Privacy policy

Last updated: 9 October 2026

This policy explains how Mr Ivo Dukic's private urology practice collects, uses and protects your personal information. It applies to patients, people who contact the practice, and visitors to ivodukic.co.uk.

Who we are

The data controller for your information is Urolsurg Ltd, the company through which Mr Ivo Dukic, Consultant Urological Surgeon (GMC 6103172), provides private urology care.

• Company number: 16213062 (registered in England and Wales)

• Registered office: 51 Coopers Road, Handsworth Wood, Birmingham, B20 2JU

• ICO registration number: ZB525476

• Practice secretary: Keely Thomas

• Telephone: 0121 716 9046 (Monday to Friday, 8am to 6pm)

• Email: admin@ivodukic.co.uk

The private hospitals where you are seen, The Harborne Hospital, The Priory Hospital, Spire Parkway Hospital and The Droitwich Spa Hospital, are separate data controllers for the records they keep. Each has its own privacy notice. If you are seen as an NHS patient at University Hospitals Birmingham NHS Foundation Trust, the Trust's privacy notice applies instead of this one.

What information we collect

We collect only what we need to arrange and provide your care.

• Identity and contact: name, date of birth, address, phone and email, from you, your GP or your referrer.

• Health information: symptoms, medical history, medications, examination findings, test and imaging results, operation notes and clinic letters, from you, your GP, hospitals, laboratories and radiology.

• Insurance and payment: insurer name, policy and authorisation numbers, and invoices, from you and your insurer.

• Your GP and referrer: practice name and contact details, from you or your referral letter.

• Enquiries: what you tell us by phone, email or the website contact form.

• Website usage: pages visited, device and browser type, and approximate location, from your browser (see Website, contact form and cookies below).

Health information is a special category of personal data under UK GDPR. We give it extra protection.

How we use your information and our legal basis

UK GDPR requires a lawful basis for each use. For health information, we also need a condition under Article 9.

• Assessing, diagnosing and treating you: contract with you, Article 6(1)(b); provision of health care, Article 9(2)(h).

• Writing to your GP and other clinicians caring for you: contract, Article 6(1)(b); provision of health care, Article 9(2)(h).

• Discussing complex cases at a multidisciplinary meeting: legitimate interests in safe care, Article 6(1)(f); provision of health care, Article 9(2)(h).

• Billing you or your insurer: contract, Article 6(1)(b); establishing legal claims, Article 9(2)(f), where needed.

• Keeping records as required by law and professional guidance: legal obligation, Article 6(1)(c); provision of health care, Article 9(2)(h).

• Clinical audit to check and improve outcomes: legitimate interests, Article 6(1)(f); provision of health care, Article 9(2)(h).

• Answering enquiries: legitimate interests, Article 6(1)(f); explicit consent, Article 9(2)(a), if you share health details.

We do not sell your information or use it for marketing. We do not make decisions about you by automated means alone.

If your information is used in research or published audit, it is anonymised first. We will ask for your consent if identifiable information is ever needed.

Who we share it with

We share only what each person or organisation needs for your care, payment or a legal duty.

• Your GP and referring clinician: clinic letters and results, unless you ask us not to. We will explain any risks of not informing your GP.

• The hospital where you are seen: for appointments, tests and surgery.

• Other clinicians involved in your care: such as radiologists, pathologists, anaesthetists and other specialists.

• The Birmingham Urology Centre multidisciplinary team: when your case needs a group opinion.

• Your health insurer: to obtain authorisation and settle fees, if you are insured.

• Service providers working on our behalf: our practice secretary, IT, email and secure storage providers, our clinical note-taking provider (see below) and billing or practice management providers. They act only on our instructions, under written contracts that require them to keep your information secure and confidential.

• Regulators and authorities: where the law requires it, for example a court order, the GMC, or a safeguarding concern.

We may also share information if you are at serious risk of harm and cannot consent. In this case, we act in line with GMC confidentiality guidance.

AI-assisted clinical notes

With your agreement, Mr Dukic uses Heidi Health, an AI medical scribe, to transcribe and summarise your consultation.

• We ask for your verbal consent at the start of each consultation. You can say no, or stop it at any point, without affecting your care.

• Mr Dukic checks and corrects every summary before it is used. He remains responsible for your record.

• Heidi Health processes the information only on our instructions, under a data processing agreement.

• Heidi Health transcribes the conversation as it happens and does not store audio recordings. Its data is hosted in the UK.

You can read more in our patient explainer on Heidi Health.

How long we keep it and how we protect it

• Adult medical records: 8 years after your last treatment.

• Records of patients under 18: until their 25th birthday, or 26th if they were 17 at the end of treatment.

• Invoices and financial records: 6 years, as HMRC requires.

• Enquiries that do not lead to an appointment: 12 months.

Retention periods follow the NHS England Records Management Code of Practice. We may keep records longer where there is a clinical or legal reason, such as an ongoing complaint or claim.

We protect your information with password-protected and encrypted systems, secure email, restricted access and staff confidentiality agreements. Paper records are kept to a minimum and stored securely.

We aim to keep your information in the UK. If a provider stores it elsewhere, we make sure UK GDPR safeguards are in place, such as a UK adequacy decision or the ICO's International Data Transfer Agreement.

Your rights

Under UK GDPR you have the right to:

• Access a copy of your information

• Correct information that is wrong or incomplete

• Erase your information, where we have no legal or clinical need to keep it

• Restrict how we use it while a concern is looked into

• Object to uses based on legitimate interests

• Move information you gave us to another provider, where this applies

• Withdraw consent at any time, where we rely on it

To use any of these rights, contact us on 0121 716 9046 or admin@ivodukic.co.uk. We will reply within one month, free of charge in most cases. We may ask you to confirm your identity first.

If you are unhappy with how we handle your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Website, contact form and cookies

This website is hosted by Hostinger. Messages sent through the contact form go to the practice inbox and are handled as described above. Please do not send detailed medical information through the form; we will contact you to discuss it securely.

The site uses cookies that are needed for it to work. We also use Google Analytics cookies to understand how visitors use the site. These are only set if you accept analytics cookies in the cookie banner, and you can change your choice at any time. Google processes this data on our behalf and may store it outside the UK under UK GDPR safeguards. You can block or delete cookies in your browser settings.

Links to hospital, insurer and review websites take you to sites with their own privacy policies.

Changes to this policy

We review this policy at least once a year. The date at the top shows when it was last updated.