Loading
Loading
At MediShout, we are committed to safeguarding the privacy and security of the personal data entrusted to us. This Privacy Policy details what personal data we collect and how we use it.
We may process different kinds of personal data which we have categorised as follows:
Identity Data: This may include first name, maiden name, last name, marital status, title, date of birth and gender.
Contact Data: This may include email addresses and telephone numbers.
Technical Data: This may include internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our application and website.
Usage Data: This may include information about how you use our website, products and services.
Marketing and Communications Data: This may include your preferences in receiving marketing from us and your communication preferences.
Aggregated Data: This may include statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website or application feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.
Special Categories of Personal Data: This may include health and vulnerability related data.
Location Data: This may include data about your location.
Medishout processes personal data as a Data Controller for the following purposes:
Medishout is a Data Processor for all data processed by us or our sub-processors on behalf of our customers. In these cases, our customer is the Data Controller and their Privacy Policy governs how that data is collected and used. Our processing obligations in these instances are strictly governed by the Data Processing Agreement we have in place with each customer.
We use this data for the following purposes:
Medishout may share personal data externally to the business. Where we choose to share your information, we shall do so for the following reasons:
Where we have your “Consent” to do so. Where we process your data under the consent lawful basis you have the right to withdraw consent. Please refer to “Your right to withdraw consent” below;
Where necessary to fulfil the services and/or products we are contracted to provide to our clients;
Where we have a “Legal obligation” and are required by law and to law enforcement agencies, judicial bodies, government entities, tax authorities or regulating bodies around the world, this includes communicating with you to update you about our Privacy Policy and changes to how we process your personal data;
Where we have “Legitimate interest” to do so, including;
For the purposes listed in the controller activities table in this Privacy Policy;
For reporting, analytics and service improvement purposes across our trading styles and/or within any future group construct should Medishout Ltd establish or become part of a group;
Where required for a proposed sale; reorganisation; transfer; financial arrangement; asset disposal; or any other transaction relating to our business and/or assets held by our organisation.
Where we choose to share your personal data with third-parties, we take appropriate steps to ensure your data is protected. This includes requiring them to:
Abide by the requirements of all relevant data protection and privacy legislation;
Treat your information as carefully as we would;
Only use the information for the purposes it was supplied (and not for their own purposes or the purposes of any other organisation); and
Allow us to carry out checks to ensure they are doing all these things.
If you provide your data through a third party, we may share data with that lead provider in order to assist with the management of the services and to streamline customer contact.
We may have to disclose your personal data with other third parties as set out below. These organisations or bodies will not use your information to contact you. These third parties will be subject to obligations to process your personal information in compliance with the same safeguards that we deploy.
HM Revenue & Customs: We’re required to disclose certain data with the HMRC.
There may be other regulators and authorities such as Solicitors and Accountants, acting as processors based in the UK who require reporting of processing activities in certain circumstances.
We may share your personal data with trusted third-party providers who help us deliver our services. For example, accounting, project management or compliance tools. These third-parties are only permitted to process your personal data in accordance with our instructions and are contractually bound by strict data protection and security standards.
A list of our third-parties is set out below:
Medishout Ltd may transfer personal data to countries outside of the UK and the EEA.
Where this is the case, Medishout Ltd will only transfer data to a country deemed adequate by the UK ICO or will put in place EU Standard Contractual Clauses combined with the UK Addendum or a UK International Data Transfer Agreement with the Data Controller or Data Processor which contractually obliges them to protect your information to the same standard required by the General Data Protection Regulation and Data Protection Act 2018.
Where we transfer data to vendors in the United States, we may also rely on the UK Extension to the EU-U.S. Data Privacy Framework.
Medishout Ltd maintains a retention schedule which defines how long we will store your personal data. We will only store personal data for as long as we have a legitimate need to retain it, either for statutory/legal reasons or because we need the data to be able to provide you with services or for other legitimate business needs.
When we no longer need this information, we will anonymise your data and/or dispose of it securely.
Personal data may be held in paper and/or electronic format. Email correspondence and any notes from meetings are stored electronically. We may also retain information in spreadsheets or other systems which assist us with administration.
Unless subject to an exemption under legislation, you have the following rights with respect to your personal data:
Your right of access. You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. In most cases Medishout Ltd will not charge for this service however we do have the right to charge an administrative cost should we feel the request is excessive (excessive means that you submit a subject access request multiple times for the same or similar information). Fees will not exceed £50. Information will be provided within 28 calendar days from the day you request it. We will take all reasonable steps to verify your identity before providing you with details of any personal information we may hold about you.
Your right to withdraw consent: Where you have given consent for processing, you have the right to withdraw this consent at any time, but this will not affect the lawfulness of processing based on consent before its withdrawal.
Your right to rectification: You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
Your right to erasure: You have the right to ask us to erase your personal information in certain circumstances.
Your right to the restriction of processing: You have the right to ask us to restrict the processing of your information in certain circumstances.
Your right to object to processing: You have the right to object to processing if we are able to process your information because the process forms part of our public task, or is in our legitimate interests.
Your right to data portability: This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
You can read more regarding your individual rights and how to exercise them, here.
If you wish to exercise any of your individual rights, you can do so via the support team by emailing dpo@medishout.co.uk.
MediShout Ltd does not currently use automated decision-making tools or profiling in the processing of your personal data.
If you are in the EU, you can contact MediShout Ltd through our EU Representative using the contact details below:
EU Representative
DPO Centre Europe Limited
10 Place Vendôme,
75001 Paris,
France
Email: eurep@medishout.co.uk
Phone: +33 1 53 45 54 72 (answered in French and English)
You have the right to lodge a complaint with the UK’s Supervising Authority, The Information Commissioners Office, or the Supervisory Authority in the EU member state where you reside. We would, however, appreciate the chance to deal with your concerns before you approach the Supervisory Authority so please contact us in the first instance by writing to:
Data Protection Officer
MediShout Limited
6th Floor Spaces,
2 Lakeside Drive,
First Central 200,
London
NW10 7FQ
Email: dpo@MediShout.co.uk
If your complaint has not been resolved, you can lodge a complaint with the Information Commissioner’s Office by writing to:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire.
SK9 5AF.
Website: https://ico.org.uk/global/contact-us/
Phone: 0303 123 1113
We continually review our Privacy Policy and update it where necessary. We advise that you regularly check our Privacy Policy for updates. We do not wish to bother you with lots of minor amendments, but where we make significant changes to our policy, we may contact you to inform you. We may also notify you in other ways from time to time about the processing of your personal information.
This Privacy Policy is version 2.4 and is valid from 00:01hrs on 07th August 2026. It replaces and supersedes all other Privacy Policies associated with MediShout Ltd.
No more switching between helpdesks, phone calls, emails or paper lists. With MediShout, everything is in one App.
