Privacy Policy

1. Important Information and Who We Are

Cypher is operated by Cypher Health Ltd ("we", "us", or "our"). We are the controller and responsible for your personal data.

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact the DPO using the details below.

Contact: support@cypheros.uk
Phone: 0333 355 5990

2. The Data We Collect About You

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data: includes first name, last name, username, title, date of birth, and professional registration numbers.
• Contact Data: includes billing address, delivery address, email address and telephone numbers.
• Technical Data: includes internet protocol (IP) address, browser type and version, time zone setting and location, operating system and platform.
• Usage Data: includes information about how you use our website and services.
• Prescriber Data: includes professional qualifications, registration details, and digital signature.
• Patient Data: includes prescription details, medication information, and NHS number.
• Pharmacist Data: includes pharmacy registration details and dispensing records.

3. How Your Personal Data is Collected

We use different methods to collect data from and about you including through:

• Direct interactions: You may give us your data by filling in forms or by corresponding with us.
• Automated technologies: As you interact with our website, we automatically collect Technical Data using cookies and similar technologies.
• Third parties: We receive data from identity verification services and professional registration bodies.

4. How We Use Your Personal Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Performance of Contract: To process and deliver prescriptions and provide our services.
• Legitimate Interests: To improve our services and ensure the security of our platform.
• Legal Compliance: To comply with healthcare regulations and legal requirements.
• Health Treatment: For the management and delivery of healthcare services.

5. Disclosure of Your Personal Data

We may share your personal data with the following parties:

• Pharmacies for prescription dispensing
• Payment processors for transaction processing
• IT service providers for platform operation
• Identity verification services for account verification
• Professional regulatory bodies as required

6. International Transfers

We ensure your personal data is protected if transferred outside the UK/EEA by using Standard Contractual Clauses and/or the UK equivalent approved by the ICO.

7. Data Security

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way. These include:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for data in transit
• Two-factor authentication for account access
• Regular security audits and penetration testing
• NHS Data Security and Protection Toolkit compliance

8. Data Retention

We retain personal data for different periods depending on the type:

• Prescription records: 10 years after the death of the patient (in line with NHS guidelines)
• Account data: Duration of account plus 7 years
• Audit logs: 7 years
• Technical logs: 2 years

9. Your Legal Rights

Under certain circumstances, you have rights under data protection laws including:

• Access: Request access to your personal data
• Correction: Request correction of your personal data
• Erasure: Request erasure of your personal data
• Object: Object to processing of your personal data
• Restriction: Request restriction of processing
• Transfer: Request transfer of your personal data
• Withdraw consent: Withdraw consent where we rely on it

To exercise any of these rights, please contact us at support@cypheros.uk.

10. Glossary

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party.