Will Medstars share my personal data with anyone else?

​

Medstars may pass your personal data on to third-party service providers contracted to Medstars. In these circumstances, the third party may be another controller, processor or sub-processor.

Where the third party is a processor or a sub-processor, they are obliged to keep your details securely, and to use them only to fulfil their contractual obligations to Medstars. When they no longer need your personal data to fulfil this service, they will dispose of the details in line with Medstars’ data retention policy.

We follow the principle of data minimisation. This means we only share the absolute minimum data required for each service to work properly. For example:

• error reporting service provider is only able to process technical information needed for the quality assurance, it does not receive the gist of your conversation or your email address;

• analytic service providers receive aggregated, often anonymised usage data; and

• AI service providers receive the content necessary to generate your personalised responses only.

Please note, if you contact us through third party providers, such as other messengers or our social media, you are subject to their Terms of Use. We do not control how these providers process your data.

Data Retention Periods

For active users, If you decide to delete your account, we maintain a 30-day freezing period for your convenience. This allows you to restore your account if you change your mind. After 30 days, all associated data will be permanently deleted.

You have full control over your conversational data. When you delete your account, all related messages and communications will also be permanently erased.

Please keep in mind that we may still process anonymised data even after your data is deleted. Once anonymised, the data no longer qualifies as personal data under privacy regulations. We may use such anonymised data for system improvement and training, ensuring identifying information is removed before processing.

Your rights as a data subject

At any point while we are in possession of or processing your personal data, you, the data subject, have the following rights:

• Right of access – you have the right to request a copy of the information that we hold about you.

• Right of rectification – you have a right to correct data that we hold about you that is inaccurate or incomplete.

• Right to be forgotten – in certain circumstances you can ask for the data we hold about you to be erased from our records.

• Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.

• Right of portability – you have the right to have the data we hold about you transferred to another organisation.

• Right to object – you have the right to object to certain types of processing such as direct marketing.

• Right to object to automated processing, including profiling – you also have the right to be subject to the legal effects of automated processing or profiling.

How to Exercise Your Rights

Some rights can be exercised directly through our Services. Simply navigate to Settings to manage your preferences, adjust privacy controls, or delete your data.

For additional requests or inquiries, please contact us at feedback@medstars.co.uk This might include, but is not limited to:

• changing the email associated with your registration;

• requesting access to all data we retain about you;

• seeking further clarification on security, data retention, or AI processing features toward data processing; or

• any other privacy-related concerns.

The Response Standard

We acknowledge receipt of your request within 10 business days and reserve 45 calendar days to respond. We may also extend the response time, adding 15 more calendar days, notifying you promptly.

Regardless of your location, if your request does not require additional information or is not complex, we typically aim to provide a response in less than 5 days.[11] 

To process your request efficiently, we may require additional information to verify your identity and the nature of your request. If needed, we will reach out to request further details.

Please note that using VPN services may impact our ability to timely process your request.

Sometimes your request might be unenforceable. In some cases, we may refuse to fulfill your request. This can happen if:

• the request is unclear or not directly related to your own data;

• it may be restricted due to legal requirements or specific case-by-case limitations;

• your data has already been permanently deleted.

If we are unable to process your request, we will inform you promptly and provide further details where applicable.