1. Who We Are
PatientIQ (patientiq.co.uk) is operated by MedicalGoGo Ltd, registered in England and Wales. We are the data controller for personal data collected on this website. Contact us at [email protected].
Important notice: Some of the personal data we collect — including information about your health conditions, symptoms, and treatments — is special category data under UK GDPR. We treat this data with the highest level of care and apply additional safeguards to its processing.
2. What Data We Collect
Account registration
- Name, email address, date of birth (to verify age 16+)
- Optional: gender, general location (county level)
Health profile (special category data)
- Conditions you choose to add to your health profile
- Medications and treatments you record
- Symptoms and health goals you enter
- This information is provided entirely at your choice and can be deleted at any time
Webinar registration
- Name, email address, condition interest (e.g. diabetes, cardiology)
- Explicit GDPR consent recorded at point of registration
Newsletter subscription
- Email address and first name
- Condition interest areas (to personalise content)
Usage data
- Pages visited, content viewed, search queries
- IP address, browser type, device type
- Collected via analytics tools (anonymised where possible)
3. How We Use Your Data
- To provide access to the PatientIQ platform and your personalised health dashboard
- To generate your Health Action Plan (based on your health profile)
- To send condition-relevant health updates you have subscribed to
- To send the weekly digest (if subscribed)
- To improve platform content and functionality
- To support patient research and surveys (only with your explicit consent)
- To comply with legal obligations
We do not use your data for automated decision-making or profiling that produces legal or significant effects on you.
4. Legal Basis for Processing (UK GDPR)
- Contract — processing necessary to provide the service you have registered for
- Explicit consent — for processing health (special category) data in your health profile; for marketing emails and newsletters; for research participation
- Legitimate interests — platform improvement, security, fraud prevention
- Legal obligation — where required by law
For special category health data, we rely on your explicit consent (Article 9(2)(a) UK GDPR). You can withdraw this consent at any time by deleting your health profile or closing your account.
5. Data Sharing
We do not sell your personal data. We will never share your individual health information with pharmaceutical companies, insurers, or employers. We may share data with:
- FluentCRM — email marketing (self-hosted, data stays on our servers)
- Amazon SES — email delivery (AWS, UK data residency)
- YouTube/Google — webinar video hosting (Google LLC)
- Sponsors and research partners — anonymised, aggregated statistics only (e.g. “35% of users with diabetes are interested in CGM content”); never individual data
If we ever propose to share your data in a new way, we will seek fresh consent first.
6. Data Retention
- Account data: retained while your account is active; deleted within 30 days of account closure request
- Health profile data: deleted immediately upon your request or on account closure
- Email marketing: retained until you unsubscribe or close your account
- Usage logs: anonymised after 13 months
- Research participation records: retained for 5 years (research integrity requirements), then deleted
7. Your Rights (UK GDPR)
You have the following rights, which we take seriously:
- Right of access — request a copy of all personal data we hold about you (Subject Access Request)
- Right to rectification — correct any inaccurate data
- Right to erasure — request deletion of your data; for health data, this is processed within 72 hours
- Right to restrict processing — ask us to pause processing while a dispute is resolved
- Right to data portability — receive your data in a machine-readable format
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — at any time, without affecting the lawfulness of prior processing
- Right to complain — lodge a complaint with the ICO at ico.org.uk or call 0303 123 1113
To exercise any right: [email protected]. We will respond within one month as required by UK GDPR.
8. Special Note on Health Data
Your health information is sensitive. We apply additional technical and organisational measures to protect it, including encryption at rest, strict access controls, and regular security audits. Only authorised staff with a specific need can access health profile data. For more information on how the NHS handles health data, see NHS.uk.
9. Cookies
We use essential cookies (login session, preferences) and optional analytics cookies. You will be asked for consent before any non-essential cookies are set. You can manage or withdraw cookie consent at any time via our cookie preferences centre or your browser settings.
10. Security
We use HTTPS encryption, secure servers, bcrypt password hashing, and strict access controls to protect your data. We conduct regular security reviews. Despite best efforts, no system is completely secure — please use a strong, unique password and enable two-factor authentication if available.
11. Children
PatientIQ is not intended for children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact us immediately at [email protected].
12. Changes to This Policy
We may update this Privacy Policy. We will notify registered users of material changes by email at least 14 days before they take effect. The date of last update is shown at the top of this page.
13. Contact & Data Controller
Data controller: MedicalGoGo Ltd
Privacy queries & rights requests: [email protected]
ICO registration: pending
For general health information, we recommend NHS.uk.