Last updated: 31 October 2026
This policy explains what personal information Docorix collects through docorix.com, why, and what your rights are. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Docorix is a project of Ullah Health Ltd, a company registered in England and Wales (company number 17350496), registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (“Docorix”, “we”, “us”). We run docorix.com: a health and care directory, news and local intelligence, and AI Studio. Ullah Health Ltd is the data controller for the personal information described here. We are registered with the Information Commissioner’s Office as a data controller, registration number ZC270010 (see our entry on the ICO register).
You can reach us about anything in this policy at contact@docorix.com, through our contact page, or by post at the address above.
2. The information we collect
When you browse
- Technical logs. Our hosting provider records your IP address, browser type, the pages requested and the time, to keep the site secure and working.
- Display choices. Your colour theme, your “All / NHS / Private” choice and the listings you recently viewed are remembered in your own browser. See our cookie policy.
- Analytics (only if you allow it). If you choose “Allow analytics”, Google Analytics sets cookies and records the pages you visit, your device and browser type and your approximate location from your IP address, so we can see how the site is used. If you choose “No thanks” it is not loaded. You can change your choice at any time with “Cookie settings” in the footer.
- Search. The words you type into the site search are sent to our server to find results. They appear in our technical logs and a short-lived cache (about ten minutes); we do not use them to build a profile of you.
- We do not use advertising cookies or sell your information.
When you create an account
- Your name, email address, username and password (stored in hashed form), plus anything you choose to add to your profile.
- Listings you bookmark, listings or areas you follow, searches you save, anything you submit or update, and messages you send through the site.
When you add or claim a listing
- Details of the organisation, your role, contact details and any evidence you send to show you are entitled to manage the listing.
When you contact us
- Your name, email address and the content of your message.
When you use the chat assistant or AI Studio tools
- The text you type is sent to third-party AI model providers so that a reply can be generated, and conversations may be stored so we can improve the service and deal with misuse.
- Please do not enter personal, medical or patient-identifiable information into the chat assistant or AI tools.
3. Information about care providers in the directory
Directory listings are built from the public register of the Care Quality Commission (CQC), used under the Open Government Licence v3.0, and are refreshed regularly. Listings show organisation names, service addresses, public telephone numbers, websites and CQC ratings. Where a provider is a sole trader or a partnership, the business name may identify a person. We process this information on the basis of our legitimate interest in helping the public find and compare regulated services.
If you run a listed service and something is wrong, tell us through the contact page. We correct our own errors promptly; details that come from the CQC register must also be corrected with the CQC, or they will reappear at the next refresh.
4. Why we use your information and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Providing your account and the features you ask for | Performance of a contract |
| Running, securing and improving the site; preventing misuse; answering enquiries; publishing the directory | Legitimate interests |
| Analytics cookies (Google Analytics), optional features you switch on, and any marketing emails | Consent, which you can withdraw at any time |
| Keeping records the law requires | Legal obligation |
5. Who we share information with
- Hosting, content delivery and email: our web hosting provider, which also delivers our email.
- Analytics: Google (Google Analytics), only if you allow analytics cookies.
- AI model providers: text entered into the chat assistant or AI Studio tools is processed by providers such as OpenAI, Anthropic and Google to generate a response.
- Map tiles: maps load images from OpenStreetMap servers, which receive your IP address in order to send them.
- Payment providers: if paid services are offered, payment is handled by the payment provider and we do not store card details.
- Advisers and authorities: professional advisers, and regulators or law enforcement where the law requires it.
We do not sell personal information.
6. Transfers outside the UK
Some of the providers above, including Google and the AI model providers, process information outside the United Kingdom. Where that happens we rely on UK adequacy regulations or on appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. How long we keep information
- Account information: for as long as your account is open. You can ask us to delete it at any time.
- Enquiries: for as long as needed to deal with your enquiry and for a reasonable period afterwards in case of follow-up.
- Chat and AI tool conversations: for a limited period for service improvement and misuse prevention, then deleted or anonymised.
- Analytics data: held in our Google Analytics account for the retention period we set there, and only for visitors who allowed analytics.
- Technical logs: for the period set by our hosting provider.
8. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information;
- ask us to restrict, or object to, how we use it;
- ask for your information in a portable format;
- withdraw consent where we rely on it.
To use any of these rights, email contact@docorix.com or send a request through the contact page and choose “Privacy or data request”. We will reply within one month. We may need to check your identity first. There is no charge.
If you are unhappy with how we have handled your information, please tell us first through the contact page (choose “Privacy or data request”) or by email. We will acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.
9. Children
Docorix accounts are for people aged 18 or over. We do not knowingly collect information from children.
10. Security
We use encrypted connections (HTTPS), hashed passwords, access controls and regular software updates. No website can be guaranteed completely secure, so please use a strong, unique password.
11. Changes to this policy
We will update this page when our practices change and revise the date at the top. Significant changes will be highlighted on the site.