Privacy Policy

INTRODUCTION

This Privacy Policy explains how Novamedica Limited ("we", "us", "our"), trading as The GP Service, collects, uses, stores and protects your personal information when you use our website, mobile applications or associated services (together, the "Platform").

We are committed to protecting your privacy and handling your data lawfully, transparently, and in accordance with UK GDPR, the Data Protection Act 2018, and the common-law duty of confidentiality that applies to health information.

This Privacy Policy should be read alongside our Terms and Conditions, Cookie Policy and Acceptable Use Policy.

1. WHO WE ARE — THE DATA CONTROLLER

1.1 Novamedica Limited is the data controller for the personal information we collect and process about you through the Platform.

1.2 Our registered details:

• Company name: Novamedica Limited (trading as The GP Service)

• Company number: 16437130

• Registered office: The Dock, 75 Exploration Drive, Leicester, LE4 5NU

• ICO registration: ZB938258

1.3 How to contact us about privacy:

• Email: support@thegpservice.co.uk

• Phone: 024 7745 0727

• Post: Data Protection Queries, Novamedica Limited, The Dock, 75 Exploration Drive, Leicester, LE4 5NU

1.4 Data protection responsibility. We have appointed a person responsible for data protection compliance within Novamedica Limited. You can contact them using any of the contact details above.

2. OTHER CONTROLLERS — THE CLINICIANS

2.1 When you book and attend a consultation, the treating clinician is an independent data controller for the clinical records they create about you. This reflects the clinician's independent professional responsibility for their clinical decisions.

2.2 We and the clinician act as joint controllers in certain limited respects — specifically, the maintenance of your electronic Patient Record that supports continuity of your care. Our respective roles are:

• We operate the Platform, hold the Patient Record infrastructure, and are responsible for the security, availability and integrity of that record;

• The clinician is responsible for the clinical content they create during your consultation, and for clinical decisions recorded;

• Either of us may be contacted in respect of your data rights. Where the request relates specifically to clinical content, we will normally direct the request to the clinician.

2.3 Each clinician accepting consultations through the Platform is registered with a UK professional regulator (for example, GMC, GPhC, NMC or HCPC) and carries their own professional indemnity insurance.

3. WHAT PERSONAL DATA WE COLLECT

We collect several categories of personal data about you. We collect only what is necessary for the purposes set out in section 5.

3.1 Information you give us when you register:

• Full name, date of birth, gender

• Home address and postcode

• Email address and mobile phone number

• Photo identification details (passport or driving licence) for identity verification

• Emergency contact details (optional)

3.2 Information you give us when you book and attend a consultation:

• Reason for consultation and presenting symptoms

• Relevant medical history, current medications, allergies, lifestyle factors

• Photographs or documents you upload to support your consultation

• Preferred consultation format (video or telephone)

3.3 Information the clinician records during and after your consultation:

• Diagnoses and clinical impressions

• Prescriptions issued

• Fit notes and referral letters

• Clinical notes and consultation summary

3.4 Special category health data. The information described in 3.2 and 3.3 is "special category data" under UK GDPR — it concerns your health. We apply additional safeguards to this data (section 7).

3.5 Payment information. When you pay for a consultation or other service, our payment processor (Stripe) collects your card details. We do not store full card details on our systems — we store only a secure token, transaction reference and amount.

3.6 Technical data about your use of the Platform:

• IP address, device identifiers, browser type and version

• Operating system and device type

• Pages visited on our website and time spent

• Features used within the Platform

3.7 Communication data:

• Email, SMS and WhatsApp messages you exchange with us

• Customer support queries and responses

3.8 We do not record video consultations. Video and audio during consultations are streamed live between you and the clinician and are not recorded or stored by us. The clinician's written notes are the only record retained.

4. WHERE WE GET YOUR DATA FROM

Most of the personal data we hold comes directly from you. We may also receive information from:

• The clinician treating you — who adds clinical notes, diagnoses, prescriptions and referrals to your Patient Record

• Our pharmacy partner — where you choose to have a prescription dispensed and delivered through our pharmacy partner, they share order, dispensing, and delivery information with us

• Stripe — payment confirmation and failed-payment information

• Identity verification providers — where we use an electronic identity verification service to confirm your identity

• Your device — technical data via cookies and similar technologies (see Cookie Policy)

5. WHY WE USE YOUR DATA AND OUR LAWFUL BASIS

Under UK GDPR, we must have a lawful basis for every way we use your personal data. For special category health data, we also need a specific additional condition under Article 9.

Where we rely on legitimate interests, we have carried out an assessment to balance those interests against your rights. You can ask us for a summary of that assessment.

Where we rely on consent (for example, marketing), you can withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

6. WHO WE SHARE YOUR DATA WITH

We share your personal data only where necessary, and only with parties who are subject to appropriate confidentiality and data protection obligations.

6.1 The clinician treating you. The clinician needs access to your medical history, booking details, and consultation information to provide safe care. Clinicians are bound by their professional duty of confidentiality and their regulator's standards.

6.2 Our pharmacy partner. Where you choose dispensing and delivery through our pharmacy partner, we share: your name, delivery address, contact details, and the prescription issued by the clinician. The pharmacy partner is an independent data controller for the dispensing service it provides.

6.3 Our service providers (processors). We use a small number of trusted third-party providers to operate the Platform. Each is contractually bound to process your data only on our instructions and with appropriate security measures:

6.4 Professional regulators and authorities. We may share data where required by law — for example, in response to a lawful request from the General Medical Council, the General Pharmaceutical Council, the ICO, police, courts, or other competent authority; or to defend a legal claim.

6.5 Safeguarding. Where we or a clinician have a genuine concern about the safety of you or another person, we may share information with appropriate authorities in line with statutory safeguarding guidance.

6.6 Business transfers. If Novamedica Limited is sold, merged, or reorganised, your data may be transferred to the acquirer or successor entity — subject to the same protections as under this Privacy Policy, and subject to any applicable regulatory requirements for the transfer of medical records.

6.7 We do not sell your data. We do not sell personal data to third parties, and we do not share your data for third-party marketing.

7. HOW WE PROTECT YOUR DATA

7.1 Security measures. We take your data security seriously. Our safeguards include:

• Encryption of data in transit (TLS 1.2 or higher) and at rest

• Role-based access controls — clinicians, staff and processors access only what they need

• Multi-factor authentication for clinician and staff accounts

• Security monitoring, logging, and vulnerability testing

• Physical and logical security of AWS UK hosting infrastructure

• Staff training in data protection and information governance

7.2 Special measures for health data. Because health data is sensitive, we apply additional controls — including restricted access to clinical records, audit logging of access to Patient Records, and clinical governance oversight.

7.3 No system is perfectly secure. If a data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware, and will notify you promptly if the breach is likely to result in a high risk to you.

8. WHERE YOUR DATA IS STORED AND INTERNATIONAL TRANSFERS

8.1 UK hosting. Your core personal data — including your Patient Record, account information, and consultation records — is hosted on Amazon Web Services in the UK region. It does not ordinarily leave the UK.

8.2 Limited international transfers. Some of our service providers process limited technical data (e.g. IP address, device identifiers, analytics events) outside the UK — principally in the United States:

• Google Analytics, Meta Pixel, Hotjar — these providers process website analytics data in the United States.

• Stripe — may transfer limited payment metadata to the United States.

• Meta (WhatsApp Business API) — messaging data may be processed outside the UK.

8.3 Safeguards for international transfers. Where personal data is transferred outside the UK, we rely on one or more of the following safeguards:

• UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses

• UK adequacy regulations where the destination country has been assessed as providing adequate protection

• Additional technical and organisational measures where appropriate (e.g. pseudonymisation of analytics identifiers)

8.4 You can request further information on our international transfer safeguards by contacting support@thegpservice.co.uk.

9. HOW LONG WE KEEP YOUR DATA

We keep your personal data only as long as necessary for the purposes we collected it for, and in line with legal and regulatory retention standards.

After the retention period, data is either securely deleted or irreversibly anonymised.

10. YOUR RIGHTS

Under UK GDPR you have the following rights. You can exercise any of these rights by contacting support@thegpservice.co.uk.

10.1 Right of access. You have the right to request a copy of the personal data we hold about you, and information about how we process it. We will normally respond within one month.

10.2 Right to rectification. You have the right to ask us to correct inaccurate or incomplete personal data. For clinical content, we may need to check with the clinician — we cannot change a clinical record retrospectively but can record your disagreement alongside it.

10.3 Right to erasure ("right to be forgotten"). You have the right to ask us to delete your personal data in certain circumstances. This right is limited for medical records — we are required to retain Patient Records for the period described in section 10.

10.4 Right to restriction. You have the right to ask us to restrict processing of your data in certain circumstances (e.g. while we investigate an accuracy complaint).

10.5 Right to data portability. Where we process your data based on consent or contract and by automated means, you can ask us to provide it in a structured, commonly-used, machine-readable format.

10.6 Right to object. You can object to processing based on legitimate interests, and to processing for direct marketing at any time.

10.7 Right to withdraw consent. Where we rely on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

10.8 Rights in relation to automated decision-making. We do not make automated decisions that produce legal or similarly significant effects about you.

10.9 How to exercise your rights. Email support@thegpservice.co.uk. We will respond within one month. We may need to verify your identity before responding to protect your data. In most cases we will not charge — but we may charge a reasonable fee or refuse repetitive or excessive requests.

10.10 Right to complain to the ICO. You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator. We would appreciate the chance to address your concerns first, but you can contact the ICO at any time:

• Website: ico.org.uk

• Phone: 0303 123 1113

• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

11. MARKETING

11.1 We will only send you marketing communications (by email or SMS) if you have given us your explicit opt-in consent at the point of registration or later.

11.2 What marketing may include: service updates, new Platform features, wellness content, and occasional promotional offers relating to services we offer.

11.3 Unsubscribing. You can withdraw marketing consent at any time by:

• Clicking "unsubscribe" in any marketing email

• Replying STOP to any marketing SMS

• Updating preferences in your account

• Emailing support@thegpservice.co.uk

11.4 Service messages are different. Even if you opt out of marketing, we will continue to send you essential service messages — booking confirmations, appointment reminders, prescription notifications, account security alerts, and legal or regulatory notices. These are not marketing and you cannot opt out while you hold an active account.

12. COOKIES AND TRACKING TECHNOLOGIES

Our Platform uses cookies and similar tracking technologies. For details of which cookies we use, the purposes, and how to manage your cookie preferences, please see our Cookie Policy.

In summary, we use:

• Strictly necessary cookies — required for the Platform to function

• Analytics cookies — Google Analytics, Hotjar (set only with your consent)

• Marketing cookies — Meta Pixel and similar (set only with your consent)

You can manage cookie preferences via our cookie banner or your browser settings.

13. CHILDREN

The Platform is for adults aged 18 and over only. We do not knowingly collect personal data from anyone under 18. If we discover that we have inadvertently collected data from someone under 18, we will delete it promptly.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. Where we make material changes, we will notify you by email or through a notice on the Platform. The "Last updated" date at the top of this Privacy Policy shows when it was most recently revised. Continued use of the Platform after an update indicates your acceptance of the revised Policy.

15. DEFINITIONS

"Data controller" — the party that decides the purposes and means of processing personal data.

"Data processor" — a party that processes personal data on behalf of a controller.

"Patient Record" — the electronic record we maintain of your interactions with the Platform, including clinical information recorded by clinicians.

"Personal data" — any information relating to an identified or identifiable living person.

"Special category data" — under UK GDPR, data concerning health, racial or ethnic origin, religion, sexuality, biometric or genetic identifiers, or trade union membership. Health data is the most relevant category here.

"UK GDPR" — the UK General Data Protection Regulation, as incorporated into UK law.