Privacy Notice

Introduction

Medic One Systems (“we”) are committed to protecting and respecting your privacy.

This notice (together with any terms of use on our website, any contracts, our Data Protection Policy and any other documents referred to in this Privacy Notice) sets out the basis on which any personal data we collect from you, that you provide to us, or that we obtain from other sources, will be processed by us. “Processing” can mean collecting, recording, organising, storing, sharing or destroying data.

Please read this notice carefully to understand how Medic One Systems will process and protect your personal data. This privacy notice also explains your rights when it comes to your data.

By visiting our website, or by providing any information about yourself, you are accepting and agreeing to the terms of this notice.

Medic One Systems may update its Privacy Notice at any time; please check back here regularly to review any changes. Where appropriate we will notify you of any changes by email.

This Privacy Notice has been developed in line with Data Protection legislation (the General Data Protection Regulation and Data Protection Act 2018), the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2426/2003), the guidance and codes of practice issued by the Information Commissioner, and Medic One System’s Data Protection Policy, which is available on our website.

If you have any concerns or questions please contact us at dataprotection@mediconesystems.com or Data Protection, Medic One Systems, 1a Blenheim Terrace, London, NW8 0EH.

What types of information do we hold and process?

So that we can provide a safe and professional service, we need to keep certain records about you.

We may process the following data about you:

Information you give us

This is information you give to Medic One Systems via email, phone, or in person, or by filling in forms on our website. It includes information you provide when you: call us or send us an email; become one of our clients, suppliers or partners; apply for or take a job with us; or register on our website or otherwise to receive any information or communications.

The information you give us may include:

• Personal details including name and title, and date of birth;
• Contact details including address, telephone number and email address;
• Country of nationality and domicile;
• Company or organisation details;
• Qualifications and experience;
• Financial information.

If you provide any information about any other individuals, such as next of kin or colleagues, you warrant to Medic One Systems that you are entitled to provide that information to us, and to authorise us to process it on the same basis as we will process the other information you have provided us about yourself.

Medic One may also, by consent, collect, store and use information about your health or religion should you require it to make reasonable adjustments during your visit to, or employment at, Medic One Systems, or to make resources available.

Information we collect about you

When you visit our website, we will automatically collect the following information:

• Information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time), products you viewed or searched for, page response times, download errors, lengths of visits to certain pages, page interaction information (such as clicks or scrolling), and methods used to browse away from the page.
• Technical information, including the Internet Protocol (IP) address used to connect the computer to the internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.

Information we receive from third parties

If you are a staff member or prospective staff member, we may receive and process your personal data from third parties, such as your employer, recruiters or other employment agencies, former employers, DBS provider, relevant professional bodies, the Home Office, external training and assessment providers. If you are a client staff member, we may receive and process your personal information from your employer.

We may also, as third party Data Processor, process data about individuals transferred to us by other Data Controllers, such as health care providers, which is classified as “special category”. This might include both physical and mental health data. This data will only be processed by Medic One as a result of a contractual agreement with the relevant Data Controller, which will be governed by a data processing agreement that complies with UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018, as well as with the guidance and codes of practice issued by the Information Commissioner. The data will be processed so that Medic One can fulfill its contractual obligations to provide a medical reporting service.

How do we use this information and why?

Medic One processes your data so that it can provide contracted data processing (medical reporting) services to our clients, so that it can provide high-quality support, and so that it can support your current and future relationship with the company.

We only process your data for specified purposes and if it is justified in accordance with data protection law and Medic One’s Data Protection Policy. Below we have listed some of the major purposes for which we will process your personal data, and how we will use this information. There may be other processing in addition to the below but this will always be in accordance with Medic One’s Data Protection Policy and other legal obligations.

Consent

You have given consent to us processing your data for an agreed purpose. If we need to ask for your permission, we will offer you a clear choice and ask that you confirm to us that you consent. We will also explain clearly to you what we need the data for and how you can withdraw your consent at any time.

Special category data

Special category data is sensitive personal information related to physical or mental health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, genetic or biometric data, or personal data relating to criminal convictions and offences.

We will only process special category data for specified purposes and where this is justified by data protection law. Key examples include:

• The processing of your physical or mental health data in order to provide contracted medical reporting services on behalf of a Data Controller (such as a healthcare provider), as specified under a Data Processing Agreement. Medic One will only process this data to the extent necessary to perform contractually agreed data processing services, and will do so in line with data protection legislation, our data protection policies, and the data protection requirements of the Data Controller.
• Where you are an employee, contractor or visitor, the processing of your physical or mental health data (for example, any disability), by consent to make decisions regarding reasonable adjustments. This is necessary so that Medic One Systems can meet its obligations in relation to the Equality Act 2010.
• Where you are an employee/contractor or prospective employee/contractor, we may process information about criminal convictions, reprimands and cautions, where the law requires us to do so. Where appropriate, this information will also be used to assess your suitability to carry out the work for which you are/would be engaged. This processing is necessary for the public interest and to meet our obligations under employment law.  

Legal obligation

We may be legally obliged to process your data under the Health and Social Care Act 2021 or Mental Capacity Act 2005.

Another example of where this legal basis applies is to the processing of personal data that employees provide at the start of, and during, their employment. This information helps us to manage the employment relationship and employee performance. Without this information, Medic One Systems would be unable to follow legal requirements relating to your employment, assess your application, offer you work, and implement reasonable adjustments where required.

Contractual

Our processing of your personal information is justified on the basis of contractual necessity. An example where this legal basis applies is in the processing of personal data of employees and prospective employees. In cases where processing your personal data is a contractual necessity, and you don’t provide Medic One Systems with the personal data needed, we may not be able to process your application or provide you with the employment for which you have been appointed.

Processing of personal data may also be required to carry out any obligations arising with commercial contracts with clients, suppliers or partners, and to provide prospective or confirmed clients, suppliers or partners with the information and services that have been requested from Medic One Services.

Necessary for the legitimate interests of Medic One Systems or a third party

We may process your personal information where this is necessary for our legitimate interests or the legitimate interests of a third party, provided that your interests or fundamental rights and freedoms which require protection of your data do not override those legitimate interests. Our legitimate interests comprise the management and marketing of our business, products and services. For example, we may process information we collect about you via our website to keep our site safe and secure, and to administer our site for internal operations, including troubleshooting.

Other processing

There may be other processing in addition to the above, for example, when you access the Medic One website which uses Cookies. This is done on the basis of our other policies, and Medic One will inform you about such processing at the time when the information is obtained or as soon as possible thereafter.

Cookies

Our site uses cookies to distinguish you from other users of our site. This helps us to provide you with a good experience when you browse our site, and enable us to improve our site. A cookie is a test file that is placed on your hard disk by a web page server. Cookies cannot be used to run programmes or deliver a virus to your computer. They are uniquely assigned to you, and can only be read by a web server in the domain that issues the cookie to you.

You have the ability to accept or decline cookies through your browser settings. If you choose to decline cookies, you may not be able to fully experience the features of the Medic One site.

What information do we share, with whom and how?

So that we can provide you with high quality care and support, we need specific data. This is collected from or shared with you or your legal representative(s), or third parties.

Third parties are organisations we might lawfully share your data with. These include:

• The police or other law enforcement agencies if we have to by law or court order;
• If you are an employee, there may be occasions where we will need to share your data with a third party, for example to third party organisations who process personal data on Medic One’s behalf, including training and assessment providers; government agencies such as UK Visas and Immigration and the Home Office; DBS providers; pension schemes; HMRC; and police or other crime prevention and detection agencies.

How long do we store your personal data?

Our policy is to ensure that personal data is stored for as long as is necessary for the purposes for which it was lawfully captured and processed. This may vary according to the type of information and the specific applicable purpose(s). We will only retain data for as long as it is necessary and for the purposes for which we hold it.

In determining how long we retain your personal data, we take into account: our legal obligations; our contractual obligations; good sector practice; and the guidance of relevant UK authorities such as HM Revenue and Customs, and tax, accounting, health and safety and employment rules.

Further details are set out in our Data Protection Policy and Record Keeping Policy and Procedures.

Security of your personal data

Medic One secures your personal data from unauthorised access, use or disclosure. It secures the personally identifiable data you provide on computer servers in a controlled, secure environment, protected from unauthorised access, use or disclosure. Further information on how we secure data is in our Data and Cyber Security Policy.

What are your rights?

You have various rights under Data Protection legislation. These include:

• The right to ask us not to process your personal data for direct marketing purposes, even if you have given consent;
• The right to withdraw any consent you may have given for our processing of your data - if you exercise this right, we will be required to stop such processing where consent is the sole lawful ground on which we are processing that data;
• The right to ask us for access to the data we hold about you via a Subject Access Request – see our Data Protection Policy for further information;
• The right to ask us to rectify any data we hold about you that is incomplete or inaccurate;
• The right to ask us to delete your data in certain circumstances;
• The right to ask us to restrict our processing of your data in certain circumstances;
• The right to object to our processing of your data in certain circumstances;
• In certain circumstances, the right to require us to give you the data we hold about you in a structured, commonly used and machine-readable format.

How do you exercise these rights?

You can exercise any of these rights free of charge by contacting our Data Protection Officer by email at dataprotection@mediconesystems.com or by post at Data Protection, Medic One Systems, 1a Blenheim Terrace, London, NW8 0EH, United Kingdom.

In exercising any of these rights, we may require more information from you, for example to confirm your identity. Please note that if you submit unfounded or excessive requests to exercise any of these rights, we reserve the right to make a reasonable charge for providing the requested information or taking the requested action, or to decline your request. Further information on exercising your rights can be found in our Data Protection Policy, which is available on our website.

You also have the right to complain to the Information Commissioner's Office (ICO) if you are concerned that we are not respecting your rights under data protection legislation. The ICO is the authority in the UK which is responsible for overseeing the application of, and enforcing, Data Protection Law. Medic One is registered with the ICO (registration number ZA919689).

Further information  

If you have any queries or require further information, please consult our Data Protection Policy or get in touch with our Data Protection Officer by email at dataprotection@mediconesystems.com or by post at Data Protection, Medic One Systems, 1a Blenheim Terrace, London, NW8 0EH, United Kingdom.

Version as at 01/04/2025. Signed off by the Directors of Medic One Systems.