Medi-Bridge Privacy Policy

Last updated: 30 March 2026

Introduction

At Medi-Bridge, we take your privacy seriously. This policy explains how we collect, use, and protect your personal information when you use our healthcare platform.

We're committed to being transparent about how we handle your data and ensuring you have control over your information. If you have any questions after reading this policy, please don't hesitate to get in touch.

Who we are

Medi-Bridge Technology Ltd
Hulm Club, 1st Floor
57 Farringdon Rd
London EC1M 3JB

Email: hello@medi-bridge.org
Phone: 07460794747
Data Protection Officer: Zahra Uddin

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What information we collect

Personal information

When you create an account and use Medi-Bridge, we collect:

  • Your name, date of birth and gender
  • Contact details (email address, phone number, postal address)
  • Account credentials (username and encrypted password)
  • Profile preferences
  • Government-issued ID

Health information

With your explicit consent, we collect sensitive health information including:

  • Medical history, symptoms, diagnoses, and treatment plans
  • Current medications, dosages, allergies, and adverse reactions
  • Test results and consultation notes
  • Photos, videos, audio recordings, and notes you upload or create
  • Health-related lifestyle information you choose to share

This is "special category data" under UK GDPR and receives extra protection.

Technical information

Like most online services, we automatically collect:

  • Device type, operating system, and browser information
  • IP address and approximate location
  • How you use our platform (pages visited, features used, time spent)
  • Cookies and similar technologies (see our Cookie Policy for details)

How we use your information

We use your information to:

Provide healthcare services

  • Facilitate consultations with healthcare professionals
  • Manage your medical records and health history
  • Process appointments and prescriptions
  • Monitor your treatment progress
  • Send you important service notifications

Run our platform

  • Create and maintain your account
  • Verify your identity and prevent fraud
  • Provide customer support
  • Improve our services and user experience

Meet legal obligations

  • Comply with healthcare regulations
  • Respond to legal requests
  • Protect public health and safety
  • Investigate and prevent harmful activities

Communicate with you

  • Send important updates about our services
  • Respond to your questions and support requests
  • Send marketing communications (only if you've opted in)

Legal basis for using your information

Under UK GDPR, we need a legal reason to use your personal information. Here's what we rely on:

For personal information

  • Your consent - when you give us clear permission
  • Contractual necessity - to provide the services you've requested
  • Legal obligation - to comply with laws and regulations
  • Vital interests - to protect your life or health in emergencies
  • Legitimate interests - for security and service improvements, balanced against your rights

For health information

Health data is treated with extra care. We process it based on:

  • Your explicit consent - clear, informed permission for specific purposes
  • Healthcare provision - for medical diagnosis, treatment, and health management under professional confidentiality
  • Public health - when necessary for public health purposes

You can withdraw your consent at any time, though this won't affect any processing we've already done lawfully.

How we share your information

We only share your information when necessary and with appropriate safeguards in place.

With healthcare professionals

With your explicit consent, we share relevant health information with doctors, nurses, and other healthcare providers involved in your care. We only share what's necessary for your treatment, and all healthcare professionals are bound by medical confidentiality.

With service providers

We work with trusted partners who help us run our platform:

  • Neon - PostgreSQL database (AWS Europe West 2, London, UK)
  • Amazon Web Services (AWS) S3 - file storage (Frankfurt, Germany)
  • Google Workspace - email and collaboration tools (EU)

  • Sentry - Application performance monitoring & error tracking (EU)

  • PostHog - privacy-focused analytics to improve our service (EU)

    • Only activated if explicit consent is provided
    • Upon declining or not providing consent, no analytics cookies or tracking will be set in your browser.
    • Opt-in only: Analytics tracking is disabled by default. You will be asked for your consent before any data is collected.
    • Cookies and storage: If you accept, PostHog may use cookies and local storage to collect usage data. If you decline, no cookies or tracking will be set.
    • No personal data: We do not send personally identifiable information (such as your name, email, phone number, address, or IP address) to PostHog.
    • Session recording: Session recording is disabled during development and only enabled in production if you consent.
    • Data usage: The data collected is used solely to improve our website and is not shared with third parties

All our service providers:

  • Sign strict data protection agreements
  • Only access data as we instruct them
  • Implement strong security measures
  • Store data exclusively in UK/EEA data centers
  • Are regularly audited for compliance
  • GDPR compliant

For legal reasons

We may share your information to:

  • Comply with legal obligations or court orders
  • Respond to valid legal processes (warrants, subpoenas)
  • Protect public health or safety
  • Prevent fraud or illegal activities
  • Protect our rights, property, or safety

In business transfers

If Medi-Bridge is acquired or merged with another company, your data may transfer to the new owner. We'll notify you if this happens and ensure your privacy protections continue.

We never sell your data

We will never sell your personal information to third parties for marketing purposes.

Your rights

You have important rights over your personal information:

Right to access

You can request:

  • Confirmation of whether we hold your data
  • A copy of your personal information
  • Details about how we use it

Right to correction

You can ask us to correct inaccurate or incomplete information. You can also update many details directly through your account settings.

Right to deletion ("right to be forgotten")

You can request deletion of your data in certain circumstances. Note that some health records may need to be retained for legal or regulatory reasons.

Right to restrict processing

You can ask us to limit how we use your data under certain conditions. We'll store it but not actively process it.

Right to data portability

You can request your data in a structured, machine-readable format and ask us to transfer it to another service provider where technically possible.

Right to object

You can object to:

  • Processing based on legitimate interests
  • Direct marketing (at any time)
  • Automated decision-making

How to exercise your rights

To exercise any of these rights:

  • Email us at hello@medi-bridge.org
  • Use your account settings for many functions
  • Write to us at our postal address above

We'll respond within 30 days (sometimes up to 90 days for complex requests). We may need to verify your identity before processing requests.

How we protect your information

We take data security seriously and use multiple layers of protection:

Technical security

  • Encryption - AES-256 encryption for stored data and TLS 1.3 for data in transit
  • Access controls - role-based permissions
  • Network security - firewalls, intrusion detection, and secure protocols
  • Certified infrastructure - ISO 27001, ISO 27017, ISO 27018, and SOC 2 Type II certified data centers

Offline functionality and encrypted local storage

When offline access is enabled for your organisation, we may cache data on your device so you can continue working without an internet connection. Sensitive cached information (such as patient records and related updates) is stored encrypted in your browser (for example in encrypted local storage); encryption keys are managed on your device and removed when you log out.

When you are back online, queued changes are synchronised to our servers. You can clear offline cached data from your profile; logging out also clears encrypted offline storage and cached application assets (such as service worker caches). If your organisation turns off offline access, we may clear the offline cache after attempting to sync pending changes; the offline cache may also be cleared automatically after extended inactivity.

We strongly recommend that you use a strong device password, PIN, biometric lock, or equivalent, so that cached data is not easily accessible if your device is lost or stolen while unlocked.

Organisational security

  • Regular staff training on privacy and security
  • Strict need-to-know access policies
  • Background checks for staff with data access
  • Comprehensive incident response procedures
  • Regular internal and external audits

If something goes wrong

In the unlikely event of a data breach:

  • We'll notify the ICO within 72 hours
  • We'll inform you promptly if your data is at high risk
  • We maintain detailed breach documentation and response plans

How long we keep your information

We only keep your data as long as necessary:

  • Account data - while your account is active plus 7 years after closure
  • Health records - 7-10 years from your last consultation (as required by medical record retention regulations)
  • Communications - 3 years after the last message
  • Technical data - 2 years or until no longer needed
  • Legal matters - longer if required for legal proceedings

When retention periods expire, we securely delete your data using:

  • Automated deletion processes
  • Cryptographic erasure and secure overwriting
  • Removal from backups within 90 days
  • Confirmation that our service providers also delete appropriately

International transfers

Your data is stored and processed primarily in the UK and European Economic Area (EEA).

Our approach

  • Neon PostgreSQL - AWS Europe West 2 (London, UK)
  • AWS S3 - file storage, Frankfurt, Germany (EU)
  • Google Workspace - EU region
  • Sentry - Frankfurt, Germany (EU)
  • PostHog - EU region
  • No transfers outside UK/EEA - all data stays within these territories
  • GDPR compliance - all providers have data processing agreements in place
  • UK/EEA staff only - only UK/EEA based support staff can access your data

When we do transfer data internationally (rarely), we use:

  • Adequacy decisions (transfers to countries with equivalent protection)
  • Standard Contractual Clauses (EU-approved safeguards)
  • Your explicit consent when appropriate

Cookies and tracking

What we use

  • Essential cookies - necessary for authentication and the platform to work (always active)
  • Preference cookies - remember your settings
  • Analytics cookies - help us understand usage and improve our service
  • Marketing cookies - enable relevant advertising (only with your consent)

Your control

  • You'll see a cookie banner on your first visit with clear choices
  • You can manage cookie preferences in your account settings
  • You can control cookies through your browser settings
  • You can opt out of non-essential cookies at any time

Children's privacy

We take extra care with children's information:

  • Parental consent required - users under 16 must have parent or guardian consent
  • Enhanced protections - additional privacy safeguards for minors
  • Limited collection - we only collect essential healthcare information
  • Guardian access - parents/guardians can access and manage their child's account

Third-party links

Our platform may link to other websites or services. We're not responsible for their privacy practices. Please read their privacy policies before sharing your information.

Changes to this policy

We review this policy regularly and will update it as needed.

How we'll notify you

  • We'll give you at least 30 days' notice of material changes
  • We'll email you and display a prominent notice on our platform
  • We maintain a clear version history
  • We'll ask for fresh consent when legally required

Review schedule

We review this policy:

  • At least annually
  • When laws change
  • When we introduce new features or services

Next review date: 1 October 2026

Your right to complain

We hope to resolve any concerns you have, but you have the right to complain to a data protection authority.

Contact us first

We'd appreciate the opportunity to address your concerns:

  • Email our Data Protection Officer: hello@medi-bridge.org
  • We'll investigate within 30 days
  • We're committed to resolving issues promptly

Contact the regulator

You can complain to the UK Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF

Website:https://ico.org.uk
Phone: 0303 123 1113

If you're in the EU, you can contact your local data protection authority. Find yours at:https://edpb.europa.eu/about-edpb/about-edpb/members\_en

Get in touch

Questions about this policy or how we handle your data? We're here to help.

Email: hello@medi-bridge.org
Phone: 07460794747
Address: Hulm Club, 1st Floor, 57 Farringdon Rd, London EC1M 3JB
Data Protection Officer: Zahra Uddin, hello@medi-bridge.org

We aim to respond within 5 business days.

Document version: 1.2
Effective date: 13 October 2025

This privacy policy is available in multiple languages. If there are any discrepancies between translations, the English version takes precedence.

© Medi-Bridge Technology Ltd - All rights reserved