How we use your information when we help you abroad
Our privacy notice for patients, their families and other people named in a case.
From UCS Assist Ltd. Last updated: 9 October 2026
1. Who we are
We are UCS Assist Ltd, a medical assistance company. When you fall ill or are injured while travelling, your travel insurer or assistance company may ask us to look after your care: to assess you medically, arrange treatment or a transfer, and bring you home.
We are the controller of your information. That means we decide how it is used, and we are responsible for looking after it.
- Company number: 17290123 (registered in England and Wales)
- Registered office: 2 Deansgate, Bolton BL1 1BR, United Kingdom
- Contact us: Martin Ball, our Data Protection Lead, for questions about your information, with our Data Protection Officer, Claire Bates, behind him. Email martin.ball@ucscaregroup.co.uk
- ICO registration number: ZC257585
Our Data Protection Officer is Claire Bates. You can contact her about anything in this notice, or to use any of your rights, by email at Claire.Bates@ucscaregroup.co.uk. You can also write to her at our registered office (above), marked “For the attention of the Data Protection Officer”.
We keep your case in a system called Atlas. Our sister company, UCS Care Group Ltd, builds and runs Atlas for us, and only uses your information on our instructions (it is our “processor”).
2. Who this notice is for
- Patients we are helping, or have helped.
- Family, next of kin and friends whose details we hold because they are part of a patient's case.
- Other people named in a case, such as a travel companion.
If you are acting for someone else — a parent for a child, or a relative for someone too unwell to deal with this — please read it on their behalf.
3. Where we get your information from
Most of what we know about you does not come from you. It comes from:
- your travel insurer, assistance company or broker, when they ask us to help you;
- the hospitals, clinics and doctors treating you, in reports and letters they send us;
- your family, friends or travelling companions, when they contact us about you;
- our own clinicians, who record your care while they look after you, for example on a flight home;
- you, when you speak to us, message us or fill in a form;
- public sanctions and watch lists, which we check names against (section 5).
4. What information we hold
- Who you are and how to reach you: name, date of birth, sex, address, phone number, email address, and your NHS number if you have one.
- Your insurance: your policy, the insurer or assistance company, and their reference numbers.
- Your trip and where you are: the country and place you are in, and the hospital you are in. If you fill in one of our forms, it may record where you were when you sent it.
- Your health: your medical condition, treatment, tests, medicines, allergies, fitness to travel, and the record our clinicians keep of the care they give you. Health information is special category data, and the law gives it extra protection.
- Messages and letters about your case, by email, WhatsApp and phone.
- For family and contacts: your name, how you are related to the patient, and how to reach you.
- The result of a sanctions check (section 5).
5. Why we use it, and the law that allows us to
| What we do | Why the law allows it |
|---|---|
| Look after your health — assess you, arrange and give treatment, bring you home, and keep a clinical record of it | It is in the legitimate interests of you, your insurer and us that you get the care your cover exists to provide. For your health information: it is for the provision of health care, by health professionals who owe you a duty of confidentiality. |
| In an emergency, when you cannot tell us what you want (for example, if you are unconscious) | To protect your vital interests — your life or health. |
| Keep your insurer or assistance company informed, including clinical decisions about your care, so that they can authorise and pay for it | Our legitimate interests, and theirs, in running the insurance cover you are claiming on. For your health information: the law allows it for insurance purposes, and where it is needed for a legal claim. |
| Invoice your insurer for our services | The contract between us and your insurer. Invoices carry your name and case reference, never medical information. |
| Check names against sanctions lists | Our legal obligation not to deal with people under sanctions, and our legitimate interest in checking watch lists more widely. We send names only — never your date of birth or any medical information. The lists checked can include people wanted in connection with crimes, so a match could reveal information about alleged offences; a match is reviewed by a person before anything happens. |
| Keep records for regulation, clinical safety and legal claims | Our legal obligations, and our legitimate interests in being able to show what happened. |
Where we rely on legitimate interests, we have weighed them against your interests and rights, and recorded how. You can ask us for that record, and you can object (section 10).
6. Who we share it with
We share only what each of these needs:
- your travel insurer, assistance company or broker — the company that asked us to help you;
- hospitals, clinics, doctors and ambulance services treating you abroad or receiving you at home;
- the companies we use to transport you, such as air ambulances, ground ambulances and medical escorts — they receive what they need to move you safely;
- the companies whose services run Atlas, who act only on our instructions:
- Microsoft — hosting and storage in the UK; translation of foreign-language medical reports (in the UK); maps showing where you are (processed in the European Union); and sending WhatsApp messages;
- Meta (WhatsApp) — delivering WhatsApp messages we exchange with you or your family;
- OpenSanctions (Germany) — the sanctions check, which receives names only;
- Ideal Postcodes (UK) — finding an address from a postcode;
- UCS Care Group Ltd, which runs Atlas for us. As the maker of Atlas, which is a registered medical device, it may also use a case by its case number — not your name — to investigate a safety problem or report one to the medical devices regulator;
- regulators, the police or courts, if the law requires it.
We do not sell your information, and we do not use it for marketing.
7. Sending your information abroad
Because we help people who are abroad, we have to send information about you to hospitals, doctors and transport companies in the country where you are. Some of those countries do not have data protection laws the UK recognises as equivalent to its own.
We send it because it is necessary to carry out the assistance contract made for your benefit with your insurer. If you cannot consent because you are too unwell, we send it to protect your life or health. Either way, we send only what the receiving hospital or service needs to care for you or move you.
Some of our service providers process information outside the UK: maps (Microsoft, in the European Union) and the sanctions check (OpenSanctions, in Germany) — the UK recognises the EU's protection as adequate — and WhatsApp messages, which Meta delivers under its own data transfer terms.
8. How long we keep it
| Information | How long |
|---|---|
| Your clinical record and case file | 10 years after your case closes — or, for a child, until their 25th birthday (26th if they were 17 when the case closed), if that is later |
| Invoices | 6 years after the end of the financial year |
| Copies of emails in our shared mailboxes | 2 years, once the email is saved to your case |
| Backups of our database | Up to 10 years. A backup cannot be edited, so information we have deleted may remain in one; it is never restored to be used, and if a backup is ever restored, every deletion is made again before it is used |
We keep the clinical record this long because it is a medical record, and because it may be needed if a question is raised later about the care you received. When the period ends, a person reviews the case and deletes it.
9. How we keep it safe
Atlas is hosted in the UK. Staff see only what their role needs, and we keep a record of who looked at or changed your case. Your clinical record is never overwritten: a correction is added alongside it, so the record always shows what was known and when.
10. Your rights
You have the right to:
- see the information we hold about you, and get a copy (a “subject access request”);
- have it corrected if it is wrong. A medical record is not changed after the event: we add a correction or a note beside it, so the original stays readable;
- have it deleted, in some cases. We usually cannot delete a medical record before the end of its retention period, because the law lets us keep it for health care and for legal claims — we will tell you if that applies;
- ask us to limit how we use it;
- object to how we use it, where we rely on legitimate interests (section 5);
- have a copy in a format a computer can read, where this applies.
To use any of these rights, contact our Data Protection Officer (section 1). You do not have to use a form, and you do not have to name the law — telling any of our staff is enough. We will answer within one month. If your request is complicated we may need up to two more months, and we will tell you why.
We will ask you to prove who you are before we release anything, because health information is sensitive. If you are asking for someone else, we will need to see that you are allowed to: the patient's written permission, a Lasting Power of Attorney for health and welfare, or a court order. Next of kin do not automatically have a right to see a patient's records.
If the patient has died, their records can be requested under the Access to Health Records Act 1990 by their personal representative, or by someone with a claim arising from the death.
11. Decisions made by computer
We do not make decisions about you by computer. Atlas does not match people or records automatically, and it does not make clinical decisions. It may calculate a figure to show a clinician — for example a standard early-warning score from your observations — but every decision about your care, and every link between your records, is made by a person.
12. If you are unhappy
Please tell our Data Protection Officer first (section 1). We would like the chance to put things right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time:
- website: ico.org.uk/make-a-complaint
- telephone: 0303 123 1113
- post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
13. Other privacy notices
- Our website has its own privacy notice, for people who use the website.
- Your insurer or assistance company has its own privacy notice, for what it does with your information.
- Our staff and clinicians have their own notices.
14. Changes to this notice
We will update this notice when how we use your information changes, and change the date at the top.