Last Updated: 09/10/2026

On this page11 sections · Choose a topic

1. Who We Are

Quick GP Access is a private online GP letter service operated by MTZMS Limited. We are registered with the Care Quality Commission (CQC). Please do not email medical information or identity documents; these are collected through our secure request forms.

Data controller and service provider: MTZMS Limited trading as Quick GP Access (company number 15084641)
Clinical lead and registered manager: Dr Muhammad Zarif
GMC registration: 7149341
ICO registration number: ZC081756
Email: admin@quickgpaccess.co.uk
Registered Address: Rosehill Business Centre, Room 20, Normanton Road, Derby, DE23 6RH

2. What Information We Collect

For general enquiries, we may receive your name, email address and message. For a clinical assessment, the information we request may include:

  • Personal details (name, date of birth, address, contact details)
  • Identity information used for verification, including photographic ID and a live selfie through Stripe Identity, our preferred verification route. For people who need an accessible alternative, we collect a securely uploaded selfie showing their face while holding their photographic ID, with the ID visible and readable. The GP may arrange a short video call to confirm identity. These checks help protect patients, prevent impersonation and ensure that assessments and letters relate to the right person. Clinical records document the verification method and outcome. Any identity evidence retained by a verification provider is handled under that provider’s privacy notice and retention arrangements. We retain only information needed for verification, safety and our records

    Stripe Identity’s automated photo ID and selfie comparison can process biometric information to match your face to your ID. Stripe asks for consent before collecting and using biometric information. Read Stripe’s Privacy Policy and its identity verification and data-storage guidance before starting. If you cannot use the automated check or do not consent to biometric processing, contact us for guidance about an alternative identity check. Please do not email your ID or selfie.

  • Medical information relevant to your request (symptoms, medical history, supporting evidence), your consent choices, assessment notes and a copy of any letter or decline decision
  • Payment and transaction information processed through Stripe; payment card processing is handled by Stripe

3. How We Use Your Information

We use your information to:

  • Verify your identity
  • Conduct clinical assessments
  • Issue medical letters and documentation
  • Maintain accurate medical records
  • Comply with legal and professional obligations (GMC, CQC)
  • Process payments
  • Respond to complaints or general enquiries
  • Document any clinically necessary phone or video call in notes; Quick GP Access keeps relevant clinical notes rather than recording clinical calls

4. Legal Basis for Processing

We use a lawful basis under Article 6 of the UK GDPR for each purpose. Health information also requires an Article 9 condition. Clinical consent is separate from the lawful basis for keeping necessary clinical records. The bases used for our service are:

  • General enquiries and service administration: legitimate interests (Article 6(1)(f)) in responding to enquiries, maintaining the service and handling complaints. Where an enquiry is about entering a service contract, Article 6(1)(b) also applies to the requested pre-contract steps. Please avoid sending health information with general enquiries.
  • Clinical assessments and payments: contract (Article 6(1)(b)). Health information is processed for medical assessment and healthcare under Article 9(2)(h), with the relevant Data Protection Act 2018 Schedule 1 condition and professional confidentiality safeguards.
  • Clinical records, safety and complaints: legitimate interests (Article 6(1)(f)) in maintaining accurate records and safe care, together with Article 9(2)(h) for health information. Article 6(1)(c) applies where a specific legal duty requires processing. Article 9(2)(f) applies where health information is necessary for establishing, exercising or defending legal claims. Any consent relied on for optional processing can be withdrawn without removing our other valid grounds for necessary record retention.

5. How We Keep Your Information Secure

Your data is protected through:

  • Encrypted website (SSL/TLS encryption)
  • Jump EHR for clinical questionnaires and patient records
  • Password-protected storage with restricted access
  • Secure email systems for clinical correspondence
  • Regular security reviews

6. Who We Share Your Information With

We use service providers and may share information where necessary for the following purposes:

  • Jump EHR for questionnaires, patient records and clinical communication; IONOS for business email; Stripe for payments and Stripe Identity for automated identity verification; our website hosting provider; and Font Awesome and Cloudflare (cdnjs), which deliver icons and website code and receive your device’s IP address when you visit our website. Only information necessary for each provider’s role is shared
  • Some providers, such as Stripe, may process data outside the UK. Where they do, the transfer is protected by UK adequacy regulations or the UK International Data Transfer Agreement or Addendum
  • Cookies: our website uses only cookies that are strictly necessary for it to work. We do not use advertising or analytics cookies. Our secure request forms are provided by Jump and Stripe, which may set their own strictly necessary cookies
  • When legally required, including safeguarding concerns
  • With your consent where applicable, such as contacting your NHS GP for clinical verification or sharing a letter you request
  • With regulatory bodies if required (CQC, GMC)

We do not sell or market your information to anyone.

7. How Long We Keep Your Information

Our records management policy specifies retention of clinical records for 8 years after the last clinical contact, followed by secure disposal, subject to any applicable legal or professional requirements.

Payment and accounting records are retained for 7 years under our records policy, subject to applicable accounting and tax requirements. General enquiries are kept only for as long as needed to resolve the enquiry and deal with any related follow-up or complaint.

8. Your Rights Under GDPR

Your rights depend on the processing and lawful basis. They include:

  • Access your data: Request a copy of the information we hold about you
  • Correct your data: Ask us to update inaccurate or incomplete information
  • Delete your data: Request deletion (subject to our legal obligation to retain medical records)
  • Restrict processing: Ask us to limit how we use your data
  • Data portability: Request your data in a transferable format
  • Object: Object to how we process your data
  • Withdraw consent: You can withdraw consent at any time

We normally respond to data rights requests within one month, subject to the lawful rules on identity checks, clarification and extensions. Withdrawing consent does not affect earlier lawful processing or require deletion of records we must legitimately retain.

To exercise any of these rights, email: admin@quickgpaccess.co.uk

9. Complaints

If you have concerns about how we handle your data, you can:

10. Changes to This Policy

We review this privacy policy annually. Any changes will be posted on this page with an updated date.

11. Contact Us

For any privacy-related questions:
Email: admin@quickgpaccess.co.uk