Quorum Clinical Ltd
Privacy notice
How we handle personal data, both in our own right and on behalf of the NHS organisations we work for.
Last updated: 4 August 2026
What this notice covers
This notice covers personal data that Quorum Clinical Ltd handles as a data controller: information about people who visit our websites, contact us, work with us as suppliers or professional advisers, or work for us. It applies to both of our websites, quorumclinical.com and relayhealth.co.uk.
It also explains, in the section on Relay below, the different and more limited role we hold when an NHS organisation uses our software. In that situation we are a data processor and the NHS organisation is the controller, so this notice is not the one that governs patient information.
Who we are
Quorum Clinical Ltd is a company registered in England and Wales, company number 17180559, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We are registered with the Information Commissioner's Office under reference ZC202481.
For any question about privacy, or to exercise any of the rights described below, email alex@quorumclinical.com or write to us at the registered office address above.
Visiting our websites
quorumclinical.com sets no cookies, runs no analytics, and makes no requests to any third party. Nothing is stored on your device and nothing about your visit is shared with anyone.
relayhealth.co.uk sets no tracking or advertising cookies.
As with any website, our hosting provider records technical information about requests to our servers, including IP addresses, in order to serve the site and keep it secure. We do not use those records to identify individuals or to build any profile of you.
If you contact us or request a walkthrough
If you email us, we hold your email address, your name if you give it, and the content of your message. If you submit the "Book a walkthrough" form on relayhealth.co.uk, we collect the name, role, email address and organisation you enter, and any message you choose to add.
We use this only to reply to you and, where relevant, to arrange a walkthrough of our software. We do not use it for marketing and we do not share it with anyone for marketing. Our lawful basis is legitimate interests: replying to an enquiry you chose to send us. You can ask us to stop at any time.
Business contacts
We hold names, job titles, work email addresses, work telephone numbers and correspondence for people we deal with in the ordinary course of business: suppliers, professional advisers, and staff at NHS organisations and other bodies we work with or are seeking to work with.
We use this to carry on our side of those relationships, to keep records of what was agreed, and to meet our legal and regulatory obligations. Our lawful basis is legitimate interests in most cases, and compliance with a legal obligation where the record is one we are required to keep.
People who work for us
We are a small company and currently have one worker, who is also our sole director. Personal data relating to that role consists of the statutory records a company must keep about its directors, and the records we are required to keep for tax and accounting purposes. Some of this information is public because company law requires it to be filed at Companies House.
Our lawful bases are compliance with a legal obligation and, where a record goes beyond what the law requires, the performance of a contract. If we take on further workers, we will give them a separate, fuller notice at that point and update this one.
Relay, and NHS patient data
Relay is our software for coordinating multidisciplinary team meetings. Where an NHS organisation deploys it, that organisation is the data controller for the patient and staff information held in the system, and Quorum Clinical Ltd is its data processor. We act only on that organisation's documented instructions, under a written data processing agreement entered into before any patient data enters the system.
That means this notice does not govern patient information held in Relay. If you are a patient and want to know how information about you is used, the notice you need is the one published by the NHS organisation providing your care, and any request about your information should go to that organisation. If you contact us directly about patient information, we will not be able to act on it ourselves and will refer you to the relevant NHS organisation.
The technical and organisational measures we apply, the categories of data processed, retention, sub-processors and the arrangements for assisting the controller with individual rights requests are set out in the data processing agreement with each NHS organisation, rather than in this notice.
Who else handles this information
We keep the number of organisations involved deliberately small. For the personal data covered by this notice, they are:
- Our website host, which serves both websites and holds the technical request records described above.
- Our domain registrar, which provides DNS and forwards email sent to our quorumclinical.com addresses.
- Our email delivery provider, Amazon Web Services, which delivers the messages our systems send, including enquiries submitted through the form on relayhealth.co.uk. Amazon acts as our processor under a data processing agreement.
- Our mailbox provider, Google, which receives and stores the email sent to us.
Each of these acts on our instructions and none of them uses the information for their own purposes. We do not sell personal data and we do not disclose it to anyone else except where we are required to do so by law.
Transfers outside the UK
Where any of our providers transfers personal data outside the UK, we rely on the safeguards permitted under UK data protection law, and we can tell you which apply on request.
How long we keep information
- Enquiries: up to 28 days after your enquiry is resolved, then deleted, unless you have become a customer or ongoing contact and we need to keep corresponding with you.
- Business contacts and correspondence: for as long as the relationship continues, and then for six years, because that is the period for which we must be able to produce tax and accounting records.
- Statutory company and employment records: for the period the relevant legislation requires.
- Technical request records held by our host: for the short period our host retains them for security and operational purposes.
Your rights
For the personal data covered by this notice, you have the right to ask us for a copy of it, to have it corrected if it is wrong, to have it deleted, to object to or ask us to restrict what we do with it, and to receive it in a portable form. Where we rely on legitimate interests, you can object and we will stop unless we have a compelling reason not to.
To exercise any of these, email alex@quorumclinical.com or write to the registered office. We will respond within one month. We may ask you for enough information to be confident we are dealing with the right person before we act.
Complaints
If you are unhappy with how we have handled your personal data you can complain to the Information Commissioner's Office at ico.org.uk, and you do not have to come to us first. We would appreciate the chance to put things right, so please do tell us if something has gone wrong.
Changes to this notice
We will update this notice when our practices change, and revise the date at the top. This notice replaces the earlier one published at relayhealth.co.uk/privacy on 15 June 2026, which covered that website alone.