App Privacy policy

iPLATO Healthcare Ltd (“we”, “us”, “our”, ”iPLATO“), is a company registered in England & Wales with company number 6131747 with registered offices at 1 King St, London, W6 9HR. We provide the myGP® mobile application and are committed to protecting and respecting your privacy. We act as both a data controller and a data processor under UK law. We are the data controller for myGP® App registration data, for anything you enter directly into certain areas of myGP® (eg: medication reminders, self-care tracking data), and for data we process with your explicit consent. This means we are responsible for determining the purposes for which and the manner in which this personal data is processed. However, for other features (eg: messaging / appointment bookings / repeat prescriptions / etc) we provide these services on behalf of your GP practice / healthcare providers. In these cases, we are simply processing your personal information on their instruction. These parties are data controllers in their own right and have their own privacy policies.

This policy applies to your use of the myGP® mobile application software (App) once you have downloaded the App onto your mobile or handheld device. This policy also applies to any of the services accessible through the App (Services).

This policy sets out the basis on which any personal information we collect from you, or that you provide to us, or that is provided to us by your GP / healthcare services / NHS central services, will be processed by us. Please read this policy carefully to understand how we will treat your personal information. 

1. Information you give us.

This is information you give us about you when filling in forms/screens on the myGP® App or registering for Services through myGP®, through any interactions you undertake or services you request or source through myGP® and via any health or monitoring device you connect to myGP®, when uploading your image, or when corresponding with us by phone, e-mail or otherwise. It will be clear at the time what personal information we are requesting from you. If you do not provide the personal information necessary or withdraw your consent for the processing of your personal information, where this information is necessary for us to provide myGP® services to you, we will not be able to provide these services to you. You don't have to provide data and can simply choose to stop using the App at any time.

2. Information we collect about you and your device.

Each time you use myGP® we automatically collect the following information:

1. technical information, including the type of mobile device you use, a unique device identifier, mobile network information, your mobile operating system, and time zone setting;
2. information either accessed through your device or stored on your device which you have explicitly consented to sharing, and the providence of that data including the device used to collect that data, time, date; and
3. details of your use of myGP®.

Where you enable use of your device camera or audio or choose to upload files or images stored on your device, these are used for the purpose explicitly stated in the App at the time when you enable these services. If you choose not to enable these services you cannot make use of the video / audio call or file sharing functionality  

Additionally, if you choose to enable location services on your device when onboarding, location data from your device will be used to make it easier for you to search for your GP practice within the app. If you choose not to share your location, you are able to enter your GP / address manually.

3. Information we receive from your GP / healthcare provider.

We may receive information about you from your GP / healthcare provider to facilitate provision of relevant Services. This may include your name, NHS number and relevant contact details as well as sensitive information, for example prescription and appointment information. They are the controller of this data and we are a contracted processor; they provide us with such data to enable us to provide the services they specify to you. 

We DO NOT use your data for marketing purposes unless we ask for your explicit consent.

Any personal information you submit through myGP® or that is accessed by myGP® is generally required for providing the Services to you.

Where we receive information from your GP / healthcare provider we rely on their legal basis for processing this information.

However, we may rely on other lawful bases for using your personal information. Specifically, we use information held about you in the following ways:

1. To provide services to you or where we have a contract with you
   • To register you for the myGP® App and Services and manage your account and for our own internal administrative purposes.
   • To help us to verify your identity where appropriate by crosschecking with records kept at the relevant GP Practice or held by NHS centrally.
   • To provide you with the myGP® App and Services and to ensure that myGP® presents the correct version and data for your device.
   • To update you on any developments or information about the myGP® App and Services.
   • To allow us to investigate and address queries, questions and complaints that affect your use of the myGP® App and Services.
   • To provide you with opportunities to participate in research initiatives.

2. Where we have a legal obligation

To make disclosures as required by or in compliance with reasonable requests by regulatory bodies including the General Medical Council or Care Quality Commission, or as otherwise required by law or regulation.

3. Where it is in our legitimate interest
   • To review and enhance the quality of our services and products through details of your use of the myGP® App and Services. It is in our legitimate interest to provide effective and responsive services.
   • To allow us respond to general enquiries and feedback from you. It is in our legitimate interest to provide effective and responsive services to customers.
   • For internal operations, including troubleshooting, detection of fraud, log data analysis, testing, security, audit, statistical purposes and to investigate and defend legal claims. This is in our legitimate interest to protect our business interests and assess our business effectiveness.
   • To provide you with the option to pick alternative or additional services which are available within the App or are generated from the responses you give to us when you enter information into the App;

Please note, the alternative or additional services, generated when you enter the information requested for booking an appointment in the App, are specified by your GP or healthcare provider. This service is only available where your GP or healthcare provider has requested it.

Where we rely on legitimate interest as a ground for processing your personal information, before we go ahead, we carry out a ‘balancing test’ to ensure that our processing is necessary and that your fundamental rights of privacy are not outweighed by our legitimate interests. We keep a record of these balancing tests and you can request to see  the information they contain. You can find out more by contacting us using the details below.

4. Where we have your explicit consent
   • Where you consent to the sharing of your data with third party providers (eg: online pharmacy)
   • Where you allow the use of camera and/or photo storage when using image-related functionality in the app – no images are stored by myGP® but where required they are provided in unidentifiable form to external parties for analysis and presentation in the app.  
   • Where you allow the use of camera through your device settings for the purpose of NHS Log-in ID verification.
   • Where you allow the use of camera and/or photo storage for a skin image search – these images are not stored by myGP® but are provided anonymously for analysis.
   • Where you allow location services for the purpose of locating your GP practice during onboarding or finding your nearest pharmacy.
   • Where you consent to the App using read/write permissions for file storage (eg: when exporting medical records).
   • Where any of the personal information you provide to us directly through your use of the App contains data concerning health related information and racial or ethnic information, religious or philosophical beliefs, trade union membership data, genetic/ biometric data and sex life or sexual orientation data (Sensitive Information), we rely on you having provided us explicit consent to use such data when you provide this data via the App.

5. Where we rely on your GP or healthcare provider’s healthcare purposes

   Where any of the personal information we use contains Sensitive Information, and in addition to the above, where this data is received from your GP / healthcare provider, we rely on their lawful basis to use such data for healthcare purposes. This includes providing medical record access, and specifically access to Covid vaccination data, on behalf of your GP.

We will not sell your personal information or share it for marketing purposes. 

We may disclose your personal information:

• To you and your GP or other healthcare provider in the course of providing the Services to you; or
• To additional processors who support us to provide the Services to you, where this is the case, their use of your data is governed by strict contract terms; or
• To third parties who offer additional services you may wish to benefit from, where this is the case, a formal Data Sharing Agreement is in place with the third party and you will be asked for your explicit consent; or
• If we are under a duty to disclose or share your personal information to comply with any legal or regulatory obligation; or
• To enforce or apply our Terms and other agreements or to investigate potential breaches of such Terms; or
• To protect the rights, property or safety of iPLATO, our customers, or others.

We will store your personal information at our secure data centre which is located within the United Kingdom. We do not transfer your personal information outside the UK. All data will be encrypted when being transferred to and from your device to myGP® or to our data centre. It is your responsibility to keep any passwords or pin codes used to access myGP® confidential. 

If you choose to enable access to your medical record through myGP®, please note that we do not store this content, we simply make the information held by your GP available to you on your device.

If you choose to conduct a video consultation with your healthcare provider through myGP® then please be assured that at no time do we record or store the video or audio footage in any form.

We take all steps reasonably necessary to ensure that your data is treated securely through strict procedures and security features to prevent unauthorised access to your personal information. However, we cannot guarantee the secure transmission of information via the internet due to security threats outside our control and as such, any transmission of information is at your own risk. 

We will retain your personal information for as long as needed to fulfil the purposes outlined in the ‘How does myGP® use your personal information?’ section above or for a period specifically required by applicable regulations or laws. For example, we generally keep your personal information for as long as you remain a registered user of the App.

When determining the relevant retention periods, we will take into account factors including:

• our contractual obligations and rights in relation to the information involved;
• legal obligation(s) under applicable law to retain data for a certain period of time;
• statute of limitations under applicable law(s);
• our legitimate interests where we have carried out balancing tests (see section on ‘How do we use your information above);
• (potential) disputes; and
• guidelines issued by relevant data protection authorities.

Otherwise, when requested, we securely erase or anonymise your personal information where you cease to be a user of the App and we no longer require your information for the purposes collected.

myGP® or any other Service we offer may contain links to other independent third-party websites or mobile applications ("Third-party Sites"). 

These Third-party Sites are not under our control, and we are not responsible for and do not endorse their content or their privacy policies (if any). You will need to make your own independent judgement regarding your interaction with any Third-party Sites, including the purchase and use of any products or services accessible through them.

myGP® uses the following third party trackers so we can provide effective and responsive services to our users:

Google Firebase / Fabric (ios only) – provides metrics on successful sign-ins, screen views and button hits. We use this to assess App usage levels.

Elastic – provides information on screen views, button hits, backend events and what is being entered in the app. We use this to assess feature performance and investigate and address issues.

By law, you have a number of rights (subject to certain conditions) when it comes to your information. Further information and advice about your rights can be obtained from the Information Commissioners Office (ICO). You can exercise any of these rights by contacting us using our details below. 

We usually act on requests and provide information free of charge, but may charge a reasonable fee to cover our administrative costs for:

• baseless or excessive/repeated requests, or
• further copies of the same information.

Alternatively, we may be entitled to refuse to act on the request.

Please consider your request responsibly before submitting it. We will generally respond within one month from when we receive your request but, if the request will take longer to deal with, we will come back to you and let you know.

We update our privacy policy from time to time and any changes we may make to our privacy policy in the future will be posted online and, where appropriate, notified to you through the App. The new terms may be displayed on-screen and you may be required to read and accept them to continue your use of myGP®. 

If you have any questions, comments or requests regarding this Policy, please get in touch with us:

iPLATO Healthcare Ltd

1 King St

London W6 9HR  info@iplato.com

You can contact our Data Protection Officer by emailing: ig@iplato.com

If you are not satisfied with our response, or you think we are not complying with data protection law, you can make a complaint to the UK data protection regulator - the Information Commissioner: