Privacy Notice
Last updated: [DATE]
1. About Health4U
Health4U is an online healthcare service providing private medical consultations and treatment services to patients in the United Kingdom.
Health4U currently provides services relating to:
- weight management
- erectile dysfunction
- hair loss
Our services are designed to provide convenient access to doctor-led care while maintaining appropriate standards of confidentiality, clinical governance and data protection.
Health4U is operated by Laurels Health Limited, a company registered in England and Wales under company number 16033134, with its registered office at 16 Laurel Way, London, England, N20 8HP.
We are registered with the Information Commissioner's Office (ICO) under registration number [ICO NUMBER].
For the purposes of UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, Laurels Health Limited is the data controller for the personal information described in this Privacy Notice, except where another organisation acts as an independent controller.
Because we provide healthcare services, some of the information we process is particularly sensitive, including information about your health and medical history. We recognise the importance of protecting this information and handling it appropriately.
This Privacy Notice explains:
- what information we collect
- why we need it
- how we use it
- who we may share it with
- how long we keep it
- how we protect it
- your rights in relation to your personal information
Please read this Privacy Notice carefully before using Health4U.
2. Who this Privacy Notice applies to
This Privacy Notice applies to individuals who:
- visit or use the Health4U website
- create a Health4U account
- complete an online consultation or health questionnaire
- request or receive treatment through Health4U
- communicate with our clinical or support teams
- purchase or subscribe to a Health4U service
- receive medication through one of our pharmacy partners
- otherwise interact with Health4U
Our website may contain links to websites operated by other organisations. Health4U is not responsible for the privacy practices of external websites. You should review the privacy information provided by those organisations before supplying them with personal information.
3. What is personal data?
Personal data is information relating to an identified or identifiable individual.
This can include straightforward information such as your name, email address and telephone number, as well as information relating to your account, transactions and use of our website.
Some personal data receives additional protection under data protection law. This includes information concerning your health, which is classified as special category personal data.
As a healthcare provider, Health4U needs to process health information in order to assess whether treatment is safe and clinically appropriate for you and to provide ongoing care.
4. Information we may collect about you
The information we collect will depend upon how you interact with Health4U.
Personal and contact information
We may collect information including your:
- full name
- date of birth
- sex where clinically relevant
- home and delivery address
- email address
- telephone number
- account and login information
Identity information
Where required for patient safety, regulatory compliance, fraud prevention or prescribing purposes, we may ask you to provide information that enables us to confirm your identity.
This may include:
- photographic identification
- photographs or video
- date of birth
- address information
- information processed through an identity-verification provider
For certain Health4U services, we may also conduct a video consultation or other identity check before treatment can be supplied.
Health and medical information
When you use our clinical services, we may collect information about your health, including:
- current and previous medical conditions
- symptoms
- current and previous medication
- allergies and adverse reactions
- previous treatments
- height, weight and BMI
- blood pressure or other clinical measurements where relevant
- lifestyle information where clinically relevant
- photographs you provide for clinical assessment
- information relating to treatment effectiveness or side effects
- consultation responses
- clinical notes
- prescriptions
- treatment decisions
- correspondence between you and our clinical team
The precise information requested will depend upon the service and treatment you are requesting.
You should provide complete and accurate information when completing a Health4U consultation. Missing or incorrect medical information may affect our ability to assess whether treatment is safe for you.
GP and healthcare information
Where appropriate, we may ask for details of your GP or another healthcare professional involved in your care.
We may communicate relevant information about your treatment to your GP or another healthcare professional where this is clinically appropriate, required for patient safety, required by law, or otherwise permitted under applicable healthcare and data protection requirements.
We will explain where GP communication forms part of a particular Health4U treatment pathway.
Payment and transaction information
When you purchase a treatment or subscription, information relating to the transaction will be processed.
Payments may be handled by a specialist payment provider. Health4U may therefore not directly receive or retain your complete payment-card details.
We may nevertheless retain information relating to:
- payments made
- orders
- subscriptions
- refunds
- failed payments
- transaction references
- your treatment purchase history
Communications
We may keep records of communications between you and Health4U, including:
- secure account messages
- emails
- telephone communications
- complaints
- enquiries
- feedback
- communications with our clinical and patient-support teams
Where calls are recorded, we will provide appropriate information about this.
Technical and website information
When you use our website or online services, certain technical information may be collected automatically.
This may include:
- IP address
- browser type
- device information
- operating system
- pages viewed
- dates and times of visits
- referral information
- website interactions
- cookie or similar technology identifiers
Please see our Cookie Notice for further information about our use of cookies and similar technologies.
5. How we obtain your information
Most of the personal information we process is provided directly by you.
For example, you provide information when you:
- register for an account
- complete a medical consultation
- request treatment
- communicate with a clinician
- attend a video consultation
- place an order
- manage your subscription
- contact our support team
- provide feedback
We may also receive relevant information from other organisations involved in providing your care or operating the Health4U service.
These may include:
- our dispensing pharmacy
- prescribing and clinical systems
- identity-verification providers
- payment providers
- delivery providers
- healthcare professionals
- technology providers
- fraud-prevention or security providers
Where another organisation acts as an independent data controller, its own privacy notice will explain how it processes your information.
6. How Health4U uses your information
We may process your personal information to:
Provide our healthcare services
This includes:
- reviewing your online consultation
- assessing whether treatment may be clinically appropriate
- verifying your identity where necessary
- providing medical advice
- prescribing treatment where appropriate
- generating and processing prescriptions
- arranging dispensing and delivery
- monitoring your response to treatment
- carrying out follow-up assessments
- providing ongoing clinical support
- maintaining your medical record
Operate your Health4U account
We use your information to:
- create and maintain your account
- authenticate access
- maintain account security
- display relevant treatment and order information
- allow you to communicate securely with us
Process orders and subscriptions
We may use your information to:
- process treatment orders
- manage recurring subscriptions
- take or arrange payment
- issue refunds
- manage failed payments
- arrange dispensing
- organise delivery
Protect patient safety
Your information may be processed where necessary to:
- identify contraindications
- check whether medicines may interact
- review allergies
- assess clinical eligibility
- monitor treatment
- investigate potential adverse events
- identify safeguarding concerns
- communicate important safety information
- investigate clinical incidents
Communicate with you
We may contact you about:
- your consultation
- treatment
- prescription
- order
- delivery
- subscription
- required follow-up assessments
- important medicine or safety information
- changes to our service
- enquiries or complaints you have raised
These service communications are different from marketing communications.
Improve and protect Health4U
We may process information to:
- maintain website and platform security
- prevent fraud or misuse
- investigate technical problems
- monitor service performance
- improve our patient journeys
- conduct quality assurance
- support clinical governance
- investigate incidents
- audit our services
- meet our regulatory and professional obligations
Where possible and appropriate, information used for analytics, audit or service improvement may be anonymised or aggregated.
7. Our lawful bases for processing your information
Data protection law requires us to have a lawful basis for processing personal data.
Depending upon the circumstances, Health4U may rely upon:
Contract
Processing may be necessary to provide a service you have requested or to take steps at your request before entering into a contract.
Legal obligation
We may need to process information to comply with laws and regulatory requirements applying to healthcare providers, prescribers and businesses.
Legitimate interests
We may process information where this is necessary for our legitimate interests or those of another organisation, provided those interests are not overridden by your rights.
Examples may include:
- improving our services
- maintaining system security
- preventing fraud
- managing our business
- handling certain enquiries and complaints
Consent
In some circumstances we will ask for your consent.
This may apply, for example, to certain forms of marketing or other optional processing.
Where processing is based upon consent, you may withdraw that consent at any time.
Withdrawal of consent does not affect processing that lawfully occurred before consent was withdrawn.
8. Processing your health information
Information concerning your health is special category personal data and receives additional protection under UK data protection legislation.
Providing an online medical service necessarily requires us to process health information.
Where we process information for the purposes of providing healthcare or treatment, we will generally rely upon the relevant healthcare provisions under Article 9(2)(h) of the UK GDPR, together with an appropriate condition under UK data protection legislation.
Other special-category processing conditions may apply in particular circumstances, including where processing is necessary to protect vital interests or where another condition permitted by law applies.
Access to identifiable medical information is restricted to individuals and organisations that have an appropriate reason to access it.
9. Prescriptions, pharmacies and delivery
Where a Health4U clinician considers treatment clinically appropriate, information necessary to issue and fulfil your prescription may be provided to our pharmacy or prescribing partners.
This may include:
- your name
- date of birth
- address
- contact information
- prescribed medicine
- prescription information
- relevant clinical information where required
Our pharmacy partner will process information in accordance with its own legal, professional and regulatory obligations.
Information necessary to deliver medication may also be provided to delivery or courier services.
We only provide organisations involved in dispensing and delivery with information reasonably required to perform their role.
11. Sharing information with your GP or other healthcare professionals
Safe healthcare sometimes requires appropriate communication between healthcare professionals.
Depending upon the service you use, Health4U may request your GP's details and may communicate relevant information about your treatment to your GP.
This can help ensure that:
- your medical record remains appropriately up to date
- medicines are prescribed safely
- potentially important interactions or contraindications can be identified
- different healthcare professionals involved in your care have relevant information where necessary
There may also be circumstances where we need to share information without your consent, for example where required by law or where there is a sufficiently serious concern regarding your safety or the safety of another person.
Any such disclosure will be considered carefully and handled in accordance with our legal, professional and safeguarding responsibilities.
12. Marketing communications
Where permitted, Health4U may contact you with information about our services, health information, offers or other communications that may be relevant to you.
Where consent is required, we will only send such communications where you have chosen to receive them.
You can change your marketing preferences or unsubscribe from marketing communications at any time.
Stopping marketing communications will not prevent us from sending important service or clinical communications relating to your account, treatment, prescription, subscription or patient safety.
14. Automated processing
Technology may be used within parts of the Health4U service to help organise information, identify potentially unsuitable treatment requests, support clinical workflows or highlight information for clinical review.
Where automated systems support clinical decision-making, we will implement appropriate safeguards in accordance with applicable law and professional requirements.
Where you have a legal right to request human intervention in relation to a decision made solely by automated means, you may contact us to exercise that right.
[Health4U to confirm whether any solely automated decision-making with legal or similarly significant effects will be used before publication.]
15. Keeping your information secure
Health4U takes appropriate technical and organisational measures to protect personal and medical information.
These measures may include:
- encryption
- secure hosting
- access controls
- authentication controls
- audit logging
- secure communications
- system monitoring
- backups
- staff confidentiality requirements
- policies governing access to patient information
Access to medical records is restricted to authorised individuals who require access for an appropriate purpose.
Although we take reasonable measures to protect information, no internet-based system can be guaranteed to be completely secure.
You are also responsible for protecting your Health4U login credentials. You should not share your password or allow another person to access your account.
Please contact us promptly if you believe your account or personal information has been compromised.
16. International transfers
Some organisations providing technology or other services to Health4U may process information outside the United Kingdom.
Where personal information is transferred internationally, Health4U will ensure that an appropriate legal mechanism is in place where required.
Depending upon the destination, this may include:
- UK adequacy regulations
- the UK International Data Transfer Agreement
- the UK International Data Transfer Addendum to approved Standard Contractual Clauses
- another transfer mechanism permitted under UK data protection law
Where necessary, we will also consider whether additional safeguards are required to protect your information.
17. How long we keep your information
We retain personal information only for as long as there is a legitimate, clinical, regulatory or legal reason to keep it.
Medical records may need to be retained for a significant period after your treatment has ended in accordance with applicable healthcare record-retention requirements.
Different retention periods may apply to different categories of information, including:
- clinical records
- prescriptions
- financial and transaction information
- account information
- complaints
- customer-service communications
- marketing preferences
- technical records
Closing your Health4U account does not necessarily mean that your medical record can immediately be deleted.
Where we have a legal, regulatory or professional obligation to retain clinical information, it will continue to be securely retained for the required period.
When identifiable information is no longer required, it will be securely deleted, destroyed or anonymised as appropriate.
[Health4U's formal records-retention schedule should be confirmed by the Medical Director/Data Protection lead before publication.]
18. Your data protection rights
Depending upon the circumstances, UK data protection legislation gives you a number of rights over your personal information.
These can include the right to:
- obtain access to your personal information
- have inaccurate information corrected
- have incomplete information completed
- request deletion of information in certain circumstances
- request restriction of processing
- object to certain processing
- receive certain information in a portable format
- withdraw consent where processing relies upon consent
- exercise rights relating to certain forms of automated decision-making
These rights are not absolute and may not apply in every situation.
In particular, healthcare providers may be required to retain medical records even where an individual has requested deletion.
We may need to verify your identity before responding to a request involving your personal information.
19. Accessing your information
You have the right to request access to personal information Health4U holds about you. This is commonly known as a Subject Access Request (SAR).
To make a request, please contact:
Email: [HEALTH4U DATA PROTECTION EMAIL]
Post:
Data Protection
[HEALTH4U LEGAL COMPANY NAME]
[ADDRESS]
Please provide sufficient information for us to identify you and understand the information you are requesting.
We will respond within the timeframe required under applicable data protection law. In some circumstances, additional time may be permitted for particularly complex or numerous requests. If this applies, we will tell you.
20. Correcting your information
It is important that the information held within your Health4U account and medical record is accurate.
You should update information through your account where this functionality is available or contact us if information is incorrect.
Please ensure you provide accurate and complete medical information whenever completing a consultation or follow-up assessment.
21. Requesting deletion of your information
You may ask us to delete personal information in certain circumstances.
However, the right to erasure does not automatically apply to all information.
In particular, Health4U may need to retain information where this is necessary:
- as part of your medical record
- to comply with healthcare or prescribing requirements
- to comply with another legal obligation
- to establish, exercise or defend legal claims
- for another lawful reason permitted by data protection legislation
Where information cannot be deleted, we will explain the applicable reason where required.
22. Children's information
Health4U's online prescribing services are intended only for individuals who meet the minimum age requirements for the relevant service.
Our current adult treatment services are not intended for individuals under the age of 18.
If we become aware that personal information has been provided by or about a child in circumstances where our service should not be used, we will take appropriate action in accordance with our legal and safeguarding responsibilities.
23. Changes to this Privacy Notice
Healthcare services, technology and data protection requirements can change over time.
We may therefore update this Privacy Notice periodically.
The latest version will be published on the Health4U website and the date at the beginning of the Notice will show when it was most recently updated.
Where a change materially affects how we process your personal information, we may take additional steps to bring the change to your attention where appropriate.
24. Questions or complaints
If you have a question, concern or complaint about how Health4U handles your personal information, please contact us first so that we have an opportunity to investigate.
Data Protection contact:
Dr Anisha Patel
Email:
[EMAIL]
Address:
[ADDRESS]
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
You do not have to contact Health4U before approaching the ICO, although we would welcome the opportunity to address your concerns directly.