Privacy notice

Last updated: 2 August 2026

This notice explains how Aegis Healthcare Advisory Limited handles personal information when you use this website, submit an enquiry, correspond with us, or become a client.

Who we are

Aegis Healthcare Advisory Limited is the controller responsible for the personal information described in this notice. We are a private limited company registered in England and Wales under company number 17256579.

Our registered office is 167-169 Great Portland Street, 5th Floor, London W1W 5PF. You can contact us about privacy through the complaint form below or by writing to our registered office, marked “Data Protection”.

Information we collect

We may collect:

  • your name, work contact details, organisation and role;
  • information you provide about your service, regulatory position and support needs;
  • your preferences when you join a resource waitlist or ask to receive a product update;
  • correspondence, meeting notes, proposals, contracts and payment records;
  • technical information needed to operate and secure the website, such as IP address, browser type and server logs; and
  • information needed to respond to a data-protection request or complaint.

Please do not submit patient names, patient contact details, medical records or other identifiable health information through our website forms. If sensitive information is relevant to an enquiry, contact us first so that an appropriate secure route can be agreed.

We usually receive information directly from you. We may also receive business contact information from your employer, professional advisers, publicly available professional sources, or another person in your organisation.

How and why we use information

  • Enquiries and proposals: to respond, arrange calls and take steps at your request before entering a contract. Our lawful bases are steps before a contract and our legitimate interests in operating our advisory business.
  • Resource waitlists: to confirm your interest and send updates about the specific resource you selected. Our lawful basis is your consent, which you can withdraw at any time by replying to an update or contacting us.
  • Client services: to deliver agreed services, manage the relationship, invoice and keep appropriate records. Our lawful bases are performance of a contract, legal obligations and legitimate interests.
  • Website operation and security: to deliver pages, prevent misuse, diagnose faults and protect our systems. Our lawful basis is legitimate interests.
  • Legal and regulatory matters: to establish, exercise or defend legal claims, meet legal duties and respond to authorised public bodies. Our lawful bases are legal obligations and legitimate interests.
  • Data-protection requests and complaints: to verify identity, investigate, respond and demonstrate compliance. Our lawful bases are legal obligations and legitimate interests.

We do not use website enquiry information for automated decision-making or profiling, and we do not sell personal information.

Sharing and international transfers

We share personal information only where necessary with service providers supporting website hosting, form processing, email, document storage, professional services and business administration. We may also disclose information where required by law, to regulators or authorities, or in connection with legal claims or a business reorganisation.

Some suppliers may process information outside the United Kingdom. Where this happens, we require an appropriate UK transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, together with proportionate security measures.

How long we keep information

  • Enquiries that do not become client matters: normally up to 24 months after the last meaningful contact.
  • Resource waitlists: until you withdraw consent or, if earlier, 12 months after the selected resource is released.
  • Client and transaction records: normally seven years after the engagement ends, where needed for tax, contractual, insurance and legal purposes.
  • Website security logs: normally no more than 12 months, unless needed to investigate an incident.
  • Data-protection requests and complaints: normally three years after closure.

We may keep information longer where a legal duty, dispute, regulatory issue or preservation requirement applies. We delete or anonymise information when it is no longer needed.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict your personal information, object to processing, and receive certain information in a portable format. You may also complain about how your information has been used.

These rights are not absolute. We may need to verify your identity and may retain information where the law permits or requires it. We normally respond to valid rights requests within one month.

Data-protection complaints

Use this form if you are concerned about how we have handled personal information. We acknowledge complaints within 30 days and respond without undue delay. Complex matters may take longer; if so, we explain the reason and keep you informed.

Do not include patient records or other unnecessary sensitive information. We use these details only to investigate and respond to your complaint.

If you remain dissatisfied, you can complain to the Information Commissioner’s Office. You can contact the ICO without complaining to us first, although the ICO may ask whether you have raised the matter with us.

Changes to this notice

We review this notice when our services, suppliers or legal obligations change. The date at the top shows when it was last updated.