Healthya

Privacy & Policy

1. IMPORTANT INFORMATION AND WHO WE ARE

1.1 Purpose of this Privacy Policy

  • This privacy notice explains how ADDVantage Digital Solutions Limited (“healthya ConX”, “we”, “us”, “our”) collects, uses, shares, and safeguards your personal data, including any data you provide when using our platform, submitting consultations for review, or interacting with our website and services. It also explains your privacy rights and how the law protects you, including where special category data is processed and where NHS-related consent requirements apply.

1.2 Controller

  • ADDVantage Digital Solutions Ltd (Company No. 07112339) is the data controller for your personal data unless otherwise stated. healthya ConX is a wholly owned subsidiary of ADDVantage Digital Solutions Ltd, Clive House, Clive Street, Bolton, BL1 1ET, United Kingdom.
  • We are registered as a data controller with the Information Commissioner's Office (ICO) under registration number ZB860085.
    • Data Protection Officer (DPO):
    • Simon Green
    • Email: dpo@healthya.co.uk
  • Where we process patient data on behalf of healthcare organisations or other customers, we act as a data processor and process that data only in accordance with written instructions from the relevant controller.
  • For clients based in the European Union or the UK, where a representative is required, the relevant contact details are:
    • ADDVantage Digital Solutions Ltd, Clive House, Clive Street, Bolton, BL1 1ET
    • Email: CS@healthya.co.uk

1.3 Contact Details

  • If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact us at dpo@healthya.co.uk.
  • You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

1.4 Changes to the Privacy Notice and your Duty to Inform us of Changes

  • This version was last updated in June 2026 and historic versions can be obtained by contacting us.
  • It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

1.5 Third Party Links

  • This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

2. HOW IS YOUR PERSONAL DATA COLLECTED

We use different methods to collect data from and about you including through:

2.1 Direct Interactions

  • You may give us your Identity, Contact, Professional, and Patient Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:
    1. Apply for our products or services;
    2. Create an account on our platform;
    3. Subscribe to our service or publications;
    4. Request marketing to be sent to you;
    5. Enter a competition, promotion or survey;
    6. Give us feedback or request support;
    7. Submit consultations or request clinical review;
    8. Provide specific consents for NHS data sharing and clinical services;
    9. Participate in clinical governance or quality improvement activities.

2.2 Automated Technologies or Interactions

  • As you interact with our platform, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our Cookie Policy in Section 10 for further details.

2.3 Third Parties or Publicly Available Sources

  • We may receive personal data about you from third parties and public sources, including:
    • Technical Data from the following parties:
      1. Analytics providers such as Google;
      2. Search information providers such as Google.
    • Identify and Contact data from the following sources:
      1. Data brokers or aggregators such as healthcare industry databases;
      2. Publicly available sources such as Companies House, professional registers including GPhC, GMC, NMC, and pharmacy or clinic websites;
      3. NHS systems including NHS Spine, NHS England, NHSBSA, and Integrated Care Boards;
      4. PMR systems such as EMIS Health, Phoenix, and Positive Solutions;
      5. Payment processors such as Stripe;
      6. Independent clinical reviewers and contracted healthcare professionals.

3. HOW WE USE YOUR PERSONAL DATA

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

  • Where we need to perform the contract, we are about to enter into or have entered into with you.
  • Where it is necessary for our legitimate interests, provided your interests and fundamental rights do not override those interests.
  • Where we need to comply with a legal or regulatory obligation.
  • Where you have provided consent and we rely on consent as the lawful basis.
  • Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
  • Where processing is necessary to protect vital interests.

Generally, we do not rely on consent as our primary lawful basis for processing personal data other than for direct marketing and some analytics cookies. Where we do rely on consent, you may withdraw consent at any time by contacting us at DPO@healthya.co.uk.

3.1 Purposes for which we will use your personal data

  • We have set out below the ways we use your personal data, the categories of data used, the lawful basis we rely on, including where Article 9 conditions apply to special category data, and the retention periods where these are determinable. Where more than one lawful basis applies to a processing activity, the specific basis used will depend on the facts of the processing and will be recorded in our internal records.

Purpose/Activity

Type of Data

Lawful Basis for Processing (including Article 9 condition where relevant)

Data Retention Period

To register you as a new customer

  1. Identity, Contact, Professional

Performance of a contract; legal obligation where regulatory verification is required

For the duration of the contract and 7 years thereafter for regulatory and audit purposes

To verify professional credentials and regulatory status

  1. Identity, Professional , Contact
  1. Performance of a contract; legal obligation; public interest in healthcare safety where applicable

For the duration of the contract and 7 years thereafter

To process and deliver clinical services, including NHS Pharmacy First consultations, private consultations, PGD utilisation, prescription management and NHS claims reporting

Identity, Contact, Patient Data, Clinical Data, NHS Data, Transaction Data

Performance of a contract; legal obligation for regulatory and NHS reporting; Article 9(2)(h) where special category data is processed, or other applicable Article 9 condition where required

Clinical records retained in line with the NHS Records Management Code and applicable law; NHS claims and reporting retained in line with contractual and statutory requirements

To facilitate consultation review by independent clinicians

Patient Data, Clinical Data, PSQ responses, Anonymised Identity Data, Clinical Review Data

Performance of a contract with the submitting organisation; public interest in healthcare provision; consent where required

12 months from review completion for audit and quality assurance unless longer retention is required by contract or law; anonymised outputs may be retained indefinitely

To obtain and manage patient consents, including GP practice information sharing, NHS reporting and pharmacy referrals

Consent Records, Identity, Contact, Clinical Data

Legal obligation where required by NHS or statutory frameworks; performance of a contract in other contexts; consent where used

7 years from consent withdrawal or contract termination unless a longer statutory retention period applies

To manage payments, fees and charges, subscriptions, consultation fees, module charges, SMS/API fees and debt collection

Identity, Contact, Transaction Data, Usage Data

Performance of a contract; legitimate interests in managing finances and recovering debts; legal obligations for tax and accounting

7 years from the end of the financial year for HMRC and accounting compliance, or as required by law

To manage our relationship with you, including account management, support, notifications of changes, surveys and reviews

Identity, Contact, Professional, Usage Data

Performance of a contract; legitimate interests in maintaining customer relationships and improving services

For the duration of the contract and typically 2 years thereafter unless otherwise required

To conduct analytics, reporting, service improvement and NHS reporting

Technical, Usage, Anonymised Clinical Data where appropriate

Legitimate interests in understanding service use and improving outcomes; legal obligation where NHS reporting is require

Anonymised data may be retained indefinitely; identifiable data retained only as necessary and in line with other retention rules

To provide marketing communications and educational content

Identity, Contact, Professional, Usage

Consent for promotional direct marketing; legitimate interests for non-promotional product-related communications and mandatory clinical updates

Until consent withdrawal or 24 months after last engagement for promotional marketing, subject to preferences and opt-outs

To deliver relevant platform content and improve user experience

Identity, Contact, Professional Data, Usage Data, Technical

Legitimate interests in studying use of our products and services, developing them and informing strategy

For the duration of the contract, then anonymised where appropriate

To make recommendations about services and clinical best practice

Identity, Contact, Technical, Usage, Professional Data

Legitimate interests in developing our products and services, supporting clinical practice improvement and growing our business

For the duration of the contract and 12 months thereafter

To comply with legal, regulatory, safeguarding, and public interest obligations

All categories as required

Legal obligation; public interest; vital interests where necessary

Retention as required by law, regulation or the relevant authority

3.2 Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

We may use your Identity, Contact, Technical, Usage and Professional Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

You will receive marketing communications from us if you have requested information from us or purchased services from us or if you provided us with your details when you entered a competition or registered for a promotion and, in each case, you have not opted out of receiving that marketing.

We will get your express opt-in consent before we share your personal data with any company outside of healthya ConX for marketing purposes.

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at dpo@healthya.co.uk.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a service purchase or other transaction.

3.3 Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of this platform may become inaccessible or may not function properly. For more information about the cookies we use, please see our Cookie Policy in Section 10.

3.4 Change of Purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you want an explanation of how the processing for the new purpose is compatible with the original purpose, please contact us at dpo@healthya.co.uk.

If we need to use your personal data for an unrelated purpose, we will notify you explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law.

4. DISCLOSURES OF YOUR PERSONAL DATA

4.1 We may share your personal data with the parties set out below for the purposes described in Section 4:

  • 4.1.1 External third parties as set out in the Glossary.
  • 4.1.2 NHS England, NHSBSA, ICBs, CQC, GPhC, GMC, NMC, and other regulatory authorities for compliance, claims, reporting, safeguarding, and audit purposes.
  • 4.1.3 Service providers acting as processors who provide IT and system administration services.
  • 4.1.4 Professional advisers acting as processors or joint controllers, including lawyers, auditors, and insurers.
  • 4.1.5 HM Revenue & Customs, regulators, and other authorities.
  • 4.1.6 ADDVantage Digital Solutions Ltd, our parent company, for corporate governance, legal compliance, and business administration.
  • 4.1.7 Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. If a change happens to our business, the new owners may use your personal data in the same way as set out in this privacy notice.

4.2 We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

4.3 We will only use your personal data for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

4.4 Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS England. NHS England is the controller for any personal information you provided to NHS England to get an NHS login account and verify your identity and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS England (as the “controller”) when verifying your identity. To see NHS login’s Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.

4.5 Mandatory Disclosures and Exceptions to Confidentiality

  • 4.5.1 Statutory and Legal Framework
    • Notwithstanding our commitment to confidentiality and data protection, healthya ConX and healthcare providers using the platform may be legally required or professionally obligated to disclose personal data and Patient Health Information without consent where disclosure is mandated by law, regulation, or overriding public interest.
  • 4.5.2 Circumstances Requiring Mandatory Disclosures
    • 4.5.2.1 Court Orders ad Legal Proceedings
      • Compliance with court orders, subpoenas, warrants, or legal proceedings
      • Production orders from regulatory authorities and law enforcement agencies
      • Criminal investigations where legally mandated under Police and Criminal Evidence Act 1984
    • 4.5.2.2 Safeguarding and Protection of Vulnerable Persons
      • Suspected child abuse or neglect under Children Act 1989 and Children Act 2004
      • Adult safeguarding concerns under Care Act 2014
      • Domestic violence, modern slavery, and serious harm prevention
      • Mental Capacity Act 2005 best interests’ determinations
    • 4.5.2.3 Public Health Protection and Disease Control
      • Notifiable diseases under Health Protection (Notification) Regulations 2010
      • Infectious disease outbreak management and contact tracing
      • Food poisoning, contamination incidents, and public health emergencies
    • 4.5.2.4 Professional Regulatory and Fitness to Practice
      • GPhC fitness to practice investigations
      • GMC serious professional misconduct cases
      • NMC professional standards investigations
      • Pharmacy inspections, compliance audits, and regulatory enforcement
    • 4.5.2.5 NHS Fraud, Financial Crime and Security
      • NHS Counter Fraud Authority investigations
      • NHSBSA fraud detection and prevention
      • Prescription fraud, medicine diversion, and controlled drug offences
    • 4.5.2.6 Patient Safety and Clinical Governance
      • Serious incidents requiring investigation under NHS England guidance
      • Never events and serious patient safety incidents
      • CQC regulatory inspections and investigations
      • Clinical negligence claims and patient harm cases
  • 4.5.3 Public Interest and Emergency Disclosures
    • 4.5.3.1 Overriding Public Interest
      • Prevention of serious crime, terrorism, or threats to national security
      • Protection of public safety, welfare, and essential infrastructure
      • Prevention of serious harm to vulnerable individuals
      • Maintenance of healthcare system integrity
    • 4.5.3.2 Whistleblowing and Protected Disclosures
      • Patient safety concerns and clinical risks
      • Professional misconduct and regulatory breaches
      • Fraud, corruption, and serious financial irregularities
  • 4.5.4 Professional Duty of Care
    • 4.5.4.1 Clinical Best Interests
      • Information may be shared where it is in the patient's best clinical interests
      • Where the patient lacks capacity under Mental Capacity Act 2005
      • Where emergency treatment is required to save life or prevent serious harm
    • 4.5.4.2 Duty to Warn
      • To prevent serious harm to the patient themselves
      • To protect identifiable third parties at immediate risk
      • To protect public health and community safety
  • 4.5.5 Documentation and Accountability
    • All mandatory disclosures will be:
      • Fully documented with specific legal basis identified
      • Reviewed by appropriate clinical, legal, or designated personnel
      • Limited to the minimum information necessary
      • Subject to regular audit and governance processes
    • Where legally permitted, individuals will be informed of mandatory disclosures before or after disclosure, unless notification is prohibited by law.
  • 4.5.6 Legal Framework Compliance
    • All mandatory disclosures comply with:
      • UK GDPR Article 6 (lawful bases) and Article 9 (special category data)
      • Data Protection Act 2018
      • Common Law Duty of Confidentiality exceptions
      • Human Rights Act 1998
      • Professional regulatory standards and codes of conduct
  • 4.5.7 Future Legal and Regulatory Changes
    • This section covers current legal requirements as of the effective date. healthya ConX reserves the right to make mandatory disclosures as required by future legislation, regulatory changes, or emergency powers, conducted in accordance with applicable legal safeguards.

All mandatory disclosures will be documented, limited to the minimum necessary, reviewed by appropriate personnel and subject to governance and audit processes. Where legally permitted, individuals will be informed of mandatory disclosures before or after disclosure unless notification is prohibited by law.

5. INTERNATIONAL TRANSFERS

  • Some of our external third parties are based outside of the UK so their processing of your personal data will involve a transfer of data outside the UK.
  • Whenever we transfer your personal data outside of the UK, we ensure a similar degree of protection is afforded to it by ensuring that appropriate safeguards are in place, which may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum, or other lawful transfer mechanisms.
  • Where we use service providers in the United States, we will also consider whether a valid Data Privacy Framework certification or equivalent safeguard applies.
  • NHS patient data is subject to additional restrictions and may only be transferred internationally where specifically permitted by NHS requirements and with appropriate safeguards.
  • Please contact us at dpo@healthya.co.uk (mailto:dpo@healthya.co.uk)if you want further information on the specific mechanism used when transferring your personal data outside the UK

6. DATA SECURITY

  • We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. These measures include:
    • 6.1 Appropriate technical and organisational safeguards.
    • 6.2 Encryption of data in transit and at rest.
    • 6.3 Role-based access controls and multi-factor authentication.
    • 6.4 Regular security testing and vulnerability management.
    • 6.5 Staff training on data protection and cyber security.
    • 6.6 Incident response and breach notification procedures.
    • 6.7 Network and access segregation for sensitive data where appropriate.
    • 6.8 Continuous security monitoring and threat detection.
  • We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and are subject to a duty of confidentiality.
  • We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.

7. DATA RETENTION

7.1 How Long will you use my Personal Data for?

  • We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting, safeguarding and NHS record-keeping requirements.
  • In deciding how long to keep data, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for processing and the relevant legal requirements.
  • Retention periods include:
    • 7.1.1 Clinical Records: retained in accordance with the applicable NHS Records Management Code and service-specific requirements.
    • 7.1.2 User Account Data: 7 years post-termination for tax, audit and governance purposes where required.
    • 7.1.3 Consultation Review Logs: 12 months from resolution or closure unless longer retention is required by contract or law.
    • 7.1.4 Financial and Transactional Data: 7 years for statutory accounting and tax purposes.
    • 7.1.5 Marketing Data: until consent is withdrawn or 24 months after last interaction.
    • 7.1.6 Consent Records: 7 years from withdrawal or end of relationship unless a longer period is required by law or contract.
    • 7.1.7 NHS Contract Management Data: retained for the period required by the relevant contract, law or guidance.
    • 7.1.8 Professional Registration Verification: retained for the duration of the contract plus 7 years.
  • Where records are anonymised, they may be retained indefinitely for research, statistics or service improvement because they no longer identify an individual.

8. YOUR LEGAL RIGHTS

Under certain circumstances, you have the following rights under data protection laws in relation to your personal data:

  • a. Request access to your personal data
  • b. Request correction of your personal data
  • c. Request erasure of your personal data
  • d. Object to processing of your personal data
  • e. Request restriction of processing your personal data
  • f. Request transfer of your personal data
  • g. Withdraw consent at any time where we are relying on consent

8.1 Special Considerations for NHS Data

  • Certain rights may be restricted where data is processed for NHS healthcare provision, regulatory compliance, or public health purposes. We will explain any restrictions that apply when you make a request.
  • If you wish to exercise any of the rights set out above, please contact us at dpo@healthya.co.uk, setting out the details of your request.

8.2 No Fee Usually Required

  • You will not usually have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in those circumstances.

8.3 What we may need from you

  • We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

8.4 Time Limit to Respond

  • We aim to respond to all legitimate requests within one month. Occasionally it may take longer if your request is particularly complex or you have made a number of requests. In that case, we will notify you and keep you updated.

9. CONSENT FRAMEWORK FOR NHS SERVICES

9.1 Service Consents

  • As part of using healthya ConX services, patients and healthcare providers may be asked to provide specific consents or acknowledgements depending on the service being used. The platform captures and records relevant consent categories with audit trails where required.
  • Examples may include:
    • i. Consent for the service provider to share information about the consultation.
    • ii. Consent for the healthcare provider to share information with the patient’s GP practice where applicable.
    • iii. Consent for reporting information to NHS England, NHSBSA or relevant commissioning bodies where required.
    • iv. Consent for a third person to be present in the consultation room where applicable.
    • v. Consent to forward a referral to another community pharmacy where applicable.
    • vi. Consent for the pharmacy sharing information with NHSBSA and NHS England for contract management and post-payment verification where applicable.

9.2 Consent Management

  • a. All consents are captured electronically within the platform with full audit trails.
  • b. Patients and service users can withdraw specific consents at any time, although this may limit the services that can be provided.
  • c. Healthcare providers are required to explain the implications of withholding consent before services commence where that is relevant to the service.
  • d. Consent records are maintained for the duration specified in Section 8.

10. COOKIE POLICY

10.1 Use of Cookies

healthya ConX uses cookies and similar technologies to ensure secure operation, enable essential features, and improve user experience.

10.2 Types of Cookies

10.2.1 Essential Cookies

  • Session Cookies: Maintain secure login state and session continuity.
  • CSRF-Token Cookies: Protect against cross-site request forgery.
  • Authentication Cookies: Secure authentication and access control.

10.2.2 Analytics Cookies

  • Analytics cookies: help us understand how users interact with the platform and improve services, where enabled and lawful.

10.2.3 Consultation Review Cookies

  • Session cookies used to securely link the submitting clinician, reviewing clinician and consultation data for audit purposes; these do not contain patient-identifiable information and expire after review completion.

10.2.4 NHS Integration Cookies

  • Cookies or tokens that support secure NHS connectivity, where used, with expiry periods based on system and security requirements.

10.2.5 Consent Management Cookies

  • Cookie preference cookies that record your choices and preferences.

10.2.6 Marketing Cookies

  • Used only with explicit consent where applicable for newsletters or service updates.

10.3 Managing Cookies

  • You can manage cookie preferences at any time via the platform's cookie consent manager or your browser settings. Disabling essential cookies may affect platform functionality and where relevant, NHS integration capabilities.

11. YOUR LEGAL RIGHTS, COMPLAINTS AND REGULATORY CHANGES

Under certain circumstances, you have the following rights under UK GDPR and the Data Protection Act 2018 in relation to your personal data:

  • a. Request access to your personal data.
  • b. Request correction of the personal data we hold about you.
  • c. Request erasure of your personal data.
  • d. Object to processing of your personal data.
  • e. Request restriction of processing of your personal data.
  • f. Request transfer of your personal data to you or to a third party.
  • g. Withdraw consent at any time where we are relying on consent to process your personal data.

If you wish to exercise any of the rights set out above, please contact us at dpo@healthya.co.uk, setting out the details of your request. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data or to exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

We aim to respond to all legitimate requests within one month. Occasionally it may take longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You will not usually have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

Certain rights may be restricted where personal data is processed for NHS healthcare provision, regulatory compliance, safeguarding, public health purposes, or where disclosure would undermine a legal obligation or serious security requirement. We will explain any restriction that applies when you make a request.

If you have concerns about how we handle your personal data, please contact us first so that we can try to resolve the issue promptly. You also have the right to complain to the Information Commissioner’s Office at any time.

This privacy policy is reviewed annually and as required by changes in law, NHS requirements, security expectations, regulatory guidance, or our processing activities. Where material changes affect your rights or our obligations, we will update this policy and notify users where required by law.

This policy should be read alongside our clinical governance, data security, safeguarding, and NHS operational requirements, and nothing in it limits any legal obligation to protect patient safety, confidentiality, safeguarding, or statutory reporting.

12. GLOSSARY

  • Accountability Principle - The requirement for organisations to be responsible for, and able to demonstrate, compliance with the UK GDPR and DPA 2018.
  • Aggregated Data - Statistical or demographic data derived from personal data but not considered personal data in law because it does not directly or indirectly reveal an individual's identity.
  • Anonymisation - Information that does not relate to an identified or identifiable individual and is not subject to UK GDPR obligations.
  • Consent - A freely given, specific, informed and unambiguous indication of a person's wishes by which they signify agreement to the processing of personal data.
  • Controller - The person or organisation who decides how and why to process personal data.
  • Data Processor - A person or organisation who processes personal data on behalf of a controller.
  • Data Protection Impact Assessment (DPIA) - A process to help identify and minimise the data protection risks in high-risk processing.
  • Data Subject - The identified or identifiable living individual to whom personal data relates.
  • Data Sharing - The disclosure of personal data by transmission, dissemination or otherwise making it available to another party.
  • DPA 2018 - The Data Protection Act 2018.
  • Individual Rights - The rights under UK GDPR, including access, rectification, erasure, restriction, portability, objection, not to be subject to automated decision-making, and to be informed.
  • Lawful Basis - The legal grounds for processing personal data under UK GDPR, including consent, contract, legal obligation, vital interests, public task, and legitimate interests.
  • Legitimate Interest - The interest of an organisation in conducting and managing its business in a way that enables it to provide the best service and the best and most secure experience.
  • Personal Data - Any information relating to an identified or identifiable natural person.
  • Processing - Any operation performed on personal data, such as collection, storage, use, disclosure, or deletion.
  • Profile Data - Information about a person's interests, preferences, feedback, and survey responses.
  • Pseudonymisation - Processing personal data so that it can no longer be attributed to a specific person without additional information kept separately.
  • Special Category Data - Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, or data concerning a person’s sex life or sexual orientation.
  • Sub-processor - A third party engaged by a processor to process personal data on behalf of the controller.
  • UK GDPR - The UK version of the General Data Protection Regulation, as amended and incorporated into UK law.
  • Third Parties - Organisations or individuals not part of healthya ConX or its group companies, including service providers, professional advisers, NHS bodies, and regulators.
  • Your Legal Rights - Your rights under UK GDPR and DPA 2018, including the right to access, correct, erase, restrict, object, and transfer your personal data, and the right to withdraw consent.

This Privacy Policy is reviewed annually and as required by changes in law or processing activities.

© 2026 ADDVantage Digital Solutions Ltd t/a healthya ConX. All rights reserved.