Privacy Policy

Emerald MedToMe Ltd ("Emerald MedToMe", "we", "us") is a private, on-demand urgent care provider registered with the Care Quality Commission (CQC) in England and operating in a manner consistent with the standards expected of providers regulated by the Regulation and Quality Improvement Authority (RQIA) in Northern Ireland. We provide in-home and virtual clinical services delivered by vetted paramedics, nurses, ANPs and GPs.

We are the data controller for personal data we hold about patients and the data processor for certain clinician data held on behalf of partnered organisations. Our Data Protection Officer can be contacted at help@medtome.co.uk.

We collect and process the following categories of information:

• Identity: name, date of birth, NHS number (where provided).
• Contact: email, mobile number, home address and postcode.
• Clinical: presenting complaint, symptoms, medical history, medications, allergies, observations, treatment provided and outcome.
• Payment: billing details processed securely via Stripe; we do not store full card numbers.
• Location: device location used solely to dispatch the nearest suitable clinician.
• Clinician records: professional registration, DBS checks, indemnity and credential documents.

We process your personal data under UK GDPR Article 6(1)(b) for the performance of a contract (delivering care), Article 6(1)(c) to comply with legal and regulatory obligations, and Article 9(2)(h) for the provision of health and social care. Consent is relied upon for non-essential communications and optional data such as marketing.

We use your data to:

• triage your symptoms and match you with a suitable, vetted clinician;
• deliver, record and follow up on your clinical care;
• process payments and issue receipts;
• maintain clinical records as required by CQC and professional regulators;
• respond to complaints and fulfil our Duty of Candour obligations;
• meet safeguarding, audit and regulatory reporting requirements.

We share data only when necessary, including with: your assigned clinician; Stripe (payment processing); professional regulators and statutory bodies where required; emergency services where there is a risk to life; and the CQC or RQIA for the purposes of inspection and regulation. We never sell your data.

Clinical records are retained in line with NHS Records Management Code of Practice (generally 8 years from the last episode of care; longer for children). Payment data is retained per HMRC requirements. Credentialing records for clinicians are retained for the duration of engagement plus 6 years.

Under UK GDPR you have the right to access, rectify, restrict or object to the processing of your personal data, and the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. Health records may be subject to lawful restrictions.

We use encryption in transit and at rest, role-based access controls, and regular security reviews. Access to clinical data is restricted to the clinician delivering your care and authorised clinical governance staff. Clinician access is logged and auditable.

To exercise any right or ask a question about this policy, contact us at help@medtome.co.uk.