Privacy policy
Reviewer privacy comes first
Cambridge Medical Partners operates GP Trusted Tools and is the data controller. This section explains the information the service expects to process when review submission opens and the principles that govern its use.
Information associated with a review
A submission may include a private email address, a chosen public display name, rating, review text, professional role, selected practice, practice-size band, setting, clinical system, UK nation and length of use. Authoritative practice information may be used to derive contextual attributes. Limited technical information may be processed where necessary to secure the service and prevent spam or abuse.
How information is used
Information may be used to receive and verify submissions, contact reviewers where necessary, moderate and publish approved reviews, protect the service, improve its operation, investigate concerns, and produce statistics, research and commercial insights. Public output is limited to approved review content and deliberately selected, privacy-reduced context.
Research, benchmarking and commercial insight products will use aggregated or effectively anonymised information unless a separate lawful and transparent arrangement permits otherwise. Direct identifiers, reviewer contact details, exact reviewer-practice relationships and private moderation information will not be sold or licensed for unrelated third-party marketing.
Practice and identity privacy
Combinations of contextual details may identify someone even without their name. Public information is therefore minimised and banded. Exact practice relationships are treated as potentially identifying personal information, and uncommon combinations may be suppressed or grouped.
Retention and withdrawal
Review information may be retained indefinitely so that published experiences and their context remain useful, unless deletion is requested or continued retention is no longer necessary or lawful. Requests are assessed against applicable obligations and any legitimate need to retain limited security, moderation, legal or audit records.
Direct identifiers may later be separated from older reviews. If the link can still be restored, the information is pseudonymised and remains personal data. If identifying links are irreversibly removed and re-identification is no longer reasonably possible, appropriately minimised review and demographic information may be retained and used as anonymised information.
Service providers, partners and business transfers
Necessary information may be processed by contracted hosting, database, security, communications, analytics and professional-service providers under appropriate safeguards. Before introducing a materially different partner or purpose, GP Trusted Tools will assess the lawful basis, compatibility, security and transparency requirements.
Information may be disclosed under confidentiality to bona fide investors, purchasers and professional advisers during financing, restructuring, acquisition or sale discussions. If the platform or operating business transfers to another controller, the transfer will be subject to data-protection due diligence, appropriate safeguards and any required notice. A new owner does not receive unrestricted permission to repurpose personal information.
Rights, cookies and marketing
Requests concerning access, correction, objection, restriction, withdrawal or deletion can be sent to gptools@cambridgemedicalpartners.com. The response will depend on the request and applicable law.
The site aims to minimise cookies and tracking. Any non-essential analytics, advertising, personalisation or direct-marketing technology will be assessed and explained before it is introduced, with consent or another lawful basis used where required.
Lawful-basis assessment — 27 September 2026
Lawful bases for reviewer information
Controller
Cambridge Medical Partners operates GP Trusted Tools and acts as the data controller for reviewer information.
Receiving, validating and moderating reviews
The legitimate interests are:
- operating a trustworthy independent review service for UK general practice;
- checking that submissions come from people with access to an accepted NHS email address;
- preventing spam, impersonation and manipulation;
- protecting reviewers, suppliers, readers and the service;
- investigating concerns and maintaining an accountable moderation record.
The processing is initiated by the reviewer, limited to information needed to validate and moderate the contribution, and subject to human review, restricted access and clear privacy information.
A documented legitimate-interests assessment should test:
- whether the processing genuinely supports these purposes;
- whether each item of personal information is necessary;
- whether the reviewer’s rights and reasonable expectations override the stated interests.
Email verification
The accepted NHS email address (@nhs.net or @nhs.uk) is used to send a short-lived verification code, associate the verified address with the private submission record, prevent repeated abuse and contact the reviewer when moderation genuinely requires clarification.
Verification does not establish that the reviewer is acting on behalf of the NHS, their employer or their practice. It must not be presented publicly as NHS endorsement.
Publishing an approved contribution
The reviewer asks GP Trusted Tools to consider and publish their contribution under the contributor terms. Only the approved review text, chosen display name and deliberately reduced contextual fields may be published.
If contract is not considered the appropriate basis after legal review, legitimate interests should be assessed as the alternative. Consent should not be described as the basis merely because the form contains a required privacy acknowledgement.
Security, fraud prevention and legal claims
Limited technical and moderation records may be processed to secure the service, investigate misuse, respond to legal complaints and establish, exercise or defend legal claims.
Responding to data-protection requests
Information may be processed to identify the requester, locate relevant records and respond to access, correction, restriction, objection or deletion requests.
Optional marketing or research invitations
Submitting a review must not automatically subscribe the reviewer to marketing or unrelated research. Any optional consent must be separate, specific and as easy to withdraw as to give.
Special-category information
The form does not ask for patient information, health information, ethnicity, trade-union membership or other special-category information.
Reviewers are instructed not to include patient-identifiable or confidential information. If unexpected special-category information is submitted, the review should be quarantined for human assessment and must not be published without a separately documented lawful condition.
Contributor terms
Rights in submitted reviews
Reviewers retain ownership of their original writing. By submitting a contribution, the reviewer grants Cambridge Medical Partners a non-exclusive, worldwide, royalty-free, transferable and sublicensable licence to store, verify, moderate, publish, reproduce, distribute and display the contribution in connection with GP Trusted Tools and related services.
The licence permits inclusion in websites, applications, reports, research, APIs, licensed datasets and other free or paid products; statistical analysis and aggregation; and transfer with the platform or operating business. It also permits proportionate editing for spelling, formatting, accessibility, privacy and legal safety. The reviewer’s meaning will not be materially changed without their explicit instruction.
A reviewer may request withdrawal from public display. Withdrawal does not necessarily require immediate deletion from backups, security records or proportionate moderation and legal audit trails, and does not reverse uses already lawfully completed. Personal information remains subject to the privacy policy and applicable rights.
Contributor responsibilities
- Describe your own genuine experience and provide accurate context.
- Do not include patient-identifiable, confidential or unlawfully obtained information.
- Declare supplier, employment, financial or other material conflicts.
- Do not submit content that infringes another person’s rights.
Moderation policy
Every review is checked by a human
No new review is published automatically. Each submission is assessed for indications of genuine first-hand use, privacy risks, conflicts, spam, abuse and legal or safety concerns.
Content that is not allowed
- Patient-identifiable, confidential or private information.
- Reviews not based on genuine first-hand use.
- Abusive, threatening, discriminatory or potentially defamatory material.
- Unsupported allegations about identifiable people.
- Vendor-authored or incentivised reviews presented as independent experience.
- Marketing, impersonation, manipulation, spam or off-topic submissions.
A submission may be approved, rejected, withdrawn or held for more information. Legitimate criticism is not removed merely because it is negative. Reviews are not materially rewritten without the reviewer’s explicit instruction.
Suppliers and readers may report concerns, but a report does not guarantee removal. Supplier responses and other supplier-authored material must be clearly labelled. Suppliers cannot edit, hide or buy the removal of legitimate independent reviews.
Editorial policy
Commercial support cannot buy editorial judgement
Commercial relationships must not determine ratings, evidence labels, comparisons or moderation decisions. Paid placement must never be presented as independent editorial judgement, and suppliers do not receive access to private reviewer identity or moderation information.
Inclusion does not establish NHS approval or endorsement, accreditation, clinical validation, compliance, procurement eligibility or clinical-system integration. Such claims require an appropriate source and clear qualification. Product information, supplier statements, editorial analysis and reviewer experiences remain visibly distinct.
Material errors will be corrected transparently. A supplier may provide evidence and request a factual correction, but cannot control editorial conclusions or suppress genuine criticism.
Commercial standards
Future revenue must be visible and bounded
GP Trusted Tools may in future earn revenue from subscriptions, enhanced supplier profiles, sponsorship, advertising, affiliate or referral arrangements, research, benchmarking, commercial reports, catalogue or API licensing, enterprise services, white-label services, and sale or investment in the platform or operating business.
Advertising, sponsorship, affiliate links, paid profiles and supplier-funded material will be labelled clearly enough for users to recognise their commercial nature. Payment will not improve a rating, guarantee favourable coverage, determine moderation, or purchase removal of a legitimate review. A paid profile will not imply endorsement.
Aggregated or effectively anonymised insights may be sold or licensed after disclosure risk has been assessed. Pseudonymised individual-level records will continue to be treated as personal information where re-identification remains possible.
General site terms
Using the catalogue
Catalogue information and reviews are provided for general information. Reviews represent their contributors’ personal opinions, not recommendations by GP Trusted Tools. Users remain responsible for procurement, information-governance, regulatory and clinical-safety decisions.
The site and its content are provided without a guarantee of completeness, continuous availability or suitability for a particular purpose. To the extent permitted by law, Cambridge Medical Partners is not responsible for losses arising from reliance on catalogue information or reviews.
Cambridge Medical Partners may assign these terms and the associated content licences as part of a genuine transfer, restructuring or sale of the platform or operating business. These terms are intended to be governed by the law of England and Wales.
Contact and changes
Questions, reports and policy updates
Questions, privacy requests, review reports and correction requests can be sent to gptools@cambridgemedicalpartners.com. Please avoid including unnecessary personal or patient information.
Policies may be updated as the service, law and commercial model develop. Material changes affecting personal-data use, moderation, editorial independence or commercial influence require owner approval and will be communicated where applicable.