Partner Practitioner Privacy Notice

1. Overview

Partner Practitioners are committed to protecting your personal data. The identity of the healthcare professional who is responsible for your personal data (Partner Practitioner) will be provided to you during each of your consultations through Venture Startups Limited’s (Updoc) technology platform (Updoc Platform).

This Privacy Notice (Privacy Notice) explains how Partner Practitioners (we, us, or our) process your personal data when we provide healthcare related services to you (Services) through the Updoc Platform. It also outlines the rights and choices that you have regarding your personal data under the Data Protection Act 2018 and the UK General Data Protection Regulation (Data Protection Laws).

2. How do we collect your personal data?

We manage your personal data as a controller, for the purposes set out below. These purposes relate to our Services to you.

The way that we collect personal data from you depends on our relationship with you. From your initial interaction with us during our consultation, we collect personal data from you (voluntarily or automatically) as well as from third parties such as your regular GP or healthcare practitioner. We also receive personal data about you from Updoc, including in relation to your request for our Services.

3. What is the role of Partner Practitioners?

We, as Partner Practitioners, are medical practitioners that are registered with the General Medical Council or healthcare professionals registered with other relevant authorities in the UK. We are responsible for providing you with certain healthcare services, and we process your personal data for our own independent purpose of providing these healthcare services to you.

4. What is the role of Updoc?

We provide our Services to you through the Updoc Platform. Updoc is an online digital healthcare platform that facilitates your consultations with us. Importantly, Updoc manages your personal data as a separate and independent controller in accordance with its own data privacy policies and processes.

If you have any questions about how Updoc processes your personal data, please refer to Updoc’s Privacy Notice for more information.

We, as Partner Practitioners, remain solely responsible for the provision of our Services to you.

5. What types of personal data do we collect?

We collect different types of personal data from you depending on your interactions with us.

If you choose not to provide personal data to us, or do not provide us with accurate personal data, you may not be able to receive the Services or we may not be able to undertake certain activities for you.

We may collect the following personal data:

Patient of Partner Practitioner

Category	Examples
Identity	Your full name, date of birth, gender and NHS number.
Contact details	Your residential address, email address and telephone number.
Health data*	Your symptoms, desired outcome, medical history (including, allergies, hereditary issues, pre-existing health conditions and prescription medications), name and contact details of your regular general practitioner (GP) (if applicable) and any other information you provide to us through the health questionnaire provided to you through the Updoc Platform. Any information that you provide to us through the Updoc Platform, or that may be recorded (including photos and documents that you upload for our review, questions that you ask us, our responses and any of our notes that we write or that are transcribed). Details of any services and products that you engage with and purchase (including details of any medications that have been prescribed by us (as applicable)). Any other health-related information that you choose to provide us. *Health data constitutes ‘special category data’, meaning that these data are considered sensitive.
Feedback	Feedback that you provide to us as a part of any complaints or queries.
Other data	Any other information that you choose to provide to us.

6. How do we use your personal data?

Here are the purposes for which we process your personal data, along with the legal basis that we rely on for such processing:

Purpose	Legal Basis
Provision of healthcare services, including: reviewing your request for Services. conducting remote consultations. providing the outcome of your consultation, such as a medical letter or certificate. locating NHS records or reaching out to your GP.	It is in our legitimate interest to provide healthcare services and for you to receive such services. Where we process health data, we rely on the provision of health or social care or treatment or the management of health or social care systems.
Sharing your personal data with Updoc and/ or third party pharmacies that have a contractual relationship with Updoc (Partner Pharmacies) for the purposes of facilitating our provision of Services, prescription fulfilment, and quality assurance and training.	It is in our legitimate interest to provide healthcare services and for you to receive such services. Where we process health data, we rely on the provision of health or social care or treatment or the management of health or social care systems.
Addressing your questions or complaints.	It is in our legitimate interest to address your complaints and queries, as part of our provision of healthcare services to you. Where we process health data, we rely on the provision of health or social care or treatment or the management of health or social care systems.
Compliance with our legal and regulatory obligations, including applicable record-keeping requirements.	Compliance with our legal obligations. To the extent we process your health data for these purposes, this is on the basis of (i) public interest in the area of public health, such as ensuring high standards of quality and safety of healthcare, or (ii) and the establishment, exercise or defence of legal claims. If we are unable to rely on (i) or (ii), we will obtain your explicit consent instead.
For our legal purposes, including to enforce, protect or get advice on our rights or obligations, exercising or defending claims and regulatory authority checks and requirements.	It is in our legitimate interest to protect and enforce our legal rights and claims. To the extent we process your health data for these purposes, this is for the establishment, exercise or defence of legal claims.

7. Who do we share your data with?

We only share your personal data where we have appropriate safeguards in place and we consider it necessary for the purposes outlined in this Privacy Notice. We may share your personal data with the third parties set out below:

• Updoc – we share your personal data with Updoc to facilitate consultations via the Updoc Platform between you and us, including storing personal data, recording consultations and providing outcomes to you such as medical letters or certificates.
• Your regular GP or healthcare practitioner – we provide your personal data (including your health data) to your regular GP or health practitioner, but only when you have explicitly requested that we do so.
• Partner Pharmacies – we may provide your personal data to pharmacies in the UK that may dispense, package and deliver your prescription.
• Third party service providers – we share your personal data with third parties that we rely on to assist with the provision of the Services to you (for example, cloud service providers) and to assist us with our business (for example, medical indemnity insurance providers).
• Authorities – we may share your personal data with legal and regulatory authorities at their request or, to comply with a legal obligation, or for the establishment, exercise or defence of legal claims.

Other than as listed above, we will only disclose your personal data when you direct or give us permission, when we are required by applicable law, or when we suspect fraudulent or criminal activities.

We do not sell your personal data to third parties for marketing purposes.

8. International transfers

Updoc may transfer your personal data to countries outside of the UK. They may disclose personal data to their Group Entities, as well as certain third-party service providers located in Australia, the United States, Europe and the United Kingdom.

Some of these countries may not offer the same level of data protection as the applicable Data Protection Laws. Where this is the case, they enter into appropriate contractual safeguards with third parties in such countries to protect your privacy rights and the integrity of your personal data when they transfer it out of the UK (including, where required, by entering into the UK standard contractual clauses).

Please see Updoc’s Privacy Notice for more information.

9. How do we store and secure your personal data?

We generally store your personal data in the Updoc Platform which uses secure cloud systems using Amazon Web Services. Please see Updoc’s Privacy Notice for more information.

We have appropriate organisational measures in place to manage and store your personal data securely. Your personal data is important to us, so we make sure that we take reasonable steps to protect your personal data.

10. How long do we store your personal data?

We retain your personal data for as long as is required for the permitted purposes (outlined above), or for longer if otherwise required by law.

When determining retention periods, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised disclosure or the use of the personal data, the purposes for which we collect the personal data and any other applicable legal, tax, accounting or other regulatory requirements.

11. Your data protection rights

You have various rights concerning the personal data that we hold about you. However, these rights are subject to limitations and restrictions under Data Protection Laws. We will tell you when any of these limitations or restrictions apply.

Your rights under this Privacy Notice include:

• Access - you may request access to the personal data we hold about you. In some instances, reasonable charges may apply for us to provide copies of such data.
• Correction - you have the right to request that we correct any personal data that we hold about you which you believe is inaccurate.
• Erasure - you may have the right to request that we delete your personal data.
• Restriction of processing - you may have the right to request that we restrict the processing of your personal data.
• Object to processing – in certain circumstances, you have the right to object to the processing of your personal data.
• Data portability – you can request that we send the data that we have collected to another organisation, or directly to you, under certain conditions and in a format that can be read by a computer.
• Withdrawal of consent - if you have given us your consent for the processing of your personal data you may withdraw your consent at any time with future effect. If you withdraw your consent, this does not affect the lawfulness of processing based on your consent before you withdrew consent. If you withdraw your consent, we will promptly delete the relevant data unless there is another legal ground permitting or requiring us to retain and continue processing such data.

If you make any one or more of the requests above, you will be required to verify your identity. Please send a description of your personal data in writing stating your name and your relationship with us to privacy@updoc.uk. We may require proof of identity to verify your request and to protect personal data from unauthorised access. We will carefully consider your request and will deal with your request without undue delay and within the time limits provided under Data Protection Laws.

If you feel that we have not complied with this Privacy Notice or with applicable Data Protection Laws, please send your complaint to privacy@updoc.uk. You also have the right to make a complaint to the ICO as directed on their website (www.ico.org.uk).

12. Changes to this Privacy Notice

From time to time, we may make changes to this Privacy Notice, including how we process your personal data – taking into account new laws, regulations and technology. Please visit our service provider’s website (www.updoc.uk) and locate the Partner Practitioner Privacy Notice to obtain a copy of the latest version of this Privacy Notice at any time.