PUSH DOCTOR

PRIVACY AND COOKIES POLICY

At Push Doctor we understand how important your personal information is to you. We believe your personal information should only be used in ways that support positive healthcare outcomes for you and improve your patient experience.

This privacy notice tells you what to expect us to do with your personal information when you contact us or use one of our services. It applies to everyone who uses a Push Doctor service other than our Push Doctor Private app-based service (which has a separate privacy policy), whether you:

• are paying for Push Doctor services yourself
• are receiving Push Doctor services as a benefit through a third party
• you are receiving Push Doctor services because they are part of the NHS services offered by your GP surgery (inc. Push Access).
• you are using the Push Doctor service to access the services of a third-party provider (Push Consult)

Personal information is any information that can be used to identify a living person.

This notice is split into sections:

• Our details
• What does Push Doctor use my personal information for?
• How does Push Doctor get my personal information?
• What personal information about me does Push Doctor use?
• Who does Push Doctor share my personal information with?
• Where is my data stored?
• How long does Push Doctor keep my personal information for?
• How does Push Doctor keep my information secure?
• What rights do I have over my personal information?
• Contact us
• Complaints
• Updating this notice
• Cookies

We have used links to help you get to the information you are interested in.

In some places we have provided links to other websites, for example the Information Commissioner's Office website. We are not responsible for the accuracy of any other website.

Our details

Push Doctor is responsible for keeping the personal information we use safe and making decisions about how it can be used.

'Push Doctor' is an operating brand/style of Square Health Limited. Square Health Limited (including the Push Doctor trading division) is regulated by the Care Quality Commission ("CQC") (registration number 1-1207461908). The CQC is the independent regulator of all health and social care in England. The CQC monitors, inspects and regulates all hospitals, care homes, home-care agencies, GP practices and dental practices.

The address of Square Health Limited is:

Crown House, William Street, Windsor, Berkshire SL4 1AT.

You can contact our Data Protection Officer at dpo@pushdr.com or by writing to the Data Protection Officer at the address above for any queries about your personal information.

What does Push Doctor use my personal information for?

We use your personal information to:

• provide you with Push Doctor services - For example, we may use your personal information to:
  • send you a text message requesting that you validate your Push Doctor account and/or to reset your username and password if require
  • administer our site, for example to allow you to log in and log out of your account
  • notify you about changes to this privacy notice or our services
  • ensure that content from our website or apps is presented in the most effective manner for you
  • allow you to use our interactive features
  • respond to any queries you raise with us and to provide customer support
  • ask for feedback from you if you have agreed to this
• help maintain the quality of and improve Push Doctor services - For example, we may use your personal information to:
  • create anonymous information that we can use to help develop our services or provide to other organisations with an interest in our services, like regulators
  • anticipate demand for our services
  • monitor the performance of our website and applications
  • quality assure the services provided by Push Doctor GPs and members of Push Doctor staff
• we may also use your personal information to let you know more about our offers and services, and to understand the effectiveness of our advertising

This may include using your medical information, so we can offer services that are relevant to you. For example, we may ask you some questions relating to your general health, or you may choose to share your data from wearable devices, monitors or other apps with us. If you are paying for Push Doctor services yourself or receiving Push Doctor services as a benefit through a third party and we hold your medical data, you may also choose to allow us to use this to personalise recommendations from Push Doctor.

You can control how we use your personal information through your communication preference centre. You can find your communication preference centre within the Push Doctor app or website under 'Your Account'. From here you can choose the communications you would like to receive from us. You can switch these on or off any time.

• We may sometimes need to use your personal information for other purposes - For example, we may sometimes need to use your personal information to:
  • co-operate with regulators, like the Care Quality Commission
  • comply with a legal obligation, like a court order requiring us to release information
  • deal with disputes and legal claims, for example if you make a legal claim against one of our GPs
  • deal appropriately with any risk to public health

And if you receive Push Doctor services through your NHS GP

• we also provide information back to your GP surgery, so that they have a record of what we have done. That personal information will be handled in accordance with your GP surgery's policies.
• We may also use your information to help other organisations delivering NHS or social care to provide you with services.

And if you are paying for Push Doctor services yourself or receiving them as a benefit through a third party

If you are paying for Push Doctor services yourself or receiving them as a benefit through a third party, we may also use your personal information to:

• carry out credit checks to check your identity
  • In order to process your application, we carry out a 'soft credit check' to confirm your identity with one or more credit reference agencies ("CRAs"). We provide your details to a CRA, which uses information it holds and publicly available information to check those details are correct. The CRA lets us know the result of the check. Only you can see the check on your credit report. The check will have no impact on your credit score or any future credit applications you may make. It doesn't matter how many soft checks there are on your credit report.
  • We will use this information to:
    • Verify the accuracy of the data you have provided to us
    • Prevent criminal activity and fraud

If you would like more information on:

• the identities of the CRAs
• their role also as fraud prevention agencies
• the data they hold
• the ways in which they use and share personal information
• data retention periods
• your data protection rights with the CRAs

this can be found in the Credit Reference Agency Information Notice at https://www.experian.co.uk/crain/index.html.

If you are paying for Push Doctor services yourself, we will also use your information to obtain payment from you for our services

If you are receiving Push Dr services as a benefit through a third party, we may also use your personal information to check that you are entitled to this benefit

Under data protection laws, each purpose for which we use your personal information must comply with one of the conditions for processing. You can find out more about the conditions we rely on below:

The Information Commissioner's Office (ICO) is responsible for ensuring that organisations comply with data protection rules. You can find out more about what the conditions for processing are on their website:https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/.

When we are using personal information, we must meet one of the conditions set out in Article 6 of the UK General Data Protection Regulation (GDPR).

Under the GDPR there is some personal information that is so sensitive that it gets extra protection. This special category data is any personal information about someone's:

• health (including mental health);
• sex life;
• sexual orientation;
• racial or ethnic origin;
• political opinions;
• religious or philosophical beliefs
• trade union membership.

It also includes genetic data and biometric data if that information is used to identify an individual.

When we are using special category data, we must also meet one of the conditions set out in Article 9.

We have set out in the table below which conditions we are relying on when we use your personal information.

We have set out below the conditions that we are relying on in order to use your data.

PURPOSE	ARTICLE 6 CONDITION	ARTICLE 9 CONDITION
All patients
co-operate with regulators, like the Care Quality Commission	Article 6(1)(e) - public task Article 6(1)(c) - compliance with a legal obligation	Article 9(2)(g) - substantial public interest
comply with a legal obligation, like a court order requiring us to release information	Article 6(1)(c) - compliance with a legal obligation	Article 9(2)(f) - establishment, exercise or defence of legal claims Article 9(2)(g) - substantial public interest
deal with disputes and legal claims, for example if you make a legal claim against one of our GPs	Article 6(1)(f) - legitimate interests (we have a legitimate interest in being able to deal with disputes and legal claims)	Article 9(2)(f) - establishment, exercise or defence of legal claims
deal appropriately with any risk to public health	Article 6(1)(e) - public task Article 6(1)(c) - compliance with a legal obligation	Article 9(2)(h) - healthcare and social care purposes Article 9(2)(i) - public health
Patients receiving Push Doctor services through their NHS GP
provide you with Push Doctor services	Article 6(1)(e) - public task	Article 9(2)(h) - healthcare and social care purposes Article 9(2)(g) - substantial public interest
help maintain the quality of and improve Push Doctor services	Article 6(1)(e) - public task Article 6(1)(f) - legitimate interests (we have a legitimate interest in maintaining and improving the quality of Push Doctor services)	Article 9(2)(h) - healthcare and social care purposes Article 9(2)(g) - substantial public interest
Provide information back to your NHS GP surgery	Article 6(1)(e) - public task	Article 9(2)(h) - healthcare and social care purposes Article 9(2)(g) - substantial public interest
We may also use your information to help other organisations delivering NHS or social care to provide you with services.	Article 6(1)(e) - public task	Article 9(2)(h) - healthcare and social care purposes Article 9(2)(g) - substantial public interest
let you know more about our services and offers	Article 6(1)(a) - consent	Article 9(2)(a) - consent
let you know more about the products and services of third parties that may be relevant to you	Article 6(1)(a) - consent	Article 9(2)(a) - consent

Patients paying for Push Doctor services themselves
provide you with Push Doctor services	Article 6(1)(b) - performance of a contract	Article 9(2)(h) - healthcare and social care purposes
help maintain the quality of and improve Push Doctor services	Article 6(1)(f) - legitimate interests (we have a legitimate interest in maintaining and improving the quality of Push Doctor services)	Article 9(2)(h) - healthcare and social care purposes
carry out identity/soft credit checks	Article 6(1)(b) - performance of a contract	No special data used
obtain payment from you for our services	Article 6(1)(b) - performance of a contract	No special data used
let you know more about our services and offers	Article 6(1)(a) - consent	Article 9(2)(a) - consent
let you know more about the products and services of third parties that may be relevant to you	Article 6(1)(a) - consent	Article 9(2)(a) - consent
Patients receiving Push Doctor services as a benefit through a third party
provide you with Push Doctor services	Article 6(1)(b) - performance of a contract	Article 9(2)(h) - healthcare and social care purposes
help maintain the quality of and improve Push Doctor services	Article 6(1)(f) - legitimate interests (we have a legitimate interest in maintaining and improving the quality of Push Doctor services)	Article 9(2)(h) - healthcare and social care purposes
carry out identity/soft credit checks	Article 6(1)(b) - performance of a contract	No special data used
let you know more about our services and offers	Article 6(1)(a) - consent	Article 9(2)(a) - consent
let you know more about the products and services of third parties that may be relevant to you	Article 6(1)(a) - consent	Article 9(2)(a) - consent

There are extra rules that apply to information about criminal allegations and convictions. We do not use this type of information very often, for example you might tell us about a drug-related conviction or time in prison. Our use complies with Article 10 of the GDPR because it meets the condition set out in the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2 (health or social care purposes).

How does Push Doctor get my personal information?

Most of the personal information we use is provided to us directly by you so that you can access our services. For example, you provide us with your contact details. Please let us know if there are any changes to your personal details while you are registered with us

This includes personal data you provide when you:

• search for one of our apps or our website
• download one of our apps
• create a Push Doctor account on-line;
• purchase services through our website or one of our apps;
• log in to Push Doctor and use the Services;
• report a problem with a Push Doctor app or website;
• request marketing to be sent to you;
• enter a competition, promotion or survey; or
• give us some feedback.

We may use information about your health from health technology companies

If you agree, we may use information about your health from programmes like Microsoft HealthVault or Google Health that individuals use to collect, store and analyse information about their health.

If you agree, we may use information about your health from smart devices. For example, smart watches can keep a record of your heart rate. You can choose to stop sharing this data with us at any time.

We also gather technical information about your visit, like what device you are using to access Push Doctor services. More detail about what we collect is set out in the section below (What personal information about me does Push Doctor use?)

We automatically collect this personal data by using cookies, server logs, application data caches, browser web storage and other similar technologies. We may also receive data about you if you visit other websites that use our cookies. Please see our cookie policy for further details.

We collect information about your location if you are using a computer, tablet or mobile phone that has GPS enabled in order to:

• know where a patient is located is important so that we can direct emergency services to them if appropriate
• We use information about your location to advise you where your nearest pharmacy is.

You can stop us using your location information at any time by turning off the GPS setting in your device

If you get Push Doctor services through your NHS GP, then we will access information about you that is stored on your NHS GP's records. We will ask for your agreement before we do this.

We access NHS systems so that we can see your full medical record. This means that we can see any information that your NHS GP can see. This will include contact information and detailed health information like family health history, past diagnoses, treatment plans, medication, body measurements and test results.

If you get Push Doctor services through your NHS GP, then the medical record of your appointment (including any diagnosis or treatment prescribed by the Push Doctor GP) will be stored in your NHS medical record that is held by your GP practice. However, Push Doctor GPs do provide us with summary information about your online appointment.

Push Doctor GPs log the following information with Push Doctor:

• Patient's name
• Patient's date of birth
• Patient's mobile phone number
• Patient's email address
• The start time, end time and duration of the Online Appointment
• Details of any unscheduled end to the Online Appointment, for example if an emergency caused the Online Appointment to end
• Any failure by a Patient to attend the Online Appointment
• Cancelled appointments
• Any patient feedback
• Name [and Push Doctor reference number] of the Push Doctor GP

If you pay for Push Doctor services yourself, we may access information about you from credit referencing agencies, advertising networks and partner organisations that help us process payments.

If you receive Push Doctor services as a benefit through a third party then your third-party service provider may provide us with your work contact details like your full name and email address and we may access information about you from credit referencing agencies

If you pay for Push Doctor services yourself or you are receiving Push Doctor services as a benefit through a third party you will provide us with information about your health (because we are not able to access this information from NHS records). Push Doctor GPs store the medical record of your appointment (including any diagnosis or treatment prescribed by the Push Doctor GP) on our systems.

Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS England. NHS England is the controller for any personal information you provided to NHS England to get an NHS login account and verify your identity, and uses that personal information solely for that single purpose. For this personal information, our role is a "processor" only and we must act under the instructions provided by NHS England (as the "controller") when verifying your identity. To see NHS Login's Privacy and Cookies Policy and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.

Recording consultations

Consultations in the course of providing a Push Doctor Service may be recorded for quality, training and monitoring purposes. Recordings may include audio, video or both and information collected includes health and medical information and other personal data contained in consultation recordings. If you get Push Doctor services through your NHS GP recordings of consultations may be shared with your NHS GP practice.

What personal information about me does Push Doctor use?

We use the following personal information:

• Your contact details and account details

This includes the information that you provide us with when you register and other profile information

This includes:

• Your name
• Your title
• Your address
• Your email address
• Your mobile telephone number
• Your username
• Your password
• Answers to security questions to check your identity
• Any personal description provided by you
• Any photograph provided by you
• Any personal interests provided by you
• Your communication preferences
• Any feedback or survey responses provided by you

• Biographical information

This is information like your date of birth, nationality, gender, marital status and dependants

• Information about your health and social circumstances

This includes:

• Information you provide as part of using our services
• Information provided during your online appointments
• Notes and reports relevant to your health, including any information you have told us about your health.
• Details of your treatment and care, including any diagnosis, medical advice, comments and care plan from your Push Doctor GP and other staff who have cared for you.
• Results of investigations, such as laboratory tests and x-rays.
• Relevant information from health and social care professionals, relatives or those who care for you.
• Information about your ethnicity, sexual orientation, sex life, religious beliefs or opinion or genetic data where this is relevant to your care or is information that you have provided to us as part of your care.
• If you agree, information from programmes like Microsoft HealthVault or Google Health that individuals use to collect, store and analyse information about their health.

Health tracking programmes allow you to combine data from multiple apps or devices. By doing so, you can track your health and fitness activities against your goals to provide you with a comprehensive view of your health and fitness.

This information can include all of the information listed below in examples of data from smart devices and health apps. Information may be combined from several sources to provide you with a more personalised view of your health and lifestyle.

• If you agree, information from smart devices and health apps.

This information can include indicators of activity such as heart rate or blood pressure, exercise summaries, nutritional intake, weight and sleep cycles.

• Information about your next of kin and carers

This includes their contact details, relevant medical history if required and emergency contact information.

• Communications with or about you

This includes referrals, prescriptions and fit notes

• Information about your use of the Push Doctor app or the website

This includes:

• Whether you are using a computer, mobile phone or tablet to access our services.
• Your mobile operating system, the type of mobile internet browsers you use and data about the way you use our app and/or website
• Information that identifies the computer, mobile phone or tablet that you use to access our service.

This includes your IP address, any unique device identifiers placed by us or our service providers, the unique identifier assigned by Push Doctor to your computer, mobile phone or tablet

• Information about your visit.

This includes full uniform resource locators (URL); clickstream to, through and from the Push Doctor app and website (including date and time); services you viewed or searched for; page response times; download errors; length of visits to certain pages; page interaction information (such as scrolling, clicks and mouse-overs); methods used to browse away from the page

• Consultation length, how often you visit and any phone number used to call our customer services
• Information stored on your mobile phone, tablet or computer that you choose to share with your Push Doctor GP during your on-line appointment

If you are using a computer, tablet or mobile phone that has GPS enabled, your location we will use your personal information to:

• know where a patient is located is important so that we can direct emergency services to them if appropriate

• and to advise you where your nearest pharmacy is.

You can stop us using your location information at any time by turning off the GPS setting in your device

• If you provide us with feedback, we will use information from feedback information and survey responses from you.

This may include demographic information, such as where you live and your income, if you choose to provide it. It may also include your opinions about our services. We anonymise this information before we use it to improve our services.

You can control your settings in your communications preference centre. You can find your communication preference centre within the Push Doctor app or website under 'Your Account'. From here you can choose the communications you would like to receive from us. You can switch these on or off any time you like.

And if you receive Push Doctor services through your NHS GP

• Your NHS number.

And if you pay for Push Doctor services yourself

• Payment and financial information

This includes your purchases and orders, the charges you have incurred, payments you have made, your payment card details, any credit reference checks and any information from debt collection agencies

• Your marketing preferences

And if you receive Push Doctor services as a benefit through a third party

• Information about your third-party service provider, the Push Doctor benefits you are entitled to and your work contact details

• Your marketing preferences.

Who does Push Doctor share my personal information with?

To provide you with Push Doctor services we need to share your personal information with Push Doctor GPs and our medical team. More detail here

Push Doctor GPs work in partnership with Push Doctor as self-employed contractors. This is very similar to the way that many GPs work in independent GP practices in partnership with the NHS, across the country.

Push Doctor GPs are responsible for maintaining the privacy of your personal information. All Push Doctor GPs have to demonstrate they have completed NHS training in personal information handling before they can start consulting with our patients.

We employ a clinical team, who are part of Push Doctor. They may need to access your personal information so that we can provide you with services, for example if you have a query or concern about your consultation or treatment, or if the information is needed to assist our Chief Medical Officer with quality assurance. Only those employees of Push Doctor who need access to information in order to do their jobs are allowed access.

We also need to share information with partner organisations that help administer Push Doctor accounts.

For example:

• Our IT suppliers, including suppliers of data storage services
• Contractors who provide our telephone services
• Suppliers of web hosting services
• Organisations that we use to obtain feedback from patients who have agreed to do this

We have vetted these organisations to ensure that they will deal with your personal information responsibly.

We do not allow these partner organisations to use your personal information for their own purposes. We only permit them to use your personal in accordance with our instructions.

We may also share information with our partner organisations who provide data analysis services, to help improve our services. This does not include information about your health.

Sometimes we need to share information with regulators like the Care Quality Commission, the General Medical Council, NHS England, the Information Commissioner's Office and the Health Service Ombudsman.

With your agreement, information can be shared with relatives, partners or friends who act as a carer for you. We will only share information once the person you have asked us to share the information with has provided us with proof of their identity. We may share information with anyone you have given as an emergency contact, for example your next of kin. You can find out more by contacting us at support@pushdoctor.co.uk , 0330 808 4702 or writing to us at Square Health Limited (Push Doctor division), Crown House, William Street, Windsor, Berkshire SL4 1AT.

We may also share information with anyone else that you authorise us to e.g., your employer or (if you are not an NHS patient) your insurer.

If you are receiving Push Doctor services through your third-party service provider

we will not share personal data with them. Push Doctor will only share information on the number of appointments used and anonymised data on high level diagnoses. Where data is anonymised, all direct identifiers are removed and Push Doctor will only share this information when a certain number of employees have used the service. If you have informed your third-party service provider of any sickness, absence or presented them with a FIT note, it is possible they may be able to identify that you have used the Push Doctor service only.

However, Push Doctor GPs will not discuss individual cases with employers, insurers or other third parties. This is the case even if you are receiving Push Dr services as a benefit through a third party.

There are some other rare occasions where we may share your data with other organisations.

• We may share information with the police, fire, ambulance and rescue services if:

• There is an immediate risk of harm to you or other people
• There is a legal requirement to do so e.g., where a road traffic offence has been committed or the police have obtained a court order requiring us to provide information

• We may share information with bodies with public health responsibilities such as local councils and Public Health England to control infectious diseases such as meningitis, tuberculosis (TB) or measles and manage public health incidents.

• We may share information with our professional advisors, including lawyers and accountants, if this is necessary to take and receive professional advice (including legal advice), or to bring or defend a legal claim or threatened claim.

• We may share information with our insurers and the insurers of other organisations (including NHS Resolution) where this is necessary to investigate insurance cover and to handle a claim or threatened claim.

• We may share information with individuals or organisations if we are legally required to, for example if this is specified in a warrant or court order.

• Where we, or substantially all of our assets, are merged or acquired by a third party, in which case this information may form part of the transferred or merged assets

The other organisations that we share information with depend on whether you are paying for Push Doctor services or not.

If you receive Push Doctor services through your NHS GP, then we may share your personal information with other organisations that help provide NHS or social care.

These organisations include:

• Your GP practice, for example so that they have a record of your on-line appointment. If you would like to know more about what your GP practice does with the information, we share with them you should look at your GP practice's patient privacy notice. This is normally available on your GP practice's website.

• NHS hospitals

• Organisations that help deliver NHS services outside of hospital

• Private sector organisations that deliver healthcare such as private hospitals, dentists, opticians and pharmacists
• Out-of-hours providers e.g., organisations providing out of hours GP services
• Voluntary sector organisations that deliver healthcare such as charities
• Local councils if social workers are part of your care team, education services, children's services, housing or benefit offices
• Organisations that provide diagnostic tests
• Organisations that provide ambulance or patient transport services such as NHS Ambulance Trusts
• Other organisations involved in the delivery of NHS care, social care or the protection of public health, like Public Health England which oversees cancer screening programmes

If you receive Push Doctor services through your NHS GP and you have agreed to receive information about our services and offers, we may share your information with marketing organisations.

For example, we may share you contact information with companies that we use to send marketing emails. Although we will not share information about your health with these organisations, it may be possible for them to infer this information due to the content of the marketing email. For example, if we are sending you information about how we can help you manage your diabetes, our partners will be able to infer that you have this condition. You can control your settings in your communications preference centre.

You can find your communication preference centre within the Push Doctor app or website under 'Your Account'. From here you can choose the communications you would like to receive from us. You can switch these on or off any time you like.

If you receive Push Doctor services through your NHS GP and you have agreed to receive information about the products and services of third parties that may be relevant to you, we won't share information about you with those third parties. Instead we will let you know information about them so that you can use their products or services if you wish.

If you pay for Push Doctor services yourself

• We will share the record of your on-line consultation with your NHS GP unless you ask us not to. Your preference can be changed in the Account area. We will not share your information with any other providers of NHS care.
• Our IT suppliers will also include our IT service provider, who ensures your medical records are stored securely
• We may share your information with credit reference agencies to help us check your identity
• If you have agreed to receive information about our services and offers, we may share your information with marketing organisations.

If you receive Push Doctor services as a benefit through a third party

• We will share the record of your on-line consultation with your NHS GP unless you ask us not to. Your preference can be changed in the Account area. We will not share your information with any other providers of NHS care.
• Our IT suppliers will also include our IT service provider, who ensures your medical records are stored securely
• We may share your information with credit reference agencies to help us check your identity
• If you have agreed to receive information about our services and offers, we may share your information with marketing organisations.

Our app and the website include some social media features, such as the Facebook button and the 'Share This' button. You can use these features to share information about your use of Push Doctor through social media. The relevant social media site(s) control how these features work. If you want to find out more about this you should read the privacy policy of the relevant social media site.

Where is my data stored?

Most of the time your personal information stays within the UK or European Economic Area (EEA). Sometimes your personal information may be transferred to our partners outside of the UK or EEA with appropriate legal safeguards in place.

How long does Push Doctor keep my personal information for?

Medical information

If you receive Push Doctor services through your NHS GP, clinical information will be stored on your GP practice's electronic patient record system. For information about how long that information is stored, please refer to your GP practice's privacy notice. You can usually find this on their website. Neither Push Doctor nor your Push Doctor GP keeps any medical records about your on-line appointment.

If you pay for Push Doctor services yourself or you are receiving Push Doctor services as a benefit through a third party, clinical information will be stored on Push Doctor systems. Information may be retained for up to 10 years.

Whether you receive Push Doctor services through your NHS GP, or pay for Push Doctor services yourself, or you are receiving Push Doctor services as a benefit through a third party, recordings of consultations will be retained by us for up to 10 years.

Other information

Account information for individuals (including people who have completed the on-line registration process) who have not used our consultation services will be deleted after two years, unless we are required to retain such information for any legal or regulatory reason.

Account information about individuals (for example your name, log in details, summary details of the Push Doctor services you have used, any complaints you have made about our service) who have accessed our services will be kept until two years after they last accessed the services or communicated with us, whichever is later.

If you pay for Push Doctor services yourself or you are receiving Push Doctor services as a benefit through a third party and you have let us know through your communication preference centre that you are happy to receive marketing information, we keep the information we need for marketing for a maximum of 2 years from when you last accessed the Push Doctor website or app.

You can find your communication preference centre within the Push Doctor app or website under 'Your Account'. From here you can choose the communications you would like to receive from us. You can switch these on or off any time you like.

How does Push Doctor keep my information secure?

At Push Doctor we take security and the secure storage of personal data seriously. We encrypt and store all personal data on secure servers using the latest technologies which are protected by several layers of security.

We do not store any of your personal health data on your mobile device or within your web browser storage permanently. We may collect some personal data and store it temporarily on your mobile device or within your web browser storage (e.g. your post-code during the sign-up process) but this data is not kept on your device after the process for which it is being used has ended.

When using the Push Doctor app or website, all your personal data is transmitted through the internet using Secure Socket Layers (SSL) technology. SSL is an industry standard technology designed to prevent any third party from capturing and viewing your personal data while in transit.

You are required to go through a two-step identity verification process to create your account. Access to your account is protected with a password that you create. You are responsible for keeping this password confidential. We strongly recommend that you do not disclose your password to anyone else and Push Doctor will never ask you for your password in any unsolicited communication (including unsolicited correspondence such as letters, phone calls, emails or text messages). You will only ever be able to reset your password using a two-step identity verification process.

For more information on how we keep your data secure, please contact us at support@pushdoctor.co.uk or contact our helpline on 0330 808 4702.

What rights do I have over my personal information?

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

If you receive Push Doctor services through your NHS GP and you want to exercise any of these rights regarding information held in your medical records, you should contact your GP practice. This is because it is your GP practice who holds those records and has control over them.

Your right of access

You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which mean you may not always receive all the information we have about you. You can read more about this right here.

To access a copy of your electronic medical records or other information that Push Doctor holds about you, please contact us at support@pushdoctor.co.uk , 0330 808 4702 or use our live chat feature at https://www.pushdoctor.co.uk/contact

Your right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this right here.

We will not usually amend medical records. This is because it is important that we have a copy of the information available to doctors at the time they are treating you. Instead, we usually add a note to your record to highlight the information you consider to be incorrect.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances. You can read more about this right here.

Again, we will not normally delete information from medical records. This is because it is important that we have a copy of the information available to doctors at the time they are treating you.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here.

Your right to object to processing

You have the right to object to processing if we are able to process your information because the process forms part of public tasks or is in our legitimate interests. You can read more about this right here.

Your right to data portability

This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated. You can read more about this right here.

Your right to withdraw consent

You can control whether or not your personal information is used for marketing in your communication preference centre which can be accessed under 'my account' within the Push Doctor app or website. All accounts are set up so that the user does not agree to the use of their personal information for marketing unless they opt in using the preference centre.

You have the right to withdraw your agreement to the use of your personal information for marketing at any time. You can do this by changing your settings in the preference centre. Doing this means that we cannot use your personal information in the future unless you use the preference centre to opt in again.

You are not required to pay any charge for exercising your rights.

Please contact us at support@pushdoctor.co.uk if you wish to make a request, or contact our helpline on 0330 808 4702.

We may ask you to provide us with identification so that we can be sure that we are dealing with the right person. This is a security measure. We may also contact you to ask you to put your request into writing and/ or for further information in relation to your request to speed up our response.

We try to respond to requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In these cases, we will notify you and keep you up to date about when we expect to be able to respond.

Contact us

If you have any questions, want to exercise your rights or need further information about what we do with personal information, our Data Protection Officer can be contacted by email at dpo@pushdr.com .

You can find also out more about our legal obligations and your privacy rights from the Information Commissioner's Office ("the ICO"). The ICO oversees compliance with privacy laws in the UK.

The ICO can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113

www.ico.org.uk

Complaints

You have the right to make a complaint at any time to the ICO if you are not happy with the way that we have dealt with your personal data or a request from you to exercise your privacy rights.

We would appreciate the chance to deal with your concerns before you approach the ICO, so please contact us at support@pushdoctor.co.uk or 0330 808 4702 in the first instance.

Updating this notice

We may update this notice from time to time. If we plan to update the policy, we will let you know through the Push Doctor website or the Push Doctor app. When you log on to your account, we will also let you know if the notice has been updated since you last accessed Push Doctor services. You should stop using our website and apps if you do not agree to any changes.

This notice was most recently updated in November 2023. To obtain an historic version of this notice please contact us at support@pushdoctor.co.uk or 0330 808 4702.

Cookies

A cookie is a small text file that may be placed on your computer or Device when you visit the Platform. When you next visit the Platform, the cookie allows us to distinguish you from other users. There are two categories of cookies: (a) 'persistent cookies' that remain on your computer or Device until deleted manually or automatically; and (b) 'session cookies' which remain on your computer or Device until you close your browser, when they are automatically deleted.

The cookies Push Doctor uses:

• Essential cookies are required for the operation of the Platform and without them the Platform can't operate properly.
• Performance cookies allow us to see and count the number of visitors to the Platform and what they do during their visit. We use the information from these cookies to improve the Platform's performance. The data from these cookies doesn't allow us to identify you.
• Experience cookies allow the Platform to remember your choices, which means we can personalise your experience of the Platform. Data collection by experience cookies is used by our analytics systems (including third party systems) to monitor and enhance the Platform's user-friendliness.
• Marketing cookies or similar technologies that track and record your visits to the Platform, including but not limited to the actual pages you visit and the links you have clicked or followed. We use this data to make the content of the Platform more relevant to/for you based on what we know about you. We do share information about your activity on the Platform that is stored by these cookies with our agents, agencies and other third-party ad networks and this information can be used to advertise products to you on other sites. Any data we share is anonymous and cannot be used to identify you.

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

You can REFUSE cookies, by activating settings of your chosen browser(s). If you alter your browser settings to refuse cookies your access to the Platform will be restricted. You can also manage your preferences in the Cookie Settings section of our website.

In addition to the cookies, we use on this website, we also use cookies and similar technologies in some emails. These help us to understand whether you have opened an email and how you have interacted with it. We use these to improve our future email communications.

Cookies may be set when you download, open or read an email from Push Doctor If you have:

• configured weak security settings on your device
• added Push Doctor to your safe senders list or address book
• enabled your device to automatically display images, or
• if you click on any link within the email.

If you would prefer for this not to happen, please disable automatic displaying of images, or remove us from your address book or strengthen your security settings. Alternatively, you can set your browser to restrict or reject cookies.