Legal
Privacy notice
How VidaMed handles your personal information, including health information, under UK data protection law.
Draft: this privacy notice is a draft pending legal review. It may change before it is finalised.
1. Who we are
The controller of your personal information is VidaMed (registered company details and ICO registration number to be added). You can contact us at hello@vidamed.co.uk. We are an independent coordination and safety-check service for people travelling abroad for elective surgery.
2. What information we collect
- Contact details, such as your name, email address, phone number and postcode.
- Enquiry details, such as the procedure, package, travel dates and clinic you are considering.
- Health information, such as your medical history, medicines, allergies, test results, height, weight, BMI, ECG results, wound checks and imaging.
- Records of your consultations, consents, aftercare reviews and any concerns or complaints.
- Technical information, such as how you use our website, collected through cookies or similar tools where used.
3. Special category data
Health information is special category data. It needs extra protection and we process it only where we have a lawful basis and a condition under Article 9 of the UK GDPR.
4. Why we use your information and our lawful bases
| Purpose | Lawful basis | Special category condition |
|---|---|---|
| Replying to your enquiry | Consent, or steps at your request before a contract | Not applicable unless you give health details |
| Providing screening, summaries and aftercare | Performance of a contract | Provision of health care, and where relevant explicit consent |
| Sharing your summary with a clinic | Consent | Explicit consent |
| Keeping records and handling complaints | Legal obligation and legitimate interests | Provision of health care, or establishment, exercise or defence of legal claims |
| Marketing, if you opt in | Consent | Not applicable |
| Website analytics and security | Consent or legitimate interests | Not applicable |
Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect processing that took place before.
5. Who we share information with
- UK-registered clinicians (GMC doctors and NMC nurses) involved in your care.
- CQC-registered diagnostic partners that carry out your tests.
- Overseas partner clinics, only with your explicit consent.
- Your GP, only if you ask us to.
- Service providers who help us run our website and systems, under contract and only for our instructions.
- Regulators, courts or other authorities where the law requires.
We do not sell your information.
6. International transfers
If you choose an overseas clinic and consent to sharing, your information will be sent outside the UK. Some countries do not have the same data protection laws as the UK. Where we transfer information, we use appropriate safeguards where available, and we explain the position to you. In some cases the transfer will rely on your explicit consent, given after we have told you of the risks. We share only what is needed.
7. How long we keep information
We keep information only as long as needed for the purposes above. Health records are kept for the period required by professional and legal standards, which our final policy will set out. Enquiries that do not proceed are kept for a shorter period. Retention periods will be confirmed in the final version of this notice.
8. How we protect your information
We use appropriate technical and organisational measures, including restricted access, secure transfer and confidentiality obligations on our clinicians and partners. No system is perfectly secure, and we will tell you and the regulator of any breach where the law requires.
9. Your rights
- To be told how your information is used.
- To access a copy of your information.
- To have inaccurate information corrected.
- To ask for information to be erased, in some circumstances.
- To restrict or object to certain processing.
- To receive certain information in a portable format.
- To withdraw consent at any time.
To use these rights, email hello@vidamed.co.uk. We will normally reply within one month.
10. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
11. Changes to this notice
We will update this notice when needed and publish the new version on this page. For questions about how your information is used by a treating clinic abroad, please read that clinic's own privacy information. See also our terms and safety page.