Privacy Policy

Last updated: 25 August 2026

1. Introduction

BlockMed Pro UK Ltd. (referred to as "organisation", "we," "our," "us") is committed to protecting your personal data and ensuring transparency regarding how we collect, use, and share it, and comply with relevant data protection regulations, including:

• UK GDPR and the Data Protection Act 2018
• NHS Data Security and DSPT requirements

BlockMed Pro UK Ltd. is a business that owns BlockMed Pro, i.e., a healthcare technology platform. We act as a Data Processor as per UK GDPR and Data Protection.

This notice describes how we use your personal data when instructed by our customers (both patients, i.e., "Data Sellers" and Pharmaceutical organisations/laboratories i.e., "Data Purchasers") and/or when the data is being processed, including your rights under the relevant data protection laws.

It discusses how we process information when you use our online platform that connects patients, laboratories, pharmaceutical organisations and other third-party services including but not limited to data storage partners (GCP, MongoDB Atlas) and the financial service provider (Stripe).

2. Definitions and Abbreviations

The following table presents the important abbreviations and terms used in this document and their definitions:

3. Who We Are

We, as an organisation, are a UK-based health-tech company, providing our technology related services in the UK healthcare sector since 2024. Our Service based platform acts as a mediator between patients (referred to as "Data Sellers") and laboratories/pharmaceutical companies (i.e., "Data Purchasers"), enabling patients to share and sell their health data with authorised purchasers in a secure and transparent fashion.

As defined in Section 2, we act as a Data Processor, whereas Patients act as Data Subjects/Controllers.

1. Address:
   BlockMed Pro UK Ltd
   5 Cobcroft Road
   Huddersfield
   HD2 2RU
   United Kingdom
2. Email: info@blockmedpro.com

4. What Data We Collect

We understand and respect your data privacy. Therefore, we will take appropriate measures to secure your data that we capture when you interact with our Service.

However, we do not claim that any third-party software, service(s), Controllers, or Processors cannot use your submissions and/or data from your device(s) for unlawful purposes.

We may collect any or all of the following kinds of data:

1. Personal Information: Name, contact (phone, Email ID, address), login credentials
2. Patient (Health) Data: NHS number, Site Code, ODS Codes, medical history, test results, and clinical information that the patients share with consent
3. Transaction Data: Payments processed securely via Stripe (we do not store full card details)
4. Metadata: Timestamps, user roles, audit trail, etc.
5. Technical and Analytics Data: IP address, device/browser type, app usage statistics and information about how you interact with our Service. We use Mixpanel as an Analytics Processor to analyse user journeys, feature usage and platform performance. This includes your Name and Email ID only. Clinical or other health information is not intentionally transmitted to Mixpanel for analytics purposes.
6. Blockchain Records: Proof of consent, transaction logs, and audit trail under a Smart Contract

Refer to the Data Retention and Privacy Policies of the third-party service providers for more details on how they use your data.

5. How we Use Your Data

We use your data for any or all of the following reasons:

1. Meet security standards of UK GDPR and DSPT requirements
2. To enable secure exchange of health data with authorised Controllers/Purchasers (with your consent)
3. Operate and improve our Service i.e., BlockMed Pro
4. Record and verify audit log using blockchain
5. Process payments and transactions using Stripe

6. Legal Bases for Processing Data

We process your data under the following bases:

1. Consent – explicit consent for collection and sharing of health data (GDPR Article 9).
2. Contract – to provide services and process transactions.
3. Legal obligation – to comply with healthcare and financial regulations.
4. Legitimate interests – to improve and secure our services.

Disclaimer: Special category health data is processed only with your explicit consent and in line with GDPR safeguards.

7. How We Store & Protect Your Data

We store and protect your data in the following ways:

1. Cloud services: We store data securely with encryption in a trusted provider i.e., Google Cloud Platform (GCP), London (West-2) in our case.
2. Blockchain: We maintain secure, tamper-proof records of consent and transactions under Smart Contract.
3. Security measures: We implement NHS DSPT standards, and GDPR-compliant safeguards (including encryption, Access Control including Multi-Factor authentication & IP restrictions, and audit logs) to help protect your data against unauthorised access, alteration, disclosure or loss.
4. Analytics: We use Mixpanel as an Analytics Processor to analyse user journeys, platform usage and feature interactions. Where available, we use Mixpanel's European Data Residency configuration. Analytics data shared with Mixpanel is limited to information necessary for these purposes. We do not intentionally transmit NHS numbers, clinical records or other health information to Mixpanel.

8. Who We Share Data With

We may share data with:

1. Authorised laboratories and pharmaceutical organisations, with your consent.
2. Analytics processor (Mixpanel) under strict DPA, approved sub-processors (i.e., Google Cloud Platform (GCP) and MongoDB Atlas in our case)
3. Third party service i.e., our payment processor (Stripe)
4. Blockchain service provider for secure record-keeping of patients' consents under Smart Contract
5. Any regulators (such as NHS), authorities, or auditors where legally required.

Disclaimer: We never sell your data outside of the framework mentioned above.

9. Data Retention

We keep your personal and patient data only as long as necessary to:

• Complete the exchange/payment transaction process
• Meet NHS DSPT requirements, regulatory obligations, and financial recordkeeping
• Resolve disputes and enforce agreements

We retain the data per client instruction or contract. The data retention ceases automatically once the contract terminates, unless subject to legal hold. Refer to our Data Retention Policy for more details.

For data retention related queries of BlockMed Pro's third-party vendors or processors, please refer to their DPA or retention policies.

10. Your Rights

Under the UK GDPR, you are allowed to contact us/Processor to:

• Access, rectify, or delete your data (as a data seller)
• Request privacy restrictions or object to processing
• Withdraw the permissions at any time
• File a complaint with the UK Information Commissioner's Office (ICO)

All rights must be initiated via your Controller. The organisation processes requests only upon written instruction from the Controller.

11. Breach Notification

If there's a breach involving personal data, we, being the Processor, notify the Data Controller, who further notifies the ICO without undue delay, and not later than 72 hours per the UK GDPR requirements.

The Controller is responsible for notifying regulators and individuals.

12. International Transfers

BlockMed Pro primarily stores and processes your data within the United Kingdom. We do not intentionally transfer your Patient (Health) Data or other substantive personal data outside the UK.

Where required for analytics purposes, we may share limited identifying information, such as your name and Email ID, with our analytics Processor, Mixpanel, and its authorised subprocessors, which may process such information outside the UK. Where such transfers occur, we ensure that appropriate safeguards and lawful transfer mechanisms are in place in accordance with applicable UK data protection law. We do not intentionally share NHS numbers, clinical records, diagnoses, medications or other health information with Mixpanel for analytics purposes.

13. Policy Updates

We review and update this notice annually. Any changes will be posted on our website and provided to clients as required by contract or law.

14. Contact

If you have any concerns regarding your data or this notice, contact our Data Protection Officer (DPO) right away. The contact details are as follows:

Data Protection Officer (DPO):
DataCo International UK Limited
Suite 1, 7th Floor, 50 Broadway, London, SW1H 0BL
Email: privacy@dataguard.co.uk
Telephone: +44 2035146557

You can also contact your national supervisory authority i.e., ICO (allocated under UK GDPR): UK: Information Commissioner's Office (ICO) – www.ico.org.uk