Privacy Notice

1. Overview

Updoc is committed to protecting your personal data. This Privacy Notice (Privacy Notice) explains how Venture Startups Limited (Updoc, we, us, or our) processes your personal data, and the rights and choices that you have regarding your personal data under the Data Protection Act 2018 and the UK General Data Protection Regulation (Data Protection Laws).

This Privacy Notice, together with the Terms & Conditions, cover your use of the Updoc Platform. It is important that you take time to read each document.

Capitalised terms that are not defined in this Privacy Notice have the same meaning given to them in the Terms & Conditions.

2. How do we collect your personal data?

Updoc manages your personal data as a controller, for the purposes set out below. These purposes relate to providing you with access to the Updoc Platform.

The way that we collect personal data from you depends on our relationship with you. From your initial interaction with Updoc, we collect personal data from you (voluntarily or automatically) as well as from third parties such as your Partner Practitioners and through online marketing sources.

3. What is the role of Partner Practitioners?

Partner Practitioners are medical practitioners that are registered with the General Medical Council or other relevant authorities in the UK. They are responsible for providing you with certain healthcare services, and they process your personal data for their own independent purpose of providing these healthcare services to you. Importantly, Partner Practitioners manage your personal data as separate and independent controllers in accordance with their own data privacy policies and processes.

If you have any questions on this, please refer to the Partner Practitioner’s Privacy Policy for more detail.

4. What types of personal data do we collect?

We collect different types of personal data from you depending on our relationship with you, as well as your interactions with us.

If you choose not to provide personal data to us, or do not provide us with accurate personal data, you may not be able to receive the Services, experience certain features of the Updoc Platform or we may not be able to undertake certain activities for you.

We may collect the following personal data:

Patient of Partner Practitioner

Category	Examples
Identity	Your full name, date of birth, gender and NHS number.
Contact details	Your residential address, email address and telephone number.
Health data*	Your symptoms, desired outcome, medical history (including, allergies, hereditary issues, pre-existing health conditions and prescription medications), name and contact details of your regular general practitioner (GP) (if applicable) and any other information you provide to us through the health questionnaire provided to you through the Updoc Platform. Any information that you provide to a Partner Practitioner through the Updoc Platform, or that we, or they, may record (including photos and documents that you upload for their review, questions that you ask them, their responses and any of their notes that they write or that are transcribed). Details of any services and products that you engage with and purchase (including details of any medications that have been prescribed, the Partner Practitioners (as applicable)). Any other health-related information that you choose to provide us. *Health data constitutes ‘special category data’, meaning that these data are considered sensitive.
Financial data	Your billing details, including credit/ debit card details/ direct debit details and your billing address.
Marketing & feedback data	Your marketing preferences. Feedback that you provide to us as a part of surveys. With your permission, any information that you provide as a part of a testimonial that is placed on Updoc’s website, which may include health data.
Other data	Any other information that you choose to provide to us.

User of the Updoc Website and Platform

Category	Examples
Device & web data	Your device ID, IP address, statistics on page views, traffic, standard web log-in information, interactions with the Updoc Platform, and any other website event-based data to help us understand how you are using the website.
Mobile activity data	Updoc Platform activity, crash logs, diagnostics, approximate location and any other app and device-based data to help us understand how you are using the application version of the Updoc Platform.
Other data	Any information that you provide to us when you contact us through the Updoc Platform, which can include details about your identity, queries and, where you choose to provide it, your health data.

5. How do we use your personal data?

Here are the purposes for which we process your personal data, along with the legal basis that we rely on for such processing:

Purpose	Legal Basis
Providing the Updoc Platform to you, including: creating and managing your Account (including managing payments). sending you notifications about your use of the Updoc Platform and Services. responding to your questions / queries. facilitating your access to the Services and Updoc Platform, and connecting you to Partner Practitioners and (if relevant) pharmacies.	Performance of our contract with you. To the extent we process your health data for these purposes, your explicit consent.
Ensuring training and quality assurance of the Updoc Platform and services.	It is in our legitimate interest to ensure high quality of our products and services.
To send you marketing or promotional information that you have asked us to provide, or that we think you would like.	Our legitimate interest in sending you marketing and promotional materials that may be of interest to you. Where legitimate interest is not available (and where required by law), we will seek your consent instead, including your explicit consent where we process your health data to send you marketing or promotional information. In each case, you have the choice to opt-out of receiving marketing or promotional emails at any time by clicking ‘unsubscribe’ in the communication that we have sent you or by contacting our customer support team.
Online advertising to keep you aware of the Services and to help you find products and services that you may like.	Your consent. Your explicit consent where we process your health data for online advertising purposes. In each case, you have the choice to opt-out at any time.
Analytics and service improvement, including for research and development, or managing and improving our business and processes. We may anonymise and aggregate your personal data for these purposes.	It is in our legitimate interest to improve our services and business.
Addressing your questions or complaints.	It is in our legitimate interest to manage user experience of the Updoc Platform and the Services. To the extent we process your health data for these purposes, your explicit consent.
Facilitating third party validation of Outcomes. If you (or someone on your behalf) provides a digital copy of your Outcome (i.e. medical letter / certificate) to a third party, that third party may use a tool on Updoc’s website to confirm the validity of that letter / certificate. The third party must upload their email address, your surname and the certificate reference number. Updoc may then provide a brief validation of whether we have a medical certificate on file matching the information provided. This validation sets out the certificate reference number and its period of validity. We do not provide any other personal data about you to the third party.	Your explicit consent.
Compliance with our legal and regulatory obligations, including applicable record-keeping requirements.	Compliance with our legal obligations. To the extent we process your health data for these purposes, this is on the basis of your explicit consent, unless we rely on the processing being for the establishment, exercise or defence of legal claims.
For our legal purposes, including to enforce, protect or get advice on our rights or obligations, exercising or defending claims, fraud detection, product misuse, credit checks and regulatory authority checks and requirements.	It is in our legitimate interest to protect and enforce our legal rights and claims. To the extent we process your health data for these purposes, this is for the establishment, exercise or defence of legal claims.
Using a testimonial from you about Updoc that is placed on Updoc’s website.	Your consent (and to the extent we process your health data for this purpose, your explicit consent).

6. Who do we share your data with?

We only share your personal data where we have appropriate safeguards in place and we consider it necessary for the purposes outlined in this Privacy Notice. We may share your personal data with the third parties set out below:

• Partner Practitioners – we provide your personal data to Partner Practitioners so that they can provide their Services to you (i.e. health services), including health data that you have provided.
• Your regular GP or healthcare practitioner – we provide your personal data (including your health data) to your regular GP or health practitioner, but only when you have explicitly requested that we do so.
• Partner Pharmacies – we may provide your personal data to pharmacies in the UK that may dispense, package and deliver your prescription.
• Our Group companies – we provide your personal data to our Group Entities to support the provision of the Services to you.
• Third party service providers – we share your personal data with third parties that we rely on to assist with the provision of the Services to you (for example, cloud service providers, IT infrastructure providers and payment processors) and to assist us with our business (for example, to provide advertising services). We may also share your personal data to help prevent fraud or to protect or enforce our rights or the rights of our Group companies.
• Authorities – we may share your personal data with legal and regulatory Authorities at their request or, to comply with a legal obligation, or for the establishment, exercise or defence of legal claims.
• Prospective purchaser – if we sell or transfer any part of our business or assets, we may provide your personal data to a prospective purchaser.
• Third parties who are validating Outcomes – if you (or someone on your behalf) provides a digital copy of your Outcome (i.e. medical letter / certificate) to a third party, we may validate the letter / certificate. This validation sets out the certificate reference number and its period of validity. We do not provide any other personal data about you to the third party.

Other than as listed above, we will only disclose your personal data when you direct or give us permission, when we are required by applicable Law, or when we suspect fraudulent or criminal activities.

We do not sell your personal data to third parties for marketing purposes.

7. International transfers

We may transfer your personal data to countries outside of the UK. We may disclose personal data to our Group Entities, as well as certain third-party service providers located in Australia, the United States, Europe and the United Kingdom.

Some of these countries may not offer the same level of data protection as the applicable Data Protection Laws. Where this is the case, we enter into appropriate contractual safeguards with third parties in such countries to protect your privacy rights and the integrity of your personal data when we transfer it out of the UK (including, where required, by entering into the UK standard contractual clauses).

8. Marketing

Where your consent is required for any direct marketing-related communication, we will only provide you with such information if you have opted in. You may opt out at any time by clicking the unsubscribe or opt-out links in any electronic marketing communication we send to you or by contacting us at privacy@updoc.uk.

9. How do we store and secure your personal data?

We generally store your personal data in secure cloud systems using Amazon Web Services.

Your personal data is important to us, so we make sure that we take reasonable steps to protect your personal data. Some of the security measures we take include redundancy protection and monitoring, access controls, encryption and security audits and testing. In addition, all of our employees are trained in privacy compliance and are required to protect your personal data.

10. How long do we store your personal data?

We retain your personal data for as long as is required for the permitted purposes (outlined above), or for longer if otherwise required by Law.

When determining retention periods, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised disclosure or the use of the personal data, the purposes for which we collect the personal data and any other applicable legal, tax, accounting or other regulatory requirements.

11. Your data protection rights

You have various rights concerning the personal data that we hold about you. However, these rights are subject to limitations and restrictions under Data Protection Laws. We will tell you when any of these limitations or restrictions apply.

Your rights under this Privacy Notice include:

• Access - you may request access to the personal data we hold about you. In some instances, reasonable charges may apply for Updoc to provide copies of such data.
• Correction - you have the right to request that we correct any personal data that we hold about you which you believe is inaccurate.
• Erasure - you have the right to request that we delete your personal data.
• Restriction of processing - you have the right to request that Updoc restrict the processing of your personal data.
• Object to processing - you have the right to object to the processing of your personal data (for example, you can object to the use of your personal data for direct marketing purposes).
• Data portability – you can request that we send the data that we have collected to another organisation, or directly to you, under certain conditions and in a format that can be read by a computer.
• Withdrawal of consent - if you have given us your consent for the processing of your personal data you may withdraw your consent at any time with future effect. If you withdraw your consent, this does not affect the lawfulness of processing based on your consent before you withdrew consent. If you withdraw your consent, we will promptly delete the relevant data unless there is another legal ground permitting or requiring us to retain and continue processing such data.

If you make any one or more of the requests above, you will be required to verify your identity. Please send a description of your personal data in writing stating your name and your relationship with us to privacy@updoc.uk. We may require proof of identity to verify your request and to protect personal data from unauthorised access. We will carefully consider your request and will deal with your request without undue delay and within the time limits provided under Data Protection Laws.

If you feel that we have not complied with this Privacy Notice or with applicable Data Protection Laws, please send your complaint to our Privacy Officer at privacy@updoc.uk. You also have the right to make a complaint to the ICO as directed on their website (www.ico.org.uk).

12. Changes to this Privacy Notice

From time to time, we may make changes to this Privacy Notice, including how we process your personal data – taking into account new laws, regulations and technology. Please visit our website (www.updoc.co.uk) to obtain a copy of the latest version of this Privacy Notice at any time.