Privacy Policy

Last updated: July 2026

Xvera Ltd (trading as Xvera Medical) (“Xvera Medical”, “we”, “us”) is committed to protecting your privacy and handling your personal data with care, transparency, and integrity.

This Privacy Policy explains how we collect, use, store, and protect your personal and medical information when you use our services or website.

1. Who We Are

Xvera Ltd (trading as Xvera Medical)
Arkwright House
Parsonage Gardens
Manchester
M3 2LF

ICO Registration Number: ZC013023

We act as the Data Controller for your personal and medical information.

For data protection queries:
admin@xveramedical.com

Xvera Medical does not currently appoint a formal Data Protection Officer but ensures compliance through internal governance processes.

2. What Information We Collect

We collect only the information necessary to provide safe and effective care.

a) Personal Information

  • Name
  • Date of birth
  • Address
  • Contact details
  • Payment details (processed securely via third-party providers)

b) Medical Information (Special Category Data)

  • Medical history
  • Medications
  • Consultation notes
  • Laboratory results
  • Symptoms and clinical assessments
  • Treatment plans
  • Communications with clinicians

c) Technical Information

  • IP address
  • Browser and device information
  • Website usage data

(Collected via cookies — see Cookie Policy)

3. How We Use Your Information

We use your information to:

  • Provide safe medical assessment and treatment
  • Assess eligibility and suitability for treatment
  • Prescribe medication where appropriate
  • Monitor treatment outcomes and safety
  • Communicate with you regarding your care
  • Arrange pharmacy dispensing and delivery
  • Maintain clinical records
  • Carry out clinical governance and quality improvement
  • Comply with legal and regulatory obligations

We do not sell your data or use it for unrelated marketing.

We only collect and use information that is necessary for these purposes.

4. Lawful Basis for Processing

We process your data under the following legal bases:

Healthcare Provision

UK GDPR Article 9(2)(h)
Processing is necessary for the provision of healthcare and treatment.

Contractual Necessity

Article 6(1)(b)
To deliver services you have requested (e.g. consultations, memberships).

Legal Obligations

Article 6(1)(c)
To comply with regulatory requirements (e.g. CQC, GMC, record-keeping).

Legitimate Interests

Article 6(1)(f)
To improve services, ensure safety, and maintain operational effectiveness.

Consent

Used where required, including:

  • Sharing information with your GP
  • Optional communications

You may withdraw consent at any time where applicable.

5. Sharing Your Information

We only share your data where necessary, lawful, and proportionate.

This may include:

  • Partner pharmacies – to dispense prescriptions
  • Laboratories – for blood testing
  • Phlebotomy providers – for blood sample collection
  • Payment providers (e.g. Stripe)
  • IT providers – for secure systems and data storage
  • Your GP or other clinicians – with your consent or where necessary for safety
  • Regulators (e.g. CQC) – where legally required

All third-party providers act as data processors under contract and must meet UK GDPR standards.

We do not share your data with advertisers or social media platforms.

6. Data Security & Storage

Your information is stored in secure clinical systems with:

  • Role-based restricted access
  • Audit trails
  • Multi-factor authentication
  • Encrypted transmission
  • Encrypted data at rest

We take appropriate technical and organisational measures to protect your data.

7. Data Retention

We retain your data only as long as necessary.

  • Medical records are typically retained for at least 8 years in line with UK guidance
  • Other data may be retained for shorter or longer periods depending on legal, clinical, and operational requirements

8. Data Breach Procedures

In the event of a data breach that poses a risk to your rights and freedoms:

  • We will notify the Information Commissioner’s Office (ICO) where required
  • We will inform affected individuals where appropriate

9. Your Rights

You have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request deletion (where legally permitted)
  • Restrict processing
  • Object to processing
  • Request transfer of your data

To exercise your rights:
admin@xveramedical.com

If you are not satisfied, you may contact the ICO:
https://www.ico.org.uk

10. Automated Decision-Making

Xvera Medical does not use automated decision-making or profiling that produces legal or significant effects.

All clinical decisions are made by qualified clinicians.

11. Marketing & Communications

We do not carry out mass marketing.

We may send:

  • Service updates
  • Safety information
  • Administrative communications

These are considered essential to your care and service delivery.

12. International Transfers

We do not routinely transfer your data outside the UK.

If this becomes necessary, we will ensure appropriate safeguards are in place in accordance with UK GDPR.

13. Changes to This Policy

We may update this policy from time to time.

Updates will be published with a revised “Last updated” date.

14. Contact For any privacy-related queries:
admin@xveramedical.com