Patient & Family Privacy Notice

UK Bright Futures Limited, trading as Bright Futures Health · Company no. 11739538

Reference BFH-IG-19 · Version 1.6 · Next review due June 2027, or sooner if the law or our practice changes.

Applies to patients of Bright Futures Health and those with parental responsibility for them. Read alongside our Website Privacy Policy.

In short. This notice explains, in plain language, what information Bright Futures Health holds about your child (and you), why we hold it, how we keep it safe, who we share it with, and the rights you have. If anything here is unclear, please just ask — we are happy to talk it through.

1. Who we are

Bright Futures Health is a private paediatric clinic caring for children from birth to 18. We are the data controller for the information we hold about your child and you.

Controller: UK Bright Futures Limited, trading as Bright Futures Health.
Registered office: 6 Wilkinson Street, London, SW8 1DB. Company number: 11739538.
Information Governance Lead: Dr Martin Gray, Director. A statutory Data Protection Officer is not required, but the IG Lead carries equivalent responsibility for data protection.
Caldicott Guardian: Dr Margarita Burmester, Director and Safeguarding Lead, who protects the confidentiality of patient information and supports appropriate sharing.
Contact: [email protected] · 020 3633 2915.

2. What this notice covers

This notice covers the information we hold to care for your child. Two related notices cover other things:

our Website Privacy Policy covers general website use, such as cookies and website analytics. Where you send us health or child-related information through an online enquiry or booking, that information is covered by this notice. It also carries a summary of how our AI telephone assistant works, so that it is available to anyone who has not yet become a patient;
our Staff Privacy Notice covers information about people who work for us.

3. The information we hold

Depending on your child’s care, we may hold:

About your child: name, date of birth and contact details; clinical and health information — the reason for the appointment, history, examination findings, assessments, diagnoses, test results, letters, treatment and care plans; and any relevant information about development, education or family circumstances where it matters for care.
About you (parent/carer): your name, relationship to the child, contact details, and — where relevant — your role in your child’s care.
Appointment and payment information: bookings, correspondence, invoices and payment details (we do not store full card numbers).
An AI-scribe transcript of the consultation: where we use our AI scribe (see section 8.1), the consultation is briefly recorded to produce a written transcript. The voice recording is then deleted; the written transcript is kept securely in the Heidi app and is automatically deleted after 21 days.
A short note of a telephone call: where you telephone us out of hours or when our line is busy, our AI assistant takes a short written note (see section 8.2) — your name, whether you would like a call back, and which general category your call falls into. We do not record the call, we keep no transcript of it, and she collects nothing about your child.
Information from others: where you agree or where it is in your child’s interest, we may receive information from your GP, another clinician, or your child’s school — typically clinical history or relevant developmental or educational information. The same confidentiality and legal bases apply to information we receive as to information we collect directly.

Health information is “special category” data under data protection law, which means it needs extra protection. We treat it, and all information about children, with particular care.

Some information is needed so that we can assess and treat your child safely and meet our legal record-keeping and safeguarding duties; if it is not provided, we may be unable to provide safe care. Other information is optional, and we will tell you when that is the case.

4. Why we use your child’s information

We use the information to:

provide and coordinate your child’s care, including assessment, diagnosis and treatment;
arrange appointments and communicate with you;
answer our telephone when it would otherwise go unanswered, and make sure an enquiry is not lost;
keep accurate clinical records, as we are professionally and legally required to do;
manage payment for our services;
keep children safe — meeting our safeguarding and other legal duties;
maintain the safety, quality and security of our service.

We do not sell your or your child’s information, and we do not use it for marketing without your consent.

Staying in touch. So that your child does not miss preventive appointments, we send appointment confirmations, reminders and recall invitations — by email and, where you have opted in, by text or WhatsApp — and we may invite you to leave a review after an appointment. These are part of your child’s care rather than marketing; we send marketing only with your consent, and you can opt out of any message at any time by telling us or using the unsubscribe or “stop” option in the message. These messages are sent for us by trusted providers acting under contract (our processors).

5. Our legal bases

Data protection law says we must have a clear, lawful reason for using your child’s information. We never use it for anything you wouldn’t reasonably expect. The reasons we rely on are:

to meet our legal and professional duties — such as keeping proper clinical records and protecting children (Article 6(1)(c));
to run a safe, well-managed clinic — our “legitimate interests” (Article 6(1)(f)). This is also the basis on which we answer the telephone out of hours and take a message;
to provide the service you have booked — for a parent or carer who books and pays for an appointment, we rely on our contract with you (Article 6(1)(b)).

Because health information is especially sensitive, the law asks for an extra reason. Ours are:

the provision of health care and treatment (Article 9(2)(h)), together with the matching condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. This processing is carried out by, or under the responsibility of, health professionals who owe a duty of confidentiality (Article 9(3));
protecting someone’s life in an emergency (Article 9(2)(c)).

Where we share information to protect a child or another person from harm (safeguarding), we rely on Article 6(1)(c) or (d) and Article 9(2)(g), together with the safeguarding condition in Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018.

We also owe your child a common-law duty of confidentiality, which sits alongside these bases.

6. Children and young people

Most of our patients are children, so we take special care. Our guiding principle is always the child’s best interests.

For younger children, a person with parental responsibility usually makes decisions about the child’s information. We may need to check who has parental responsibility, simply to keep your child safe.
Where parents are separated, each person with parental responsibility may usually be involved — but this is always subject to the child’s best interests, any court order, and any safeguarding concern. We may limit or decline a parent’s involvement or access where that is not in the child’s interests (see sections 7 and 11.1).
As children grow up, a young person who is old enough and able to understand a particular decision can make it themselves (this is sometimes called being “Gillick competent”). We respect a competent young person’s wishes about what is shared with a parent, so far as the law and their best interests allow.

We provide a short, child-friendly explanation at the end of this notice so children can understand how we look after their information.

7. Confidentiality — who we share with

We keep your child’s information confidential and share it only on a need-to-know basis, applying the Caldicott principles. Appropriate sharing in your child’s interest is part of good care, not a breach of confidence. We may share:

with your child’s GP and other professionals involved in their care, in your child’s interest, normally with your knowledge or agreement. These professionals are usually responsible for their own records (separate data controllers);
with a host site where your child is seen — for example a hospital or consulting rooms — under our agreement with that site;
where we must by law, or to protect a child or another person from harm (safeguarding);
with trusted suppliers who help us run the clinic (for example secure IT systems, our AI scribe provider Heidi Health, and the providers behind our telephone assistant — see section 8). These suppliers act only on our instructions under a written contract (they are our processors).

In safeguarding situations, the child’s safety and best interests come first and may mean we share information — or choose not to tell a parent — without consent. Sometimes we cannot ask for agreement first, because doing so could put a child at risk or alert someone who may cause harm.

7.1 The clinical record and host sites

Bright Futures Health is the data controller for the records we create about your child. Where part of your child’s care is recorded by a host site (for example a hospital admission or an investigation), that host is usually the controller for the records it creates. For records we hold, contact us; for records created by a host, contact that host — and if you are unsure, ask us and we will point you in the right direction.

8. How we use AI

We use artificial intelligence in two places, and we want to be open about both. Neither of them makes any decision about your child’s care. A clinician does that, every time.

8.1 An AI scribe in the consultation (Heidi)

So that your clinician can give your child their full attention rather than spending the appointment writing, we use an AI scribe called Heidi — a secure tool that listens during the appointment and helps draft the notes.

During the appointment, the consultation is briefly recorded and the scribe turns it into a draft written note.
The draft can contain mistakes — which is exactly why your clinician always reviews and corrects it before it goes into your child’s record. The AI note is only ever a draft and never enters the record unchecked; your clinician remains responsible for what is recorded.
Your clinician can pause or stop the recording at any time, and will do so for any sensitive part of the consultation.
The voice recording is never kept — it is deleted as soon as it has been turned into text.
The written transcript is kept only briefly and securely in the Heidi app while the note is finalised, and is automatically deleted after 21 days (sooner if your child is discharged). The main record of your child’s care is kept in our clinical record system (Semble).
Your child’s information stays in the UK and is encrypted; access is limited to your child’s clinician(s) with secure log-in. Heidi only uses the information as we instruct, under a written contract, and does not use it for any other purpose, including training its AI.
You can ask us not to keep or reuse the transcript at any time — just tell us, and it will not affect your child’s care.

Your choice. We ask for your written consent to use the AI scribe when your child first registers with us, and your clinician will confirm at the start of the appointment that the scribe will be used and check you are happy. You can tell us before any appointment — or at the start of it — if you do not want the scribe used that day, and you can change your mind at any time. It will not affect your child’s care; your clinician will simply write the notes in the usual way.

Where a young person is old enough to understand, we also take account of their own wishes about being recorded; if a competent young person does not want the scribe used, we will not use it, even where a parent has consented.

If you decline or withdraw consent, we simply stop using the scribe. Any notes already made and held in your child’s record are kept under our health-care duties (Article 9(2)(h)) in the usual way, and are not deleted on that basis.

8.2 An AI assistant on the telephone (Luminera)

We are not a 24-hour service. When you telephone us out of hours, or when our line is busy, your call may be answered by Luminera, our AI assistant, rather than going unanswered.

The first thing you hear. Before she is involved at all, a fixed greeting tells you that she is a virtual assistant, that she cannot give medical advice, and that you should hang up and call 999 in a medical emergency, or NHS 111 for urgent advice. That greeting is spoken by the telephone system itself, so it is the same on every call and she cannot change it.

What she does. Luminera answers general questions about the clinic — our fees, where we are, which insurers we work with, how to book, what sort of appointments we offer — and takes a message so that an administrator can call you back during office hours. She is asked to keep her answers short and to offer you more detail rather than reciting everything at once, so that you are not left waiting to speak.

What she does not do — and this matters. She does not give medical advice, does not assess your child’s symptoms, and does not decide how urgent your call is. She is told to say the same thing to everybody who rings: call 999 in an emergency, or NHS 111 for urgent advice. That is said to every caller and is not a judgement about your child.

What we keep. We do not record your call, and we keep no transcript of it. The conversation exists only while the call is happening.

What we keep afterwards is a short written note: your name, whether you would like a call back, and which general category your call falls into — booking, fees or insurance, results or admin, or something else. If you give us an email address, or a time that suits you for the callback, we keep those too. We also see the number you called from, unless you have withheld it.

She does not ask about your child, and there is nowhere for us to record it. Not their name, not their age, and not what your call is about in your own words. This is deliberate: we changed the system so that those things could not be written down even by accident. Anything to do with your child is discussed with a person — when we call you back, or when you register with us.

One thing we want to be straightforward about. Although we keep no recording and no transcript, the words you speak have to be turned into text and passed to the AI provider for the conversation to happen at all. So if you begin telling Luminera something about your child before she can redirect you, those words do reach our suppliers during the call. They are not written down, not emailed to us, and not stored anywhere afterwards — but we would rather tell you that than let you assume otherwise.

Who else is involved. To answer your call we use Twilio (the telephone connection, and converting speech to text and back), Anthropic (the AI model that holds the conversation), Railway (which runs our software), Resend (which sends the note to our team by email), Brevo (our contact system) and Google (our email and our call log). They act on our instructions under written contract. Some are based in the United States; where information is transferred outside the UK we require that it is protected by safeguards approved for UK transfers (see section 9).

Safeguarding. Luminera cannot advise on safeguarding or child protection. If you or your child are in danger, she will tell you to contact your local authority, who will have an emergency number, or your local police. She will not ask you to describe what happened, and you should not tell her. She is specifically instructed not to ask, and not to accept an offer to explain — and, since the change described above, there is no longer anywhere in our system for such a thing to be recorded.

If something goes wrong with her. If our system fails during your call, she will tell you so, repeat the 999 and NHS 111 numbers, and — where we have your number — tell you that the clinic can call you back. We are told every time this happens, with the number you rang from, so that your call can still be returned.

Your choice. You do not have to speak to an AI assistant. Hang up and call back during office hours, or email us at [email protected], and a person will deal with your enquiry. Choosing not to use her will not affect your child’s care in any way.

How we check she behaves. Because she speaks to worried parents without a person present, we test her. An automated test suite runs every time our software changes, and again every time the service starts — it will not begin answering calls if any test fails. An automated check telephones her every hour, puts a scripted caller through the real system, and alerts us if the message is not properly recorded. We also periodically run a large set of scripted conversations to confirm she refuses to give clinical advice, and our Clinical Safety Officer makes test calls to her himself. We cannot review real calls, because we keep no recording or transcript of them — that is a deliberate trade, and it is the reason the other checks exist. No test makes her perfect, which is why she is limited to taking a message and why a person reads every message she takes.

9. Keeping information safe

We protect your child’s information with appropriate security measures — including controlled access, encryption, secure systems and trained staff. These are set out in our Information Security Policy. If something does go wrong, we act quickly under our Compliance & Data Breach Policy and, where the law requires, we will tell you and the Information Commissioner’s Office.

Where your information is processed. Your child’s clinical record (Semble) and the AI-scribe transcript (Heidi) are held in the UK. A number of the providers who help us contact you — including our email and messaging providers, and the providers behind our telephone assistant — may process limited information (for example your name, contact details, appointment details, and what you say during a telephone call) outside the UK. Where they do, we require that it is protected by safeguards approved for UK data transfers, such as the UK International Data Transfer Agreement or Standard Contractual Clauses and, for the United States, the UK extension to the EU–US Data Privacy Framework.

10. How long we keep it

We keep your child’s clinical records for as long as we need them to care for your child and to meet our legal and professional duties. In line with the NHS Records Management Code of Practice, children’s records are generally kept until the patient’s 25th birthday (or their 26th if the last entry was made when they were 17). We keep them into adulthood so that your child can access their own childhood health history and so we can meet our professional duties.

Other information is kept only as long as necessary and then securely destroyed. For telephone enquiries specifically:

What	How long
The call itself — audio and conversation	Not kept at all. Never recorded; no transcript retained
Anything about your child	Not kept at all. Never collected by the telephone assistant
The written note emailed to our team	2 years, unless it becomes part of your child’s clinical record
The row in our internal call log	12 months
A contact record created from your call	24 months from your last contact with us

If your child becomes a patient, the information that forms part of their care is kept with the clinical record under the period above. Full detail is in our Data Retention Policy & Schedule, available on request.

11. Your rights

Under data protection law you have rights, in certain circumstances, to:

be informed about how information is used (this notice);
ask for a copy of the information we hold (a subject access request);
ask us to correct inaccurate information;
ask us to erase information, or to restrict or object to its use;
ask for information to be transferred (data portability), where this applies;
where we rely on your consent (for example, optional updates or marketing), withdraw that consent at any time — this will not affect anything we did beforehand.

We do not make decisions about your child’s care using solely automated processing (including profiling) that produce legal or similarly significant effects. This includes our AI tools: the scribe drafts a note that a clinician corrects, and the telephone assistant takes a message that a person reads and acts on. Neither decides anything about your child’s care or how urgent it is.

Some rights are limited where we have a legal or professional duty to keep clinical records. To exercise a right, contact us at [email protected] — just tell us your child’s name and what you would like, and we will guide you through the rest. We carry out a reasonable and proportionate search and respond without undue delay and within one month, which can be extended by up to two further months for complex requests (we will tell you if so).

11.1 Seeing your child’s record

A person with parental responsibility can usually ask to see a young child’s record, and a competent young person can ask to see their own. We may need to verify identity and parental responsibility first. Where a young person is competent, we consider their views before sharing their record with a parent. We may withhold part of a record where sharing it would not be in the child’s best interests or would reveal information about another person.

12. Making a complaint

If you are unhappy with how we have handled your or your child’s information, please tell us — we would like the chance to put it right. We will acknowledge your complaint within five working days, look into it without undue delay, and keep you updated, including if we need more time. You can also complain to the Information Commissioner’s Office (ICO) at any time, at ico.org.uk or on 0303 123 1113, although we would welcome the chance to resolve things first.

13. Changes to this notice

We may update this notice from time to time. The version and date are shown at the top of this page, and the current version is always available on request.

14. How to contact us

For anything about this notice or your child’s information, contact our Information Governance Lead, Dr Martin Gray, at [email protected], by phone on 020 3633 2915, or by post at UK Bright Futures Limited, 6 Wilkinson Street, London, SW8 1DB.

A note for children and young people

When you come to see us, we write down things about your health. That helps us look after you in the best way.

We keep what we write private and safe. Only the people helping to look after you can see it.

If you are old enough to understand, you can tell us what you are happy to share — and what you would rather keep private. Just ask.

Sometimes a computer called a scribe listens for a little while to help the doctor write things down. The voice recording is deleted straight afterwards. The written notes from it are kept safely for a short time and then deleted. If you do not want the scribe used, or do not want the notes kept, just say — it is your choice and it will not change your care.

If you ring us in the evening or at the weekend, a computer assistant called Luminera might answer. She will tell you she is a computer. She is not a doctor and she cannot tell you what to do if you are poorly — she can tell you about the clinic, and she takes a message so a real person can ring you back. She does not record what you say, and she does not write anything down about you at all — just who is ringing and that they would like a call back. If someone is very ill or hurt right now, ring 999.

Want to know what we have written about you? You can ask, and we will help you.

If you are a bit older, you can have more of a say in what is shared with your parents. We will talk this through with you.

And if something is worrying you, you can always talk to us — we are here to help. If you tell us that someone might be getting hurt, we might need to tell another grown-up who can help keep you safe, and we will explain it to you if we do. Please tell a person, not the computer assistant — she is not able to help with that.

Our fees change on 16 November