Privacy notice
Privacy notice & data protection
1. Data Controller
Excel Medicine Ltd (company number 16920757) is the data controller for information you provide to us. Our registered office is Suite G05 (Ground Floor), C/O Agnitio, Regus, Malthouse Avenue, Cardiff Gate Business Park, Cardiff, CF23 8RU. We are registered with the Information Commissioner’s Office under reference C1933472.
2. What Information We Collect
We collect your name, date of birth, contact details, delivery address, and confidential health information including medical history, concurrent medications, allergies, and symptom assessments. We also record consultation answers, prescribing clinician notes, dispensary records, identity verification logs, and communication history.
3. Lawful Basis for Health Information
Under UK GDPR, our lawful basis for processing standard personal data is Article 6(1)(b) (performance of a contract). For special category health information, our lawful basis is Article 9(2)(h) (provision of health care or treatment), read with paragraph 2 of Schedule 1 to the Data Protection Act 2018. Your records are handled strictly by registered healthcare professionals bound by legal duties of medical confidentiality.
4. Data Sharing & Third Parties
We share essential data only with authorized partners required to fulfill our healthcare services: delivery couriers (Royal Mail and DPD), verified identity verification providers, secure payment gateways (Stripe), NHS GP notification services (where you provide consent), and regulatory authorities when legally required.
5. Retention & Security
All clinical records are hosted on encrypted UK-based servers. Under UK medical record standards, prescription and consultation records are retained for 8 years following the last treatment date. Financial records are retained for 6 years in compliance with HMRC requirements.
6. No Automated Clinical Decisions
Our digital questionnaire gathers patient symptoms and highlights clinical contraindications for our medical team. However, an algorithm never makes a prescribing decision. Every single consultation is reviewed by a GMC-registered UK doctor who holds full clinical accountability.
7. Your Data Rights
Under UK GDPR, you have the right to request access to your medical records (Subject Access Request), request rectification of inaccurate data, request restriction of processing, and lodge a complaint with the Information Commissioner’s Office at ico.org.uk.
Excel Rx is not an emergency service. If you need medical help quickly, call NHS 111 or contact your GP. If someone is seriously ill or injured, call 999.