Privacy Policy
How Sanctura Life collects, uses, protects, and shares your personal and health information across our London and Cape Town clinics — and the rights you hold over it.
01Introduction
Sanctura Life ("we", "our", "us") is committed to protecting the privacy, confidentiality, and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit sancturalife.com and interact with our integrative oncology and healthcare services.
As a CQC-registered private healthcare provider operating clinics in London, United Kingdom and Cape Town, South Africa, Sanctura Life is subject to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the South African Protection of Personal Information Act (POPIA).
Given the sensitive nature of the health and medical information we handle, we apply the highest standards of data protection and confidentiality to all personal data we process.
02Who We Are
Email: [email protected]
03Information We Collect
3.1 Information You Provide Directly
General personal data- Full name and date of birth / age
- Email address and phone number
- Preferred clinic location (London or Cape Town)
- How you heard about us (referral source)
- Marketing and communication preferences
- Medical diagnosis and cancer type
- Current and previous treatments
- Services you are enquiring about
- Information shared during medical consultations with our specialists
- Treatment outcomes, progress notes, clinical records and diagnostic reports
Health data is classified as 'special category' personal data under UK GDPR and POPIA and requires explicit consent or a specific legal basis for processing. We only collect health information strictly necessary for your care.
3.2 Information Collected Automatically
- IP address and approximate location
- Browser type and device information
- Pages visited and time spent on site
- Referring URLs and navigation behaviour
- Cookie and tracking data (see our Cookie Policy)
3.3 Information from Third Parties
- Referrals from oncologists, GPs, or other healthcare professionals
- Medical records transferred from other healthcare providers (with your consent)
- Information from business or marketing partners (for non-clinical enquiries)
04How We Use Your Information
Healthcare and clinical purposes- To assess your enquiry and determine whether our services are appropriate for you
- To deliver personalised integrative oncology care
- To develop and manage your care plan in collaboration with our specialist team
- To communicate clinical updates and care-related information
- To maintain accurate and up-to-date medical records
- To coordinate care with external healthcare providers (with your consent)
- To process consultation bookings and payments
- To manage prepaid treatment packages and billing
- To send appointment reminders and administrative communications
- To handle cancellations, rescheduling, and refund requests
- To comply with CQC regulations and healthcare governance standards
- To meet obligations under UK GDPR, the Data Protection Act 2018, and POPIA
- To respond to legal requests or regulatory investigations
- To send updates about integrative oncology care and clinic services
- You may withdraw this consent at any time by contacting us or unsubscribing
05Legal Basis for Processing
| Data Type | Legal Basis | Regulation |
|---|---|---|
| General contact and enquiry data | Legitimate interests / Pre-contractual steps | UK GDPR Art. 6(1)(b)(f) |
| Clinical and treatment data | Provision of healthcare; Explicit consent | UK GDPR Art. 9(2)(h) and 9(2)(a) |
| Billing and payment data | Contractual necessity | UK GDPR Art. 6(1)(b) |
| Marketing communications | Consent | UK GDPR Art. 6(1)(a) |
| Regulatory compliance | Legal obligation | UK GDPR Art. 6(1)(c) |
| Safety and safeguarding | Vital interests / Legal obligation | UK GDPR Art. 6(1)(d)(c) |
For special category health data we rely on Article 9(2)(h) of UK GDPR (processing necessary for healthcare provision) and/or explicit consent under Article 9(2)(a).
06Data Retention
| Data Type | Retention Period | Basis |
|---|---|---|
| Clinical and medical records | Minimum 8 years from last treatment (for oncology patients — 30 years after diagnosis) | UK NHS / CQC guidelines |
| Consultation and appointment records | 8 years | CQC / clinical governance |
| Billing and payment records | 7 years | HMRC legal obligation |
| Marketing and consent records | Until consent withdrawn + 1 year | UK GDPR best practice |
| Website enquiry data (non-clinical) | 2 years | Legitimate interests |
| Cookie and analytics data | As defined in Cookie Policy | See Cookie Policy |
07How We Share Your Information
We do not sell your personal information. We may share it with:
- Your care team — clinicians, specialists, and therapists involved in your treatment at Sanctura Life
- External healthcare providers (with your consent) — your oncologists, radiologists, surgeons, or GPs
- Service providers and subprocessors — third-party vendors bound by data processing agreements (e.g. Google (Google Workspace / Google Drive), JotForm, appointment booking systems, payment processors, cloud storage)
- Regulatory and legal authorities — the CQC, HMRC, or other regulators where required by law
- Emergency situations — where necessary to protect your vital interests or those of another person
- Business transfers — in the event of a merger, acquisition, or clinic transfer, subject to appropriate safeguards
08International Data Transfers
Sanctura Life operates in the United Kingdom and South Africa. Data may be transferred between our London and Cape Town clinics as necessary for your care.
South Africa does not currently hold UK adequacy status. Any transfer of personal data from the UK to South Africa is conducted using UK International Data Transfer Agreements (IDTAs), Standard Contractual Clauses (SCCs), or other ICO-approved safeguards. Where data is transferred from South Africa to the UK, such transfers comply with POPIA and applicable South African requirements.
09Your Rights
| Right | Description | How to Exercise |
|---|---|---|
| Access | Request a copy of the personal data we hold about you | Email [email protected] or [email protected] |
| Rectification | Request correction of inaccurate or incomplete data | Email us — we respond within 30 days |
| Erasure | Request deletion of your data (subject to clinical and legal retention requirements) | Email us — we respond within 30 days |
| Restriction | Request that we limit how we process your data | Email us — we respond within 30 days |
| Portability | Receive your data in a structured, machine-readable format | Email us — we respond within 30 days |
| Object | Object to processing based on legitimate interests or for direct marketing | Email us — we respond within 30 days |
| Withdraw consent | Withdraw consent at any time (will not affect prior processing) | Email us or use the unsubscribe link |
10Security
- Encryption of data in transit (TLS/SSL) and at rest
- Role-based access controls — only authorised clinical and administrative staff can access patient records
- Secure, password-protected clinical management systems
- Regular staff training on data protection and confidentiality
- Physical security measures at both clinic locations
- Incident response procedures and data breach notification protocols
In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner's Office (ICO) within 72 hours, and affected individuals without undue delay.
11Children's Data
South Africa clinic. Sanctura Life's Cape Town clinic provides treatment and consultation to patients under the age of 18. Where we process the personal information of a child, we do so in accordance with the Protection of Personal Information Act, which classifies children's personal information as special personal information and permits its processing only with the consent of a competent person or where another statutory exception applies. Consent is obtained in accordance with South African law, including the Children's Act 38 of 2005, and the child's own assent is sought where they are of sufficient age and understanding.
United Kingdom clinic. Sanctura Life's London clinic does not provide treatment or consultation to patients under the age of 18, and does not collect the personal data of children other than incidentally where an adult provides it in an enquiry. Where such data is provided to our London clinic, we will delete it unless we are required to retain it by law or for safeguarding purposes.
Our website and enquiry forms are intended for use by adults aged 18 or over, or by an adult acting on behalf of a patient with appropriate authority.
Children's data is retained in line with the retention periods set out in Section 6 and is subject to the same security measures as all other clinical data. We do not use the personal data of children for marketing or for any non-clinical purpose.
12Cookies
We use cookies and similar tracking technologies on our website. For full details please see our Cookie Policy at sancturalife.com.
13Changes to This Policy
We may update this Privacy Policy from time to time. The Last Updated date at the top reflects the most recent revision. Where changes are material, we will notify you by email or via a notice on our website.
14Data Protection Contact & Information Officer
Address: Sanctura Life, 24 Newman Street, Fitzrovia, London, W1T 1PJ
Data Protection Lead: Amanda Ross
Address: Sanctura Life, The Foundry, Suite 401, 74 Prestwich Street, Cape Town, 8001
Data Protection Lead: Amanda Ross
15How to Make a Complaint
This Privacy Policy was last reviewed in July 2026.
For queries contact [email protected] | sancturalife.com