Privacy Policy

1. Who we are

Medacy Limited is a health technology company. We are the data controller for the personal information described in this notice — which means we are responsible for deciding how and why your information is used.

2. What information we collect about you

We only collect personal information that is necessary. Depending on how you use our services, this may include:

Basic details

• Your name, date of birth and gender

• Contact information: email address, postal address and telephone number

• Account login details (passwords are encrypted and never readable by us)

Health and medical information

This is sensitive information. We treat it with the highest care and only collect it where essential to provide your care or service.

• Medical history, diagnoses and symptoms

• Prescriptions and medication information

• Referral and consultation records

• Information shared by NHS providers or other clinicians involved in your care

Financial information

• Payment details for services (processed securely; we do not store full card numbers)

• Billing address and transaction history

Technical information

• IP address, browser type and device information when you use our website or app

• Pages visited, time spent, and how you navigate our services

• Cookie data (see Section 8)

Information from others

We may receive information about you from NHS bodies, other healthcare providers, or third parties where you have given consent or where the law allows.

3. Why we use your information and our legal basis

UK data protection law requires us to have a valid lawful basis before we use your personal information. The table below sets out what we use your information for, and why we are legally permitted to do so.

Where we rely on legitimate interests, we have assessed that our interests do not override your rights. You have the right to object — see Section 6.

Where we rely on consent, you may withdraw it at any time by contacting us. Withdrawal does not affect anything we did before you withdrew.

4. Who we share your information with

We do not sell your personal information. We share it only where necessary, and always with appropriate safeguards.

Healthcare and NHS organisations

We share clinical information with NHS bodies, hospitals, GPs and other healthcare professionals directly involved in your care, where required or permitted by law.

Service providers (data processors)

We use trusted third-party companies to help us run our services — for example, cloud hosting, payment processing, and IT support. These companies act only on our instructions and are bound by data processing agreements.

Regulators and public authorities

We may share information with the ICO, MHRA, CQC, HMRC or law enforcement where we are required to do so by law or court order.

Professional advisers

Our lawyers, accountants and auditors may access your information where necessary, and are bound by professional confidentiality obligations.

Business transfers

If Medacy is involved in a merger, acquisition or sale, your information may be transferred. We will notify you if this affects your data and ensure appropriate protections are in place.

5. How long we keep your information

We keep your personal information only for as long as necessary. Our retention periods are guided by:

• NHS Records Management Code of Practice: typically 8 years for adult health records, or until age 25 for children’s records

• Financial records: 6 years under UK tax and company law

• Marketing consent records: until you withdraw consent, plus a reasonable period thereafter

• Website technical data: typically 12 months

When information is no longer needed, we securely delete or anonymise it.

6. Your rights

UK data protection law gives you a number of rights over your personal information. These are summarised below.

To exercise any right, please contact us at privacy@medacy.co.uk. We will respond within one month. This is free of charge in most cases.

7. How we protect your information

We take security seriously and have put in place appropriate technical and organisational measures, including:

• Encryption of data in transit and at rest

• Strict access controls — staff only access data they need for their role

• Multi-factor authentication for our systems

• Regular security testing and staff training

• A documented process for responding to security incidents

If there is ever a data breach that is likely to affect your rights or freedoms, we will notify the ICO within 72 hours and tell you directly where required.

8. Cookies

Our website uses cookies — small files placed on your device — to make the site work, remember your preferences, and understand how people use our services. You can control cookies through our cookie consent tool or your browser settings.

For full details, please see our Cookie Policy at www.medacy.co.uk/cookies.

9. Transfers outside the UK

We aim to keep your data within the UK. If we ever need to transfer information to another country, we will ensure appropriate safeguards are in place — such as UK International Data Transfer Agreements — to give your data the same level of protection it has here.

10. Children

Where we provide services that involve children under 13, we take additional steps to protect their information in line with the ICO’s Children’s Code. Parents and guardians can exercise data rights on behalf of their children by contacting us.

11. Changes to this notice

We may update this notice from time to time. When we make significant changes, we will let you know — by email, or by a notice on our website. The date at the top of this page always shows when it was last updated.

12. Complaints

If you are unhappy with how we have handled your information, please contact us first — we would like the chance to put things right.

You also have the right to complain to the Information Commissioner’s Office (ICO) at any time:

• Website: www.ico.org.uk

• Helpline: 0303 123 1113

• Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF