Privacy policy

Last updated: 15 October 2026

This policy explains what personal information we collect, how we use and protect it, and your rights under UK GDPR and the Data Protection Act 2018. It covers patients of Mr Ivo Dukic, people who contact the practice, and visitors to ivodukic.co.uk.

Data controller: Urolsurg Ltd, company number 16213062, registered office 51 Coopers Road, Handsworth Wood, Birmingham, B20 2JU. ICO registration ZB525476. Contact Keely Thomas, practice secretary, on 0121 716 9046 or admin@ivodukic.co.uk.

The hospitals where you are seen keep their own records under their own privacy notices. NHS patients at University Hospitals Birmingham are covered by the Trust's notice.

1. Information we collect

• Identity and contact: name, date of birth, address, phone and email.

• Health: symptoms, medical history, medications, test and imaging results, operation notes and clinic letters.

• Insurance and payment: insurer, policy and authorisation numbers, invoices.

• GP and referrer: practice name and contact details.

• Enquiries: what you tell us by phone, email or the contact form.

• Website usage: pages visited, device type and approximate location (see section 9).

This comes from you, your GP or referrer, your insurer, and the hospitals, laboratories and radiology services involved in your care.

2. How we use your information

• To assess, diagnose and treat you, and to write to your GP and other clinicians.

• To discuss complex cases at the Birmingham Urology Centre multidisciplinary meeting.

• To arrange appointments and bill you or your insurer.

• To keep the records required by law and professional guidance.

• To audit our outcomes. Research or published audit uses anonymised data only.

• To answer your enquiries.

We never sell your information, use it for marketing, or make decisions about you by automated means alone.

3. Legal basis

• Contract, Article 6(1)(b): providing the care you ask for, and billing.

• Legal obligation, 6(1)(c): keeping medical and financial records.

• Legitimate interests, 6(1)(f): multidisciplinary review, audit and answering enquiries.

• Vital interests, 6(1)(d): if you are at serious risk and cannot consent, in line with GMC guidance.

Health information also needs an Article 9 condition. We rely on the provision of health care, 9(2)(h); legal claims, 9(2)(f), where needed; or your explicit consent, 9(2)(a), if you share health details in an enquiry.

4. Who we share it with

We share only what each person or organisation needs:

• Your GP and referring clinician, unless you ask us not to.

• The hospital where you are seen, and other clinicians involved in your care.

• Your health insurer, if you are insured.

• Service providers acting on our instructions under written contracts: secretarial, IT, email, secure storage, billing and AI note-taking.

• Regulators, courts or safeguarding authorities, where the law requires it.

5. AI-assisted clinical notes

With your verbal agreement, Mr Dukic uses Heidi Health, an AI medical scribe, to transcribe and summarise your consultation. You can decline or stop it at any time without affecting your care. Mr Dukic checks every summary and remains responsible for your record. Heidi does not store audio, hosts its data in the UK and works under a data processing agreement. Read the patient explainer on Heidi Health.

6. How long we keep it

• Adult medical records: 8 years after your last treatment.

• Patients under 18: until their 25th birthday, or 26th if they were 17 at the end of treatment.

• Financial records: 6 years, as HMRC requires.

• Enquiries that do not lead to an appointment: 12 months.

These follow the NHS England Records Management Code of Practice. We keep records longer only for a clinical or legal reason, such as an open complaint.

7. Data security

We use encrypted, password-protected systems and secure email. Access is limited to people who need it, under confidentiality agreements. Paper records are kept to a minimum and stored securely.

8. International transfers

We aim to keep your information in the UK. Where a provider, such as Google Analytics, processes it abroad, UK GDPR safeguards apply, such as a UK adequacy decision or the ICO's International Data Transfer Agreement.

9. Website and cookies

This site is hosted by Hostinger and uses strictly necessary cookies to work and to remember your cookie choice. With your consent, we also use Google Analytics 4 to count visits and see which pages are used and how people find the site. It records the pages you view, how you arrived, your device and browser type and your approximate location (town or city), linked to a random ID stored in a cookie. Google Analytics only runs if you click Accept in the cookie banner; if you click Reject, it does not run. Our legal basis is your consent (UK GDPR Article 6(1)(a)). We have turned off Google's advertising personalisation and Google signals features, and we do not use analytics to identify you. Google provides the service under its data processing terms. Event-level analytics data is deleted after 2 months and user-level data 14 months after your last visit; aggregated reports are kept longer. To change your choice, delete the cookies for ivodukic.co.uk in your browser settings and the banner will appear again on your next visit. Please do not send detailed medical information through the contact form; we will contact you to discuss it securely. Linked hospital, insurer and review sites have their own privacy policies.

10. Your rights

You can ask to access, correct, erase or restrict your information, object to how we use it, move it to another provider, or withdraw consent. Some rights are limited where we must keep medical records by law.

To use these rights, contact us on 0121 716 9046 or admin@ivodukic.co.uk. We reply within one month, usually free of charge, and may ask you to confirm your identity.

If you are unhappy with how we handle your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Changes to this policy

We review this policy at least once a year. The date at the top shows when it was last updated.