Privacy policy

Personal data processed

Personal data is any information we have that can identify you, such as your name, date of birth, medical history or credit card details.

Our data retention period, which is the length of time we hold your personal data, is informed by the Department of Health, NHS England and professional bodies such as the British Medical Association and The Health and Care Professions Council.

We might also keep some information that doesn’t identify you to help improve our business and our services as well as helping with health research. We do this by removing your identifiable information (such as your name, date of birth, contact details) to form ‘de-identified’ data.

In accordance with national opt-out legislation, you can choose to opt out of your confidential information being used for research and planning. For more information on this, please visit the NHS data opt-out website.  If you have any concerns about this or wish to change your data preferences, please email the Governance team at ClinicalGovernance@healios.org.uk or call 0330 088 3127 between 8:30am to 4:30pm Monday through to Friday.

We process the following personal data for the purposes listed. Where we use personal data, we will only use the minimum necessary personal data for that purpose.

How to unsubscribe from our marketing communications

You may unsubscribe from our marketing communications by clicking on the “unsubscribe” link at the bottom of our emails or emailing the Data Protection Lead at dpo@healios.org.uk.

Please note customers cannot opt-out of receiving transactional emails related to their account or service with Healios.

To learn about how we use your information, read our child-friendly privacy policy.

Personal data processed

For website users and social media platforms, where we rely on GDPR Article 6(1)(f) our legitimate interests are as follows:

1. Marketing our products, services and research.

If you are a visitor to our website, Healios, trading as Melios, will also process personal data using cookies.

We use cookies on our websites (melios.org.uk and healios.org.uk) to help in order for the websites to run and to provide a more personalised service to you. This policy describes how we use cookies and your options in regard to them.

What are cookies?

Cookies are a small piece of text which is downloaded on a device (such as a computer or mobile phone) when a user accesses a website which allows the website to understand the users preferences or past actions.

Healios uses a number of these cookies as outlined below. Healios will always ask for your consent before placing these cookies on your device, except where the cookie is necessary in order for our website to function. These are called ‘strictly necessary’ cookies.

All other cookies can be controlled via our cookie management system, which is available on our website pages.

We have outlined below the types of cookies we use, their purpose and how long the cookie is kept on your device.

Where you have consented to all non-strictly necessary cookies, you may withdraw this at any time by using our cookie management platform.

You may also contact us at admin@healios.org.uk and hello@melios.org.uk if you have any queries regarding the processing.

Strictly Necessary Cookies

We have two cookies that we use which are necessary to run our site. The purpose of these cookies are outlined below:

Preferences Cookies

We operate the following cookies which allow you to set preferences regarding the use of our site:

Analytical Cookies

We use the following cookies to analyse visitors to our website:

Advertising

We use the following cookies for advertising:

The UK GDPR allows various rights for people whose data is being processed. The rights are not absolute and so sometimes do not apply. Where you wish to exercise any of your rights, you may do so free of charge (unless in specific circumstances, where you will be informed in advance) by contacting us at governance@melios.org.uk. We will respond within one month.

Details of the rights within UK GDPR are below. You will be informed if the right is available to you upon application:

If you have any complaints regarding our use of personal data, please contact us by one of the above means. In the event we cannot resolve your complaint, you have the right to complain to the Information Commissioners Office, the UK data protection regulator.

They can be contacted at:

Information Commissioner’s Office (www.ico.org.uk)

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Tel: 0303 123 1113

Healios and Melios take protection of your personal data very seriously. Healios and Melios use a range of precautions that include administrative, technical and physical measures, to safeguard your personal data against loss, theft and misuse, as well as against unauthorized access, disclosure, alteration and destruction. We store the personal data you provide encrypted on computer servers that are located in highly secure and controlled facilities. We restrict access to personal data to our employees, contractors and agents who need access in order to operate, develop, or improve our services and the application.

We follow industry accepted security standards to protect the personal data you submit to us, both during transmission and once we receive it.

We have implemented several technical and organisational measures to ensure your personal data is kept secure. This includes:

• Achieving the European ISO27001 certification for Information Security Management Systems which requires annual recertification by external auditors
• Compliance with the NHS Data Security and Protection Toolkit
• Completing annual Cyber Essentials Plus certification by external security specialist company
• Annual penetration testing of our systems by an external cyber security specialist company
• Annual training for all staff on how to handle information securely.
• Having role-based access controls so that staff can only access records necessary for their role.
• Hosting on a secure platform through Heroku and Amazon Web Services who maintain the servers and ensure they are secure and up-to-date at all times with the latest security patches. This also includes extensive physical access security systems to the server sites by professional security staff utilizing video surveillance, state-of-the-art intrusion  detection systems, and other electronic means.