medElink PRIVACY POLICY (V.1)

1. Who We Are

medElink ("we", "us", "our") is a UK-based digital professional marketplace operated by Kinetic Health Holdings Limited, registered in England & Wales 12567617.

medElink connects healthcare practitioners, case managers, personal injury solicitors, professional deputies, insurers and other authorised referrers to support rehabilitation, care coordination and medico-legal work.

For privacy matters, you can contact us at: support@medelink.co.uk

or by post at the registered office above.

We are registered with the Information Commissioner's Office (ICO) .

2. Scope of This Policy

This Privacy Policy applies to all users of the medElink platform, including:

• Healthcare practitioners
• Case managers
• Personal injury solicitors
• Professional deputies
• Insurers and authorised referrers

3. Information We Collect

3.1 Account & Identity Information

• Name, email address, phone number
• Job role and organisation
• Login credentials
• General geographic location

3.2 Professional Information

• Qualifications and experience
• Professional registration numbers (e.g. HCPC, BPS, RCSLT, CSP)
• Work address (where relevant)
• Declared specialisms and services offered

3.3 DBS, Insurance & Verification Data

• DBS certificate metadata (certificate number, issue date, DBS type, Update Service status)
• Professional indemnity and public liability insurance details (cover level and expiry)
• Identity verification documents (e.g. passport or driving licence)

Important:

DBS certificates, insurance certificates and identity documents are accessible to medElink administrators only.

Other users see status-based badges only, never the documents themselves.

3.4 Referral & Case-Related Information

• Referral notes or documents uploaded by case managers
• Limited health, injury or functional information relevant to rehabilitation or medico-legal coordination

3.5 Technical & Usage Data

• IP address
• Browser and device type
• Security and audit logs

3.6 Cookies

We use cookies and similar technologies.

4. Where We Get Information From

We collect information:

• Directly from you when you register, update your profile or contact us
• From case managers or authorised professionals when referrals are created
• Automatically from your device when you use the platform (security, cookies and analytics)

5. How We Use Your Information

We use personal data to:

• Create and manage user accounts
• Verify professional credentials, DBS status, insurance and identity
• Display verification badges (not underlying documents)
• Enable users to search for and contact one another
• Facilitate referrals and professional communications
• Carry out annual DBS Update Service status checks (with consent)
• Maintain safeguarding, governance and platform integrity
• Keep the platform secure and operational
• Analyse usage trends (aggregated only)
• Meet legal and regulatory obligations

We never sell personal data.

6. Lawful Bases for Processing

We process data under the following lawful bases:

• Contract – to provide platform services
• Legitimate interests – running a safe, professional marketplace
• Legal obligation – record-keeping, safeguarding and regulatory compliance
• Consent – DBS Update Service checks, marketing communications
• Special category data conditions – processing health-related information for rehabilitation, safeguarding and legal claims

7. DBS Information

DBS data is processed strictly in accordance with the medElink DBS Policy.

medElink:

• records DBS metadata only
• performs Update Service status checks with explicit consent
• does not view or store criminal record content
• displays DBS status and type only to other users

8. Who Can See Your Data

Access may be given to:

• Professionals you choose to work with (e.g. case managers, clinicians, solicitors, deputies)
• Trusted service providers (hosting, IT, security, email) under strict contractual controls
• Regulators or public authorities where legally required

medElink's platform uses Supabase (hosted in the London AWS region) to provide database, authentication and file storage services. Supabase processes personal data on behalf of medElink under a Data Processing Addendum incorporating UK GDPR- compliant safeguards, including Standard Contractual Clauses where applicable.

Data is encrypted in transit and at rest, and Supabase implements industry-standard security and access controls. While Supabase secures its infrastructure, medElink controls application-level access, consent, retention and deletion of personal data.

9. Data Retention

• Referral and case-related data (including health information) is retained for 90 days, then removed from active systems
• Account and audit data is retained while accounts are active and for up to six years after closure
• Limited data may be retained longer where required for legal claims or safeguarding

10. Data Location & Transfers

We aim to store data in the UK or EEA.

If data is transferred outside these regions, we use ICO-approved safeguards such as the UK International Data Transfer Agreement.

Any such transfers will be documented here:

11. Data Security

We use appropriate technical and organisational measures including:

• Encryption
• Access controls
• Secure servers
• Staff confidentiality obligations

Users are responsible for keeping login details secure.

12. Your Rights

You have the right to:

• Access your data
• Correct inaccuracies
• Request deletion (where lawful)
• Restrict or object to processing
• Request data portability

To exercise your rights, contact: support@medelink.co.uk

We will respond within one month.

13. Marketing & Cookies

• Marketing communications are sent only with consent
• You can unsubscribe at any time
• Cookie use is explained in our Cookie Notice

14. Children

medElink is intended for professionals and adults only.

Accounts for individuals under 18 are not permitted.

15. Complaints

If you are unhappy with how we handle your data, please contact us first.

You may also complain to the ICO:

ico.org.uk | 0303 123 1113

Wycliffe House, Water Lane, Wilmslow, SK9 5AF

16. Changes to This Policy

We may update this policy from time to time.

Material changes will be communicated to registered users.