Prosper CRM patient privacy notice

Controller and data-protection contact

For Asclepius-controlled Prosper Healthcare CRM routes, Asclepius Wellbeing Ltd is the legal owner and data controller. Prosper Healthcare is the owned brand/trading name. Data-protection matters should be sent to assurance@prosperhealthcare.co.uk. This page does not appoint or publish a Data Protection Officer.

Data we may collect

• Identity and contact details such as name, email address, mobile number, and appointment contact details.
• Date of birth, sex, clinical metrics, symptoms/notes, health conditions, appointment/service choices, and other special-category health information entered into patient intake routes.
• Questionnaire responses, consultation notes, prescribing decisions, prescription and pharmacy communication details, follow-up records, identity verification references, and payment or refund references where needed for the service.
• Security metadata such as IP address, user agent, CSRF outcome, reCAPTCHA outcome, and rate-limit information.
• Consent evidence, policy version references, and submission or appointment references.

How we use it

We use CRM information to receive and triage requests, create or match patient and appointment records, support consultation and prescribing decisions, communicate with patients and pharmacies, manage payments and refunds where applicable, protect the service from abuse, notify authorised staff, and maintain clinical, operational, and audit records. We process health information only where we have a lawful basis and a permitted condition for special-category health data under UK data protection law.

Suppliers and transfers

We use trusted IT infrastructure and service providers to operate the CRM, database, backups, security monitoring and related services. These include Amazon Web Services for cloud hosting, database, storage, backup and security infrastructure. CRM public routes may also use Microsoft 365 email, identity verification, payment, reCAPTCHA, appointment communication, analytics and operational support providers where needed to provide and secure the service. Public brochure hosting, if used separately, is not treated as the CRM system of record.

We carry out supplier due diligence and use appropriate contractual, confidentiality, data-processing, and security terms with third-party suppliers. We only permit suppliers to process personal data for specified purposes and in accordance with our instructions, unless the law requires otherwise.

International transfers

We aim to host patient data in the UK where practical. Our primary patient data hosting and database services are configured to use UK-based AWS infrastructure where selected, including the AWS Europe (London) Region for database and storage services where applicable. Some support, security, analytics, payment, identity verification, or supplier processing may involve access from, or transfer to, locations outside the UK.

Where personal data is transferred outside the UK, we use appropriate safeguards required under UK data protection law. These may include contractual protections, UK GDPR-compliant processing terms, approved transfer mechanisms, and supplier subprocessor controls.

Security and access controls

We use HTTPS/TLS, firewalls, role-based access controls, audit logging, secure cloud infrastructure, backup controls and other technical and organisational measures to protect CRM information. Application data, clinical records, databases, backups and related cloud infrastructure for the live CRM service are hosted using Amazon Web Services infrastructure. Access to personal and clinical data is restricted to authorised users and monitored through security and audit controls.

Rights and complaints

You can ask for access, correction, deletion where applicable, restriction, objection, portability where applicable, and a review of automated decisions where relevant. You can use the Clinic CRM complaints form or email complaints@prosperhealthcare.co.uk. Data protection complaints should be acknowledged within 30 days of receipt, investigated by a named owner, answered without undue delay, and include ICO escalation wording where appropriate.