Privacy notice
How we collect, use, and protect your personal data.
Last Updated: 19th August 2024
Version 2.1 — updated lawful basis, data sharing, and international transfers.
This website, medicomhealthcare.co.uk (our website) is provided by Medicom Healthcare Limited ('we', 'our' or 'us'). We are the controller of personal data obtained via our website, meaning we are the organisation legally responsible for deciding how and for what purposes it is used.
We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use and share any information relating to you (your personal data) in connection with your use of our website.
We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR).
What this policy applies to
This privacy policy relates to your use of our website only.
Throughout our website we may link to other websites owned and operated by certain trusted third parties. Those third party websites may gather information about you in accordance with their own separate privacy policies.
Personal data we collect about you
We will collect and use the following personal data about you:
- Your name, email address and company name (if applicable)
- Any other information which you may voluntarily provide to us in your message when you complete the General Enquiries form on the Contact Us page or any other information you send to any of our email addresses listed on our website (e.g. date of birth, physical address, telephone number, health information)
How your personal data is collected
We collect personal data from you directly when you submit information via the General Enquiries form on the Contact Us page or via an email to any of our email addresses listed on our website.
How and why we use your personal data
Under data protection law, we can only use your personal data if we have a proper reason, e.g.:
- Where you have given consent
- To comply with our legal and regulatory obligations
- For our legitimate interests or those of a third party
A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests.
| What we use your personal data for | Our reasons |
|---|---|
| To process and consider any request you submit via the General Enquiries form or via email | To respond to your request as efficiently and accurately as possible |
| Disclosures necessary to comply with legal and regulatory obligations (e.g. adverse event notification) | To comply with our legal and regulatory obligations |
How and why we use your personal data — in more detail
| Purpose | Lawful basis (UK GDPR) | Data categories |
|---|---|---|
| Process and respond to enquiries | Consent (Art. 6(1)(a)) and/or legitimate interests (Art. 6(1)(f)) | Name, email, company name, and any voluntarily provided information |
| Assess and report adverse events | Consent (Art. 6(1)(a)), legal obligation (Art. 6(1)(c)), vital interests (Art. 6(1)(d)), public interest (Art. 6(1)(e)) | Name, email, company name, and any voluntarily provided information including health data |
Special category personal data
Certain personal data is treated as a special category to which additional protections apply, including data concerning health. Given the nature of our products, it is sometimes necessary to process such data. We ensure we have your explicit consent, it is necessary to protect vital interests, for legal claims, or for reasons of public interest in public health.
Who we share your personal data with
We routinely share personal data with:
- Other third parties we use to help us run our business (e.g. our website host)
We also occasionally share personal data with:
- Our external auditors (bound by confidentiality obligations)
- Our professional advisors such as lawyers (bound by confidentiality obligations)
- Law enforcement agencies, courts, tribunals, and regulatory bodies
- Other parties in connection with significant corporate transactions
| Recipient | Purpose |
|---|---|
| Red Line Pharmacovigilance Limited, Milton Keynes, UK | Adverse event assessment and reporting to authorities |
| VISUfarma BV, Amsterdam, The Netherlands | Adverse event assessment for products they distribute |
| Altacor Limited, Windsor, UK | Adverse event assessment for products they distribute |
| Aequus Pharmaceuticals Inc, Vancouver, Canada | Adverse event assessment for products they distribute |
How long your personal data will be kept
We will not keep your personal data for longer than we need it. After the prescribed retention period, data will be moved to archiving. Different retention periods apply for different types of personal data — further details available upon request.
Transferring your personal data out of the UK
It is sometimes necessary for us to transfer your personal data to countries outside the UK (including The Netherlands and Canada). We will only do so where:
- There are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you, or
- A specific exception applies under relevant data protection law
Where we transfer your personal data outside the UK, we do so on the basis of an adequacy regulation or legally-approved standard data protection clauses recognised under Article 46(2) of the UK GDPR.
Cookies
A cookie is a small text file placed onto your device. We do not use non-essential cookies on our website.
Your rights
You generally have the following rights, which you can usually exercise free of charge:
| Right | Description |
|---|---|
| Access | The right to be provided with a copy of your personal data |
| Correction | The right to require us to correct any mistakes in your personal data |
| Erasure | The right to require us to delete your personal data in certain situations |
| Restriction | The right to require us to restrict use of your personal data in certain circumstances |
| Data portability | The right to receive your personal data in a structured, machine-readable format |
| Object to use | The right to object to direct marketing or processing based on legitimate interests |
| No automated decisions | The right not to be subject to decisions based solely on automated processing. We do not make any such decisions. |
| Withdraw consent | If you have provided consent, you may withdraw it at any time by emailing dataprotection@medicomhealthcare.com |
For further information on your rights, please refer to the guidance from the UK's Information Commissioner.
Keeping your personal data secure
We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to those who have a genuine need. We also have procedures in place to deal with any suspected data security breach and will notify you and any applicable regulator where we are legally required to do so.
How to complain
Please contact us if you have any queries or concerns. You also have the right to lodge a complaint with:
- The Information Commissioner in the UK — ico.org.uk/make-a-complaint or telephone 0303 123 1113. Our ICO registration number is ZA004095.
- A relevant data protection supervisory authority in the EEA — list of authorities
Changes to this privacy policy
We may change this privacy policy from time to time. When we make significant changes we will take steps to inform you, for example by including a prominent link on our website.
How to contact us
Email: dataprotection@medicomhealthcare.com
Telephone: +44 1489 574119
Address: Medicom Healthcare Limited, Gainsborough House, 59–60 Thames Street, Windsor, SL4 1TX, UK
Policy Version: 2.1