complain to the Information Commissioner's Office. Information about making a complaint is available at https://ico.org.uk/make-a-complaint/. The ICO can also be contacted by telephone on 0303 123 1113.

11. Links to other websites

Our website may contain links to websites operated by other organisations. We do not control those websites and this policy does not apply to their processing. You should read the privacy information provided by the relevant website operator.

12. Cookie policy

What are cookies?

Cookies are small text files stored on your device when you visit a website. They can allow a website to function, remember information and understand how visitors use it. Session cookies expire when you close your browser. Persistent cookies remain until their stated expiry date or until you delete them.

Cookies used on this website

We use Google Analytics 4 to understand how visitors use the website. Google Analytics uses first-party cookies and receives information such as a cookie identifier, IP address, browser and device information, approximate location and pages visited. We use this information to produce statistics and improve the website. We do not use Google Analytics cookies for targeted advertising through this website.

Cookie names and durations can change when providers update their services. You can read more in Google's information about Analytics cookies and Google's privacy policy.

Your cookie choices

Non-essential analytics cookies should be placed only after you have given the required consent through the website's cookie control. You can refuse analytics cookies without losing access to the website. You can withdraw or change your consent at any time using the website's cookie settings control.

You can also block or delete cookies through your browser settings. Blocking strictly necessary cookies may affect website functions. Browser controls vary, so consult your browser's help documentation for instructions.

You may also use the Google Analytics opt-out browser add-on. This is provided by Google and is separate from our website cookie control.

13. Changes to this policy

We may update this policy to reflect changes in our website, services, suppliers or legal obligations. We will publish the revised policy on this page and update the date shown at the top. Where a change materially affects how we use personal data, we will take additional steps to notify affected people where required.