Last updated: 14 October 2026
Who we are
ICO registration: ZC262264 — view the public register entry ↗.
The Cambridge Prostate Practice is a trading name of Urostar Limited, registered in England and Wales, company number 11002418. Its registered office is The Nutteries, Lynn Road, Setchey, King’s Lynn PE33 0AY.
Urostar Limited is the controller of the personal information held by the practice. Your clinical care is provided by Professor Cristian Ilie, Consultant Urological Robotic Surgeon. Spire Healthcare keeps its own hospital records and has its own responsibilities for those records.
For questions about your information or to exercise your rights, email [email protected], telephone 01223 300000, or write to the registered office above. The secretary answers Monday to Friday, 09:00 to 17:00. Email and voicemail are not continuously monitored.
Information we hold
We use the information needed to arrange your appointment, provide care and manage the practice. This may include your name, date of birth, contact and GP details; referral letters, medical history, symptoms, examinations, test results and treatment plans; clinic correspondence; insurance and authorisation details; invoices, payment records and communications with the practice. We see adults only.
Most information comes from you. Relevant information may also come from your GP or referring clinician, hospitals, laboratories, imaging providers, your insurer or a representative acting with your authority.
Why we use your information
We use personal information to answer enquiries, arrange consultations and investigations, provide treatment, communicate with you and other professionals involved in your care, manage payments, keep appropriate records and respond to concerns.
For arranging and providing privately requested care and billing, our lawful basis is performing our contract with you or taking steps you request before entering one. We use information to meet applicable legal duties, including accounting requirements. Necessary practice administration, security, complaint handling and the protection of legal rights may rely on our legitimate interests, after considering your rights.
Health information needs an additional legal condition. For diagnosis, treatment and healthcare management, we rely on the healthcare condition in UK GDPR Article 9(2)(h) and the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2, under professional confidentiality. Where necessary for legal claims, Article 9(2)(f) may apply.
Consent to treatment is separate from these data-protection grounds. We do not rely on your consent as a blanket basis for keeping necessary medical records. We do not sell your information or use it for direct marketing, and we do not make decisions with legal or similarly significant effects about you solely by automated means.
Who receives information
We share relevant information with your GP, referring clinician, treating hospital, laboratories, imaging providers and other clinicians involved in your care, including a multidisciplinary team where appropriate. Tell us if you have concerns about information being shared with your GP so we can discuss the implications for your care.
Where applicable, insurers and electronic billing services receive information needed to handle authorised claims and payments. Our secretary and contracted practice-management, communications and IT providers handle the information needed to support the practice. The practice uses MidexPRO and Microsoft 365; CircleLoop provides telephone and voicemail services.
Professional advisers, such as accountants and indemnity providers, may receive relevant information and may have their own legal and professional responsibilities. Information may also be disclosed where required by law or necessary to establish, exercise or defend legal rights. We limit what is shared to the purpose.
Storage and international transfers
We use access controls and appropriate security measures to protect information. Where a supplier stores or accesses personal information outside the UK, the applicable transfer arrangements must provide recognised safeguards, such as UK adequacy regulations or approved contractual safeguards. You can contact the practice for details of relevant transfers and how to obtain information about those safeguards.
How long we keep information
We keep information for the shortest period necessary for its purpose, taking account of legal requirements, clinical and professional obligations and applicable contractual requirements. Our clinical retention schedule follows the NHS Records Management Code of Practice.
| Record | Retention period or criterion |
|---|---|
| Cancer and oncology records | 30 years from diagnosis, or eight years after death, in accordance with the applicable clinical retention rule. |
| Other adult clinical records | Normally eight years after the last treatment, unless a specialist retention rule applies. |
| Invoices and accounting records | Six years from the end of the relevant company financial year, or longer where required by tax rules. |
| Enquiries, voicemail and administrative copies | Only for as long as needed to deal with the enquiry or its follow-up and meet relevant record-keeping duties. Clinically relevant information is added to the patient record; redundant copies are removed when no longer needed. |
Relevant records may need to be retained longer for ongoing care, a complaint, investigation, legal claim or another applicable preservation requirement. We review retention and securely delete or irreversibly anonymise information when it is no longer needed.
Your rights and concerns
Depending on the circumstances, you can ask for a copy of your information, correction of inaccurate information, deletion, restriction of use, portability, or object to relevant processing. Where we rely on consent, you can withdraw it. These rights have exceptions; necessary healthcare records cannot always be deleted.
We may check your identity proportionately before responding. Access requests are normally answered without charge within one month. If a lawful extension, clarification or exception applies, we will explain it.
Contact the practice if you are concerned about how information is handled. We aim to acknowledge concerns within three working days, investigate without undue delay and keep you informed. You can also complain to the Information Commissioner’s Office ↗.
For information about browsing this site, read website privacy and cookies. Our feedback and complaints page explains the practice’s response process.