Privacy Policy

1. Introduction

Protecting your personal data matters to us. "Personal data" means any information relating to an identified or identifiable natural person — your name, your address, your email address, and also the health information you provide when you complete a medical questionnaire on our platform.

This policy explains what we do with that data when you visit our website, create an account, request a consultation, or contact us. It applies to the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, where relevant, to the UK GDPR and the Data Protection Act 2018.

1.1 Who is responsible for your data

The controller for the processing described in this policy is:

DocMedX Ltd, Dept 7018, 196 High Road, Wood Green, London, United Kingdom, N22 8HH

Email: info@docmedx.com · Telephone: +447893932336

Company registration number: 17408698 (England and Wales)

You can reach our data protection officer at info@docmedx.com, marking your message for the attention of the Data Protection Officer.

1.2 Legal bases for processing

We only process personal data where the law allows it. Depending on the situation, we rely on one of the following:

Your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) — in particular for the processing of health data submitted through our questionnaires, for our newsletter, and for non-essential cookies. You can withdraw consent at any time with effect for the future.

Performance of a contract (Art. 6(1)(b) GDPR) — to create and operate your account, to pass your request to a doctor or pharmacy partner, and to process payments.

Compliance with a legal obligation (Art. 6(1)(c) GDPR) — for example commercial and tax record-keeping duties.

Our legitimate interests (Art. 6(1)(f) GDPR) — to keep the platform secure, prevent misuse and fraud, and improve our services. Where we rely on this basis, we have balanced our interest against your rights.

Provision of health care and management of health care systems (Art. 9(2)(h) GDPR) — where health data must be processed so that a treating doctor or dispensing pharmacy can carry out their professional duties.

1.3 Transfers outside the EEA and the UK

We aim to keep personal data within the European Economic Area and the United Kingdom. Where a service provider processes data outside those areas, we only permit the transfer if there is an adequacy decision from the European Commission, or if appropriate safeguards are in place — normally the European Commission's Standard Contractual Clauses together with additional technical measures such as encryption.

You can request a copy of the safeguards we rely on by writing to info@docmedx.com.

1.4 How long we keep your data

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as a statutory retention period requires.

Account data is retained for the life of your account and deleted after closure, unless a longer period applies. Consultation and prescription records are retained in line with the medical documentation duties that apply to the treating doctor and dispensing pharmacy. Invoicing and accounting records are typically retained for up to ten years. Server logs are deleted or anonymised after a short period, normally within 30 days.

When a retention period ends, we delete the data or irreversibly anonymise it.

1.5 Your rights

Under the GDPR you have the right to request access to your personal data (Art. 15), to have inaccurate data corrected (Art. 16), to have data erased (Art. 17), to restrict processing (Art. 18), to receive your data in a portable format (Art. 20), and to object to processing based on our legitimate interests (Art. 21).

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, write to info@docmedx.com. We may need to verify your identity before we act on a request.

You also have the right to lodge a complaint with a supervisory authority — in Germany, the data protection authority of your federal state; in the United Kingdom, the Information Commissioner's Office.

1.6 Data you must provide

Some data is necessary: without an email address and password we cannot create an account for you, and without the answers to a medical questionnaire a doctor cannot assess whether a treatment is appropriate. Where a field is optional, we mark it as such. If you choose not to provide required data, we may be unable to offer the relevant service.

1.7 Automated decision-making

We do not take decisions about your treatment by automated means alone. Our questionnaire may pre-sort or flag answers to help a clinician review them, but the assessment and any prescribing decision is always made by a licensed doctor. There is no automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR.

1.8 Contact requests

If you contact us by email, telephone or through a contact form, we process the details you give us — typically your name, contact details and the content of your message — in order to answer you. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise our legitimate interest in responding to enquiries under Art. 6(1)(f) GDPR. We delete these messages once the matter is closed and no retention duty applies.

1.9 Customer surveys

From time to time we invite users to take part in a survey about the service. Participation is voluntary and based on your consent. Responses are evaluated in aggregate wherever possible, and you may withdraw at any time without disadvantage.

2. Newsletter

If you sign up for our newsletter, we use your email address to send you information about our services, treatments and health topics. We use a double opt-in procedure: after you subscribe, we send a confirmation email and only begin sending the newsletter once you have clicked the confirmation link. We log the time of subscription and confirmation in order to demonstrate that consent was given.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can unsubscribe at any time using the link at the foot of every newsletter, or by writing to info@docmedx.com. After you unsubscribe we remove your address from the distribution list.

3. Data processing on our website

This section describes the processing that takes place when you use docmedx.com.

3.1 Server log files

Each time a page is requested, our servers automatically record technical information: the IP address of the requesting device, the date and time of the request, the page requested, the referring URL, the browser type and version, and the operating system.

We use this data to deliver the site, to diagnose faults and to detect and defend against attacks. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). Log data is deleted or anonymised within 30 days.

3.2 Browsing our information pages

You can read our treatment pages, knowledge centre articles and other public content without creating an account. Doing so involves no processing beyond the server log data described above and any cookies you have consented to.

3.3 Hosting and content delivery

Our website is hosted with infrastructure providers who process data on our behalf as processors under Art. 28 GDPR. A content delivery network may serve static assets from a server geographically close to you, which involves the transmission of your IP address. We have data processing agreements in place with these providers.

3.4 Customer accounts and authentication

To use our services you create an account with an email address and a password. Passwords are stored only as a salted hash and are never visible to us. We process this data to operate your account under Art. 6(1)(b) GDPR.

We also store session information so that you stay signed in between visits. You can delete your account at any time from your dashboard or by writing to us.

3.5 Medical questionnaires and consultations

When you complete a questionnaire for a treatment area, you provide health data — a special category of personal data under Art. 9 GDPR. We process it on the basis of your explicit consent (Art. 9(2)(a) GDPR) and, once a doctor takes on your case, for the purposes of health care under Art. 9(2)(h) GDPR.

Your answers and the record of your treatment are made available to the licensed doctor reviewing your request or holding your consultation. The doctor is the controller of the medical record they create about you and is bound by medical confidentiality. We store that record on the doctor's behalf as a processor under Art. 28 GDPR, under a data processing agreement with each doctor.

Messages you exchange with a doctor or pharmacy through the platform are stored as part of your treatment record so that your care is documented. Your health data is not used for advertising and is not shared with any other party for its own purposes.

3.6 Prescriptions and order fulfilment

If a doctor issues a prescription through the platform, it is stored in your account and, when you order from a partner pharmacy, transmitted to that pharmacy together with the delivery details you have given. You may also take the prescription to any other pharmacy; in that case nothing is transmitted by us.

A doctor may issue your prescription in their own prescribing system and link it to your account by scanning its code. We then store the prescription's identifier and access code encrypted, log every access to it, and release it only to the pharmacy you choose to order from, so that it can retrieve and dispense the prescription. It is not shared with anyone else.

The pharmacy receives only what it needs to dispense and deliver: your name, delivery address, contact details, your date of birth where the law requires it for dispensing, the products ordered and the prescription. The pharmacy is a separate controller for the processing it carries out in fulfilling its own professional and statutory duties, and may not use your data for marketing. Prescriptions follow the applicable national format and rules — in Germany, this includes the requirements governing the Rezept.

3.7 Identity and age verification

Because some treatments are age-restricted or require a positive identification, we may ask you to confirm your identity or date of birth. Where a specialist verification provider is used, that provider acts as our processor and receives only the data needed for the check. The legal basis is Art. 6(1)(c) GDPR where verification is required by law, and otherwise Art. 6(1)(b) and (f) GDPR.

3.8 Payment processing

Payments are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. When you pay, the payment data you enter — card details or the credentials of another payment method — is transmitted directly to Stripe. We do not see or store full card numbers.

Your payment for medicines is charged on the dispensing pharmacy's own Stripe account, and your payment for a consultation on the treating doctor's Stripe account. The pharmacy or doctor is the merchant for that payment and receives from Stripe the information a merchant needs: the amount, the payment method type, the last four digits of the card where shown, and the order or appointment reference. DocMedX receives confirmation that the payment succeeded, the amount, and the platform fee data we need for accounting. DocMedX does not hold your money.

Refunds are issued by our team through the platform from the pharmacy's or doctor's account to the payment method you used. The legal basis for payment processing is Art. 6(1)(b) GDPR and, for accounting records, Art. 6(1)(c) GDPR. Stripe processes your data as an independent controller for its own regulatory purposes under its privacy policy at https://stripe.com/privacy.

3.9 Cookies and similar technologies

Cookies are small text files stored on your device. We use strictly necessary cookies to run the site — for example to keep you signed in, to remember your language, and to record your cookie choices. These are set on the basis of Art. 6(1)(f) GDPR and, where applicable, § 25(2) TTDSG, and cannot be switched off.

All other cookies — analytics, performance and marketing — are set only after you consent through our cookie banner. You can change or withdraw your choices at any time through the banner settings.

3.10 Analytics and marketing tools

Where you have consented, we use analytics tools to understand how the site is used — which pages are visited, how long a visit lasts, and where visitors come from — so that we can improve it. We may also use advertising and conversion measurement tools to assess the effectiveness of our campaigns.

These tools may set cookies and transmit data, including a shortened IP address, to their providers. Some providers are established outside the EEA; in those cases the transfer safeguards described in section 1.3 apply. A current list of the tools in use, their providers and their purposes is available in the settings dialogue of our cookie banner.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TTDSG.

4. Data processing on social media platforms

We maintain profiles on social networks in order to inform and communicate with people who follow us. When you interact with one of our profiles, the operator of the platform processes your data under its own privacy policy and largely for its own purposes, including profiling and advertising. This processing takes place on the platform's infrastructure and is outside our control.

For the processing that we and the platform operator carry out jointly — in particular the aggregated page statistics we receive — we are joint controllers within the meaning of Art. 26 GDPR. You can exercise your rights against us or against the platform operator. The legal basis for our own involvement is our legitimate interest in public communication and outreach (Art. 6(1)(f) GDPR).

Please do not send us health information through social media. Use info@docmedx.com or your account instead.

5. Changes to this privacy policy

We may update this policy to reflect changes to our services or to the law. The current version is always available on this page, and the date at the top shows when it was last revised. If a change materially affects how we process your data, we will notify you separately.

6. Questions and comments

If you have a question about this policy or about how we handle your data, write to info@docmedx.com or to DocMedX Ltd, Dept 7018, 196 High Road, Wood Green, London, United Kingdom, N22 8HH. We will respond as soon as we can, and in any event within the period the law allows.