Professor Swati Jha

Last updated: 25 September 2026

This notice explains how personal information is collected, used, shared and protected when you contact my practice, use this website, or are seen by me as a patient or for a medicolegal assessment. It is written for patients, parents and guardians, relatives, referring clinicians and instructing solicitors.

1. Who we are and how to contact us

The data controller for my private practice is Fulwood Healthcare Limited. The company is registered in England and Wales under company number 08463148, with its registered office at 6 Stumperlowe Hall Road, Sheffield S10 3QR. It is registered with the Information Commissioner’s Office (ICO) under reference ZA230853.

I am Professor Swati Jha, Consultant Gynaecologist and subspecialist in urogynaecology (GMC 5207986), and I am responsible for your care. My medical secretary supports the practice and works under the same duty of confidentiality. Dr Pravin Jha, a director of the company, handles data protection matters for the practice.

Data protection requests: pravinjha@hotmail.com
Appointments and general enquiries: admin@swatijha.com
Post: Data Protection, Fulwood Healthcare Limited, 6 Stumperlowe Hall Road, Sheffield S10 3QR

We are a small practice, so the law does not require us to appoint a Data Protection Officer.

Hospitals. I see patients at Spire Claremont Hospital and Circle Thornbury Hospital in Sheffield. Each hospital keeps its own records of your visit, such as registration, nursing and theatre records, tests and its own billing, and is a separate data controller for those records under its own privacy notice. I keep my own clinical record of your consultations. This notice covers that record.

2. The information we hold

Identity and contact details: name, date of birth, address, telephone number, email address, NHS number and hospital numbers.
Health information: your medical, gynaecological, obstetric and surgical history, symptoms, medicines, examination findings, questionnaires and bladder diaries, urodynamic and other test results, scans, diagnoses, treatment plans, operation details, clinic letters and reports, and what your GP and other clinicians tell us.
Consent forms: a copy of any consent form you sign is kept in your record.
Consultation recordings and transcripts: see section 6.
Insurance and payment details: insurer, membership number, authorisation codes, invoices and records of payment. We do not store card details.
Next of kin, and parents or guardians where the patient is a child.
Correspondence: emails, messages, notes of telephone calls and anything you send through the website contact forms.
Medicolegal cases: the solicitor’s instructions, your medical records, witness statements and other documents provided for the case.
Website information: see section 12.

3. Where the information comes from

Most of it comes from you. We also receive information from your GP and other doctors, nurses and physiotherapists involved in your care; from the hospitals and laboratories that carry out your tests; from your insurer when it authorises treatment; and, in medicolegal cases, from the instructing solicitor or court.

4. Why we use it and our legal basis

Data protection law requires a lawful basis for each use of personal information, and an additional condition for health information.

What we use it for	Lawful basis (UK GDPR Article 6)	Condition for health information (Article 9 and the Data Protection Act 2018)
Assessing, diagnosing and treating you, including surgery and follow-up	Contract with you (Art 6(1)(b)). Where someone else arranges or pays for your care, our legitimate interest in providing it (Art 6(1)(f)).	Provision of health care (Art 9(2)(h); DPA 2018 Sch 1 para 2)
Writing to your GP and other clinicians involved in your care	As above	Provision of health care (Art 9(2)(h))
Recording and transcribing consultations to prepare accurate notes and letters	Legitimate interests in keeping an accurate record (Art 6(1)(f))	Provision of health care (Art 9(2)(h))
Replying to enquiries and arranging appointments	Steps taken at your request before a contract (Art 6(1)(b)), or legitimate interests (Art 6(1)(f))	Provision of health care (Art 9(2)(h)), where you give us health details
Invoicing you or your insurer	Contract (Art 6(1)(b))	Management of health care services (Art 9(2)(h))
Preparing expert medicolegal reports	Legitimate interests of the parties and of the court in resolving the claim (Art 6(1)(f))	Legal claims (Art 9(2)(f))
Asking you, once and with at most one reminder, to review your care on Doctify	Legitimate interests in patient feedback (Art 6(1)(f))	Not applicable: no health information is included
Meeting legal and professional duties, such as GMC requirements, tax and accounting rules and court orders	Legal obligation (Art 6(1)(c))	Art 9(2)(h), and Art 9(2)(f) or (g) where relevant
Protecting you or someone else from serious harm, including safeguarding children and adults at risk	Vital interests (Art 6(1)(d)) or legitimate interests (Art 6(1)(f))	Safeguarding (Art 9(2)(g); DPA 2018 Sch 1 para 18), or vital interests (Art 9(2)(c))
Handling complaints and defending legal claims	Legitimate interests (Art 6(1)(f))	Legal claims (Art 9(2)(f))
Clinical audit and improving the service, using anonymised information wherever possible	Legitimate interests (Art 6(1)(f))	Management of health care services (Art 9(2)(h))
Showing reviews on this website	Legitimate interests (Art 6(1)(f))	Not applicable

I also owe you a duty of confidentiality as your doctor. Information is shared only with people who need it to care for you, or where the law or professional guidance allows or requires it.

5. Children and young people

I see some children and young people in my paediatric gynaecology clinic. A young person who understands the decision (who is “Gillick competent”) can decide for themselves who sees their information, and I will respect that unless there is a safeguarding concern. For younger children, parents or guardians with parental responsibility act on the child’s behalf.

6. Consultation recordings and AI-assisted notes

To keep an accurate record and spend more of the appointment with you rather than typing, I may audio-record a consultation. The recording is transcribed by speech-recognition software, and AI software prepares a draft note or letter from the transcript. I read, correct and approve every note and letter myself. The software providers process the data only to provide this service, under contract, and do not use it to train their models. You will be told before a consultation is recorded, and you can ask for it not to be recorded without any effect on your care.

7. Who we share information with

Your GP and other clinicians involved in your care. I normally send your GP a copy of my letter, and a copy to you. If you do not want your GP told, please say so and we will talk through what that means for your safety.
The hospital where you are seen or treated, and its theatre, imaging, laboratory and pharmacy services.
Your insurer, if you are insured: only what it needs to authorise and pay for your care.
In medicolegal cases, the instructing solicitor and, through them, the other party’s representatives and the court, as the court rules require. You will be told about this before the assessment.
Safeguarding and public authorities, when the law requires it or there is a serious risk of harm.
Service providers who work on our instructions and must keep your information secure and confidential:
- OVHcloud (UK data centre), which hosts our secure practice record system;
- Microsoft 365, for secure document storage and email;
- OpenAI and Anthropic, for transcription and AI drafting as described in section 6;
- ClickSend, which sends our review-request text messages;
- GoDaddy, which hosts this website;
- our accountant and bank.
Doctify, if you choose to leave a review: Doctify then holds your review under its own privacy notice.
Our professional advisers and indemnity provider, if we need advice or face a claim or complaint.
Regulators and courts, such as the GMC, the ICO or a court, when we are legally required to share.

Clinic letters to GPs are sent through secure NHS email or by post. We never sell your information, and we do not use it for marketing.

8. Review requests

After your consultation we may send you one text message or email, and at most one reminder, with a link to review your care on Doctify. The message contains no health information. Reviewing is entirely optional. If you would rather not be asked, tell us at any time and we will not contact you for this again.

9. Transfers outside the UK

Some of our service providers store or process data outside the UK, for example in the European Economic Area, the United States or Australia. Any such transfer has a legal safeguard in place: UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), or the ICO’s International Data Transfer Agreement or Addendum.

10. How long we keep information

Adult clinical records: kept in line with the NHS Records Management Code of Practice, normally 8 years after your last treatment, or 8 years after death.
Children’s records: until the patient’s 25th birthday (26th if they were 17 when treatment ended), or 8 years after death if that is sooner.
Consultation recordings and transcripts: kept with your clinical record and deleted with it.
Medicolegal files: kept for the life of the case and then for the relevant limitation period.
Invoices and financial records: 6 years after the end of the financial year they relate to, as tax law requires.
Enquiries that do not lead to an appointment: deleted within 12 months.

When the retention period ends, records are securely destroyed.

11. How we protect your information

Our practice record system is hosted in the UK, protected by encryption, individual logins and a full audit trail, and backed up securely. Only people who need your information for your care or our legal duties can access it. Our service providers are bound by written terms to protect your data and to use it only on our instructions. If a data breach puts your rights at risk, we will tell you and the ICO as the law requires.

12. This website: forms and cookies

Contact and booking forms. When you use a form we receive your name, email address, telephone number and message. They are stored on our website and emailed to us, and we use them only to answer you. The forms are protected against spam by Google reCAPTCHA, which checks for automated use and sends information about your device and browsing to Google under Google’s privacy policy.

Cookies and similar technologies used on this website:

Essential cookies that make the site and its forms work. These do not need consent.
Google reCAPTCHA on our forms, as described above.
The Doctify reviews widget, which is loaded from Doctify’s servers and may set its own cookies under Doctify’s privacy notice.
Visit statistics recorded on our own server by our hosting and website software, such as the page visited, time, browser and IP address, used for security and basic traffic counts.

You can block or delete cookies in your browser settings. Some parts of the site, such as the forms, may not work without them.

13. Google reviews shown on this website

If this website displays reviews from our Google Business Profile, we retrieve them from Google through the Google Business Profile API, using our own account and read-only access. We store the review text, star rating, date, our reply and the reviewer’s display name, shown as first name and initial, only to display them here. A review deleted or edited on Google is removed or updated here at the next automatic check. Information received from Google APIs is used and transferred in line with the Google API Services User Data Policy, including its Limited Use requirements. We do not sell it, use it for advertising, or share it with anyone else.

14. Your rights

You have the right to:

ask for a copy of the information we hold about you (a subject access request);
have inaccurate information corrected. Where a clinical opinion is disputed, we can add your view to the record;
ask us to delete information. We may have to refuse where we must keep medical records by law or professional rules;
ask us to restrict how we use your information, or object to our using it on the basis of legitimate interests, including recording of consultations and review requests;
receive information you gave us in a portable format, where the law allows;
withdraw consent at any time, where we rely on consent.

To make a request, email pravinjha@hotmail.com or write to the address in section 1. We may need to confirm your identity first. We will respond within one month, and there is normally no charge.

15. Complaints

If you are unhappy with how we have handled your information, please contact us first. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow SK9 5AF.

16. Changes to this notice

We review this notice regularly and will post any changes on this page. The date at the top shows when it was last updated.