Privacy Policy

Privacy Policy

This Privacy Policy explains how Driver Medicals Network Ltd collects, uses, stores and shares personal information when you use our website, make an enquiry, book or attend an appointment, communicate with us or consent to future reminders.

1. Who is responsible for your information?

Driver Medicals Network Ltd is normally the data controller for personal information collected directly in connection with our website and services.

  • Company number: 16915841
  • Registered office: Afon House, Worthing Road, Horsham, West Sussex, RH12 1TL
  • Correspondence address: The EpiCentre, Enterprise Way, Haverhill Research Park, Haverhill, CB9 7LR
  • Privacy enquiries: info@drivermedicalsnetwork.co.uk
  • Telephone: 07476 159929

 

The correspondence address and registered office are administrative addresses and are not clinic locations.

2. Personal information we may collect

Depending on your interaction with us, we may collect:

  • identity details, such as your name, date of birth and identification information;
  • contact details, including address, telephone number and email address;
  • booking details, including service, venue, date, time, booking reference and attendance status;
  • payment and transaction information, including amount, payment status and refund status;
  • health and clinical information relevant to the assessment, including medical history, medicines, vision information, examination findings, measurements, professional opinions and form-completion decisions;
  • documents and correspondence you provide, such as medical letters, prescriptions, licensing forms or optician information;
  • consents, preferences and communication records, including consent to future reminders;
  • complaints, incident information and records of enquiries; and
  • technical information from the website, such as IP address, device, browser, pages visited, cookie choices and security logs.

 

Card details are processed by our payment provider. We do not intentionally receive or store your full card number or card security code.

3. How we obtain information

We usually obtain information directly from you through the website, booking form, telephone, email or appointment. We may also receive information from:

  • a person or organisation booking on your behalf;
  • your employer, licensing authority, GP, optician or specialist, where you have authorised this or another lawful basis applies;
  • payment, booking, email, SMS and website service providers; and
  • public authorities, regulators or professional bodies where permitted or required by law.

 

If someone provides information about you, they must have authority to do so and should tell you about this Privacy Policy.

4. Why we use your information and our lawful bases

We use personal information only where we have a lawful basis. Health information is special category data and requires an additional legal condition.

Purpose

Article 6 lawful basis

Additional condition for health data

To take bookings, deliver the assessment, communicate about the appointment and provide requested documents or forms.

Contract: Article 6(1)(b).

Health or social care purposes: Article 9(2)(h), with relevant safeguards under the Data Protection Act 2018 and professional confidentiality.

To keep clinical, regulatory, tax and accounting records and comply with legal or professional duties.

Legal obligation: Article 6(1)(c); and, where appropriate, legitimate interests: Article 6(1)(f).

Article 9(2)(h); legal claims under Article 9(2)(f) where necessary.

To manage payments, refunds, fraud prevention, website security, service quality, complaints and legal claims.

Contract, legal obligation or legitimate interests, depending on the activity.

Article 9(2)(h) or Article 9(2)(f), where health data is necessary.

To send appointment confirmations and operational reminders.

Contract: Article 6(1)(b), and legitimate interests where necessary for safe and efficient administration.

Article 9(2)(h) where the message contains relevant health-service information.

To send optional future-due reminders or promotional messages.

Consent: Article 6(1)(a). You may withdraw consent at any time.

Explicit consent under Article 9(2)(a) only if a message requires use of health information.

To disclose information to an employer, licensing authority, GP, optician, insurer or other named recipient at your request.

Consent or contract, depending on the request; legal obligation where required by law.

Normally explicit consent under Article 9(2)(a), unless another lawful condition applies.

Where we rely on legitimate interests, those interests include operating a safe, secure and efficient service, protecting against misuse and fraud, maintaining records, improving customer service and establishing or defending legal claims. We balance these interests against your rights and expectations.

5. Health information and confidentiality

Health information is sensitive and receives additional protection. It is accessed only by people who need it for their role, including GMC-registered doctors and authorised administrative personnel. Doctors are bound by professional duties of confidentiality.

We normally share identifiable clinical information only with your authority. In limited circumstances, information may be used or disclosed without consent where required by law or where a doctor is professionally permitted or required to act to protect you or another person from serious harm.

6. Who we may share information with

We do not sell your personal information. We may share the minimum necessary information with:

  • GMC-registered doctors and authorised administrative staff working with Driver Medicals Network;
  • website hosting, booking-system, cloud storage, email, SMS, IT support and cybersecurity providers;
  • Stripe and other payment or banking providers;
  • accountants, auditors, insurers, legal advisers and professional indemnity providers;
  • your GP, optician, specialist, employer, licensing authority, insurer or another recipient where you have authorised disclosure or another lawful basis applies;
  • courts, regulators, law-enforcement bodies, safeguarding authorities or public bodies where disclosure is legally required or justified; and
  • a purchaser, successor or adviser in connection with a genuine sale, reorganisation or transfer of the business, subject to confidentiality and data-protection safeguards.


Service providers that process information for us must be subject to appropriate contractual and security requirements.

7. Payments

Online payments are processed by Stripe or another provider identified at checkout. The payment provider uses personal information under its own privacy terms and may carry out fraud-prevention, identity or regulatory checks. We receive information such as the customer name, email address, amount, payment method type, payment status and transaction reference, but not the full card number or security code.

8. International transfers

Some technology providers may process or support information outside the United Kingdom. Where personal information is transferred internationally, we require an appropriate legal safeguard, such as a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism.

9. How long we keep information

We keep information only for as long as necessary for the purpose for which it was collected and to meet clinical, legal, regulatory, insurance and accounting requirements. Our usual periods are:

  • adult clinical assessment records: normally 8 years after the last assessment, unless a longer period is required because of a complaint, incident, legal claim, professional requirement or other justified reason;
  • booking and correspondence records that form part of the clinical or complaint record: retained with the relevant record;
  • payment, invoice and accounting records: normally at least 6 years from the end of the relevant financial year, or longer where legally required;
  • unsuccessful general enquiries that do not lead to a booking: normally up to 12 months, unless needed longer for a complaint or legal reason;
  • future-reminder consent: until you withdraw consent or the purpose ends; and
  • opt-out records: retained as necessary to ensure that your preference continues to be respected.


At the end of a retention period, information is securely deleted, destroyed or anonymised unless there is a lawful reason to retain it longer.

10. How we protect information

We use proportionate technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, alteration or disclosure. These may include access controls, strong authentication, encryption where appropriate, secure systems, confidentiality obligations, staff training, backups and incident-management procedures.

No online system is completely risk-free. Please avoid sending unnecessary detailed medical information through ordinary email or open website fields. Use the method we request for sensitive documents.

11. Your data-protection rights

Depending on the circumstances, you may have the right to:

  • be informed about how your information is used;
  • request access to your personal information;
  • ask us to correct inaccurate or incomplete information;
  • ask for erasure of information where the legal conditions are met;
  • ask us to restrict processing in certain circumstances;
  • object to processing based on legitimate interests and object at any time to direct marketing;
  • receive certain information in a portable format;
  • withdraw consent at any time, without affecting earlier lawful processing; and
  • complain to the Information Commissioner’s Office.


These rights are not absolute. For example, we may need to retain clinical or financial records even if you ask us to erase them. We may request identification before responding. We normally respond within one month, subject to lawful extensions for complex requests.

To exercise a right, contact info@drivermedicalsnetwork.co.uk.

12. Appointment messages, future reminders and marketing

We may send service messages that are necessary to administer your booking, such as confirmations, venue details, payment information, changes, cancellations and appointment reminders.

We will use your email address or telephone number for optional future-due reminders or promotional messages only where we have an appropriate lawful basis and comply with electronic-marketing rules. Where we rely on consent, the choice will be optional and not pre-ticked. You can withdraw consent or opt out at any time by using the message instructions or contacting us.

13. Cookies and website analytics

Our website may use essential cookies needed for security, booking and payment functions. Non-essential analytics or marketing cookies should be used only in accordance with your cookie choices. Further details should be provided in the website cookie notice or cookie settings panel.

14. Automated decision-making

We do not currently use solely automated decision-making that produces legal or similarly significant effects. Clinical assessments and form-completion decisions are made by a qualified doctor using professional judgement.

15. Children

Our driver medical services are intended primarily for adults. We do not knowingly provide online booking services directly to children. If information about a person under 18 is exceptionally required, we will handle it in accordance with applicable law and professional guidance.

16. Complaints about data protection

Please contact us first so that we have an opportunity to investigate and resolve your concern.

Data protection complaints can be made by email to info@drivermedicalsnetwork.co.uk, by telephone on 07476 159929, or by post to: Data Protection Complaints, Driver Medicals Network Ltd, The EpiCentre, Enterprise Way, Haverhill Research Park, Haverhill, CB9 7LR.

We will acknowledge your complaint within 3 working days and aim to provide a full response within one month. If additional time is required, we will explain the reason and keep you informed.

You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk. The ICO can also be contacted at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

17. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our services, suppliers, legal obligations or data practices. The current version will be published on our website with the date of the latest update. Where a change is significant, we will take reasonable steps to bring it to the attention of affected individuals.

18. Contact details

Driver Medicals Network Ltd
Correspondence address: The EpiCentre, Enterprise Way, Haverhill Research Park, Haverhill, CB9 7LR
Registered office: Afon House, Worthing Road, Horsham, West Sussex, RH12 1TL
Company number: 16915841
Email: info@drivermedicalsnetwork.co.uk
Bookings: bookings@drivermedicalsnetwork.co.uk
Telephone: 07476 159929