Privacy Policy

1.1 Data Controller Identity

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), Access Doctor acts as the 'Data Controller' for all personal and clinical data collected via our services.

1.2 Contact & Governance Officer Enquiries

If you have any questions regarding this policy, wish to exercise any of your legal rights, or have concerns regarding the management of your personal data, please contact our Data Protection Officer (DPO) and Clinical Governance team:

• Data Protection Contact Email: admin@accessdoctor.co.uk
• Postal Addressee: Data Protection Officer / Governance Lead, Access Doctor UK
• Response Timeframe: Within 30 calendar days of receipt

3.1 Personal Identification Data

• Identity Data: Full legal name, title, date of birth, biological sex, and gender identity.
• Contact Details: Residential address, billing address, dispatch/shipping address, contact email address, and telephone numbers.
• Verification Documents: Official government-issued documentation (e.g., passport, photocard driving licence, utility bill) collected for identity verification and anti-fraud checks.

3.2 Special Category Health & Clinical Data

• Clinical Assessment Data: Medical history, pre-existing health conditions, symptoms, allergies, current medications, past surgical procedures, family medical history, lifestyle factors (smoking, alcohol, BMI), and consultation answers.
• Prescribing & Dispensing Records: Electronic prescriptions, prescription issues, dosage instructions, pharmacy dispensing logs, batch numbers, and re-order history.
• NHS GP Information: Name, address, and registration code of your registered NHS General Practitioner (GP), along with GP communication logs.

3.3 Technical & Digital Footprint Data

• Device & Technical Data: IP address, browser type and version, time zone setting, operating system, hardware platform, device identifiers, and network connection type.
• Usage Data: Page interaction information, clickstream to, through, and from our website, page response times, download errors, duration of visits, and navigation paths.
• Tracking & Cookie Data: Cookie identifiers, tracking pixel tags, session logs, and analytics tokens.

3.4 Financial & Transaction Data

• Payment Information: Encrypted payment tokens, payment card details (processed via PCI-DSS compliant payment gateways), billing history, order IDs, and payment status.

4.1 Ordinary Personal Data (Article 6 UK GDPR)

• Article 6(1)(b) — Contractual Necessity: Processing necessary for the performance of a contract (providing medical consultation, pharmacy dispensing, and delivery of products).
• Article 6(1)(c) — Legal Obligation: Processing necessary to comply with legal and regulatory obligations (GPhC records, MHRA safety reporting, tax/accounting laws).
• Article 6(1)(f) — Legitimate Interests: Processing necessary for our legitimate business interests (improving platform security, fraud prevention, service analytics), where balanced against your fundamental privacy rights.
• Article 6(1)(a) — Consent: Clear, affirmative consent given for direct electronic marketing and non-essential analytical cookies.

4.2 Special Category Health Data (Article 9 UK GDPR)

Because health data is classified as 'Special Category Data' under Article 9 UK GDPR, we rely on specific additional conditions:

• Article 9(2)(h) — Provision of Healthcare: Processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems pursuant to contract with a health professional.
• Article 9(2)(i) — Public Health: Processing is necessary for reasons of public interest in the area of public health, such as ensuring high standards of quality and safety of healthcare products and medicinal products (MHRA/GPhC tracking).
• Article 9(2)(a) — Explicit Consent: Explicit consent requested in specific opt-in situations where legally required.

5.1 Clinical Confidentiality Mandate

Our clinical team—comprising registered GMC physicians, GPhC registered pharmacists, and clinical support specialists—are bound by professional codes of conduct and legal secrecy obligations. Access to your clinical record is restricted solely to authorized personnel involved in your care or clinical quality assurance.

5.2 Information Security in Clinical Workflows

Medical questionnaires, consultation notes, and prescription decisions are encrypted at rest using AES-256 encryption and transmitted via TLS 1.3 encrypted protocols. Clinical data is segregated from marketing and general web tracking data.

6.1 Online Clinical Assessment Process

When you request a prescription medication, you complete an online dynamic medical questionnaire. Your responses are evaluated by our automated clinical rules engine to flag potential contraindications, drug interactions, or dosage risks.

6.2 Human-in-the-Loop Clinical Oversight (No Fully Automated Prescribing)

In full compliance with UK GDPR Article 22, GPhC standards, and CQC guidance, Access Doctor does NOT employ fully automated decision-making or AI algorithm systems to issue prescriptions without human intervention.

• Practitioner Review: Every clinical questionnaire is individually reviewed by a GPhC-registered prescriber or GMC-registered physician.
• Independent Judgement: The clinical practitioner independently verifies your medical suitability, approves or declines the treatment request, or contacts you via secure message for further details.
• Supportive Tooling: Automated screening algorithms serve solely as a preliminary clinical decision-support tool to highlight safety parameters for the reviewing clinician.

7.1 Pharmacy Dispensing Workflows

Once a prescription is issued by our clinician, it is securely transmitted to our registered dispensing pharmacy. Pharmacy staff verify the prescription, check batch numbers, print mandatory regulatory labels, and package the medication.

7.2 Discreet Packaging Policy

To protect your privacy and medical confidentiality, all medications are dispatched in plain, unbranded packaging with no external markings indicating the contents or the nature of the pharmacy product.

7.3 Courier & Logistics Data Sharing

We share necessary delivery data (name, shipping address, telephone number, email address, tracking numbers) with our contracted courier partners (e.g., Royal Mail, DPD). Couriers are contractually prohibited from utilizing your personal data for any purpose other than executing delivery.

9.1 Identity Verification (Age & Identity Checks)

To comply with UK prescribing laws and prevent prescription fraud or under-age purchasing, we conduct electronic identity verification checks upon registration or order placement.

• Electronic Validation: We partner with accredited identity verification services (e.g., LexisNexis, GBG) to cross-reference your name, address, and date of birth against official databases.
• Soft Check Footprint: These checks leave a soft credit check footprint on your file, which does not impact your credit score.
• Manual ID Request: If electronic verification fails, you may be requested to upload photographic ID via a secure document portal.

9.2 Payment Processing Security

All payment transactions are processed through PCI-DSS Level 1 compliant payment gateways (e.g., Stripe, Checkout.com). Access Doctor does not store or process raw debit or credit card numbers on its servers.

10.1 Cookie Classifications

• Strictly Necessary Cookies: Essential for navigation, secure checkout, and clinical session state management. Cannot be disabled.
• Analytical / Performance Cookies: Allow us to analyze visitor traffic, session duration, page performance, and drop-off points (e.g., Google Analytics).
• Targeting / Marketing Cookies: Used to measure marketing effectiveness and deliver relevant advertising on third-party platforms (e.g., Meta Pixel).

10.2 Google Analytics & Privacy Controls

We utilize Google Analytics 4 (GA4). IP addresses are anonymized prior to storage. GA4 data is used exclusively to evaluate site usability and performance. You can opt out via our cookie preference center or browser extension.

10.3 Meta Pixel & Social Media Advertising

Meta Pixel script may track conversion events (e.g., completing a booking or purchase). We ensure that NO clinical, health, or medical questionnaire data is ever transmitted to Meta or third-party ad networks.

16.1 How to Exercise Your Rights

To exercise any right, submit a request to our DPO via admin@accessdoctor.co.uk. We respond to valid requests within one calendar month.