Privacy policy

This policy describes personal information involved in using Medocta: browsing, accounts, professional discovery, bookings, service requests, communications, payments and care coordination. The information needed depends on your role and the service you use.

MEDOCTA LTD handles information needed for its platform and service arrangements. A treating professional, clinic, laboratory or other partner may have its own responsibilities for the care and records it provides. Review any privacy information supplied with the selected service. Ask us if you need to identify the organisation responsible for particular information.

People may use Medocta from different countries. The UK rights described here do not mean every service is subject only to UK law. Country-specific and provider-specific information should be read alongside this policy; the linked UK data-privacy notice gives additional UK service context.

Reading a privacy notice is not consent to every use of your information. Consent to clinical care, permission to act for someone else and any optional marketing choices are separate matters.

The information involved depends on the services you use. Sources include information you enter, an authorised representative, the professionals or partners involved in your care, payment confirmations and information generated by platform use.

Provide only information relevant to the service. Use the approved secure service channel for clinical documents. Public posts and general support forms should not contain confidential medical documents or payment credentials.

Required fields are identified on the relevant form. Account, booking or payment information may be needed to identify the right person, contact you or arrange the requested service. If required information is missing, that request may not be completed. Ask the team if you need help or an accessible way to provide it.

A professional may need relevant health information to assess whether a service is appropriate. They should explain what is needed and why. Do not supply extra clinical documents, identity documents or payment credentials in a public post or general enquiry.

Optional profile details, public contributions and marketing choices are separate from the information needed for a particular service. Before publishing an answer, review or professional profile, check what will be visible to others.

Information supports the account or service you request: arranging appointments, checking the relevant recipient and country, enabling care-team communications, administering payment or funding and handling support queries. Professional information supports onboarding, service approval and public profile information.

Other operational uses include access control, fraud and abuse investigation, resolving complaints and keeping transaction or service records. The service you choose determines which of these activities are relevant to you.

Search filters, country approvals and eligibility checks can affect the options displayed. A search result or an automated filter is not a clinical diagnosis. Ask the service team about a decision affecting your access to care or information.

UK data protection law requires a lawful basis for each use of personal information. Account, booking and payment administration can involve carrying out a contract or steps requested before a contract. Security and service administration can involve legitimate interests, while particular records may need to be held to meet a legal obligation. The basis depends on the purpose and the organisation carrying out the activity.

Health information requires an additional condition for use, alongside a lawful basis. Care providers must identify the condition relevant to their service and any associated confidentiality requirements. A healthcare purpose or a general terms checkbox is not, by itself, blanket permission for every use of health information.

Where an activity relies on consent, it should be explained separately so you can make a choice and withdraw that consent. Ask the privacy contact about the purpose, basis and health-data condition applying to your information. Object to direct marketing or ask about other objections using the rights routes below.

Depending on the requested service, information may be handled by the treating professional or care team, a clinic, diagnostic provider, pharmacy or other fulfilment partner; by staff handling the request; and by suppliers supporting hosting, file storage, messaging, calls, email or payments.

The information relevant to each recipient differs. A payment confirmation, professional care record and delivery instruction serve different purposes. Tell us which service you are asking about if you need the recipients or data-sharing arrangements explained.

Public profile details, questions, answers and reviews are visible according to their publication settings. Do not post information publicly that should remain private. Any disclosure required for a legal process, safety concern or safeguarding issue must be considered in its applicable context.

The patient, an authorised representative and the payer may be different people. Paying for a relative, employee or sponsored patient does not automatically grant access to their clinical records, messages or treatment decisions.

A person acting for someone else may need to demonstrate authority and the appropriate consent. For children or people needing assistance, representation and access must reflect the circumstances and the relevant service requirements.

Organisations funding care should agree what administrative or service-use reporting they receive. Funding should not be treated as permission to disclose identifiable clinical details to an employer or sponsor.

Platform and service information can involve more than one system or supplier, including the systems used by treating professionals and partners. A service for someone abroad may involve information being accessed or shared in the countries where the patient, representative or provider is located.

A cross-border service does not, by itself, provide blanket consent to transfer personal information. Applicable transfer requirements and safeguards need to be assessed for the particular processing arrangement. Ask the privacy contact for the relevant processing locations, recipients and information about safeguards.

This notice does not promise that every record, backup or supplier system is hosted solely in the UK. The arrangements relevant to a service should be explained when information is collected or the service is arranged.

Retention depends on the type of record, why it is needed, the service relationship, professional record-keeping requirements, applicable legal duties and any unresolved complaint or claim. Clinical, financial, account and support records may therefore have different retention criteria.

Closing an account is different from deleting every clinical or transaction record. A deletion request needs to consider which organisation holds the information and whether it must retain particular records. Ask us about the retention period or criteria for the information relevant to your request.

There is no single retention period for every service on this page. The responsible organisation should explain any reason for keeping information when responding to a request about that information.

The platform uses browser storage and preferences for functions such as sessions, baskets and selected regional settings. These can include cookies and local storage. Browser controls can clear or block stored information, although doing so may affect sign-in, your basket or remembered preferences.

Optional tracking or communications should be distinguished from what is needed for the requested service. Where consent is required for an optional activity, it needs a separate choice. This page does not provide a cookie-preference switch or claim to change your browser settings.

For a marketing message, use its unsubscribe option where supplied or ask the privacy contact to stop that use. Service confirmations and other necessary account or care communications are different from marketing messages.

Access to information should reflect the role and service involved. Keep your sign-in details private, check recipients before sharing documents and report suspected unauthorised access promptly. General support may need to verify identity or authority before it can disclose information.

Clinical messaging, uploaded documents and any call recording have their own service context. If recording is offered, review the recording prompt and choices; ask the professional about its purpose and how any recording is handled.

If you believe information was sent to the wrong person, an account was accessed without permission or private content was exposed publicly, contact support with the reference and what happened. Do not forward passwords, payment codes or copies of the sensitive information in an ordinary enquiry.

If you arrange care for a child or someone who needs assistance, identify the patient and explain your relationship to them. A service may need to check parental responsibility, consent or another basis for your authority before sharing records or accepting instructions.

The patient's age, capacity, confidentiality needs and applicable service requirements affect how representation is handled. Funding the service or having access to a family member's device is not, by itself, authority to see their information.

A concern about a child's information or an incorrect representative relationship can be raised through the privacy contact. Describe the issue first so the team can direct any supporting evidence to an appropriate channel.

UK data protection rights include access, correction, erasure, restriction, objection and portability where applicable. Which rights apply depends on the information, purpose and lawful basis. In particular, erasure and portability are not unconditional rights to delete or transfer every record.

You can object to direct marketing at any time. Where another use relies on legitimate interests, you can also raise an objection based on your circumstances. Use the request routes below to explain the use you want reviewed.

Requests can be made through support, email or post; using a particular form is not a condition of exercising a right. We may need proportionate identity or authority information before disclosing records. Do not attach identity documents to a general enquiry unless the team has directed you to an appropriate channel.

Describe the information or service involved, what you are asking for and how we can contact you. A booking, order or previous correspondence reference helps identify the records. If you act for someone else, explain your role without including their clinical documents in the initial message.

A support submission sends an email enquiry to the Medocta team. It starts a review; it does not automatically export or erase records, change clinical permissions or create a dashboard ticket. For a request already submitted, continue the existing correspondence rather than starting a duplicate.

Under the UK right of access, the usual response deadline is one month, with rules for identity checks, clarification and permitted extensions. The circumstances of the request affect the deadline. Ask about its status if you have not received a response; a service-support acknowledgement is not completion of a privacy request.

You can raise a data-protection concern with the Information Commissioner’s Office. The ICO provides guidance and its own complaints process; contacting Medocta does not remove that right.

The page revision identifies this version of the notice. Keep a copy if you need it for a request or service arrangement. A revision date does not mean you have consented to a new purpose for using your information.

Read any privacy information supplied for a specific service alongside this notice. If the details appear inconsistent or you need a more accessible format, contact the team so your question can be reviewed.