Privacy Policy

1. Introduction

This website, www.iqdoctor.co.uk, is operated by IQM Medical Limited (company number: 10173012) ("IQ Doctor”, “we”, “our”, “us”). We are the data controller responsible for your personal data.

We understand the importance of handling personal information carefully and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are committed to respecting your privacy and protecting your personal data.

This Privacy Notice explains what personal information we collect, how we use it, who we share it with, and your rights in relation to your personal data. It forms part of our website terms and conditions and applies whenever you use our services.

2. Who we are

Company details:

IQM Medical Ltd
Registered address: Bradford Court, 123-131 Bradford Street, Birmingham, B12 0NS.
Company number: 10173012
ICO registration number: ZA320053

Data Protection Officer (DPO):

Name: Camran Khan
Email: help@iqdoctor.co.uk
Address: Bradford Court, 123-131 Bradford Street, Birmingham, B12 0NS.

3. What personal data do we collect

Identity data: name, date of birth, gender.
Contact data: address, email, phone number.
Health data (special category): medical history, prescriptions, consultation notes, test results, and information provided to our clinicians.
Financial data: billing address. We do not hold payment card details.
Technical data: cookies (see ‘Cookies’ section).
Communication data: emails, support tickets, and telephone call transcripts.

4. How we use your personal data & legal bases

We process your personal data only where we have a lawful basis under UK GDPR. The main bases we rely on are:

Performance of a contract – to provide pharmacy and prescribing services, deliver medicines, verify your identity, detect fraud, and manage your account.
Legal obligation – to comply with pharmacy and healthcare regulations, professional record-keeping rules, and other legal requirements.
Consent – for optional services such as marketing communications.
Legitimate interests – for service improvement, staff training, fraud prevention, and audit (balanced against your rights).

For special category health data, we rely on:

Article 9(2)(h) UK GDPR (healthcare and treatment purposes).
Article 9(2)(i) UK GDPR (public health and regulatory obligations).

We will primarily use your personal data for the following purposes:

To register your account and keep it secure.
To verify your identity and create your patient record.
To provide consultations, healthcare services, and prescribed medication.
To process and fulfil any orders you place with us.
To respond to queries, refund requests, or complaints.
To share information with third-party suppliers/software where necessary for dispensing and delivery.
To analyse how our website and services are used, produce statistical information, monitor performance and improve our services.
To communicate with you about services, orders, updates, or regulatory changes.
To send you marketing communications where you have given consent.
To comply with applicable law, including responding to lawful requests from courts or regulators.

5. How long do we keep your data

Prescription and consultation records: minimum 8 years (as required by healthcare regulation).
Order records: 8 years (in line with prescription and consultation records, and legal reasons).
Customer service records: up to 3 years after closure.
Marketing records: until you withdraw consent or unsubscribe.

When no longer required, data is securely deleted or anonymised.

6. Who we share your data with

We may share your personal data with trusted third parties where necessary to deliver our services, subject to strict confidentiality and security safeguards:

Healthcare professionals and regulators: prescribing doctors, the General Pharmaceutical Council (GPhC), the Medicines and Healthcare products Regulatory Agency (MHRA), the NHS, and other professional or regulatory bodies where required by law.
Service providers: IT and hosting providers, secure communication platforms, data storage services, email and SMS providers, and customer support systems.
Delivery companies: couriers and logistics partners to deliver your medicines.
Payment processors: secure third-party payment providers. We do not store your full payment card details ourselves.
Analytics and security providers: to help us understand how our website is used, improve performance, and detect fraud or misuse.
Legal and regulatory bodies: in response to lawful requests from courts, regulators, or law enforcement agencies.

We require all third parties to process your data securely, lawfully, and only for the specific purposes we instruct.

7. International transfers

Some of our service providers (for example, cloud hosting or email services) may transfer your personal data outside the UK/EEA. When this happens, we ensure appropriate safeguards are in place, such as:

Adequacy regulations issued by the UK government confirming that the destination country ensures adequate protection; or
Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA) approved by the ICO, combined with risk assessments to ensure appropriate protection.

You can contact us if you would like more information about these safeguards.

8. How we protect your data

Encrypted databases and secure servers.
Secure and encrypted connection when accessing the website.
Role-based access control for staff.
Regular staff training on confidentiality.
Security monitoring and regular audits.
Secure data disposal.

9. Your rights

You have the following rights under UK GDPR:

Right of access (Article 15).
Right to rectification (Article 16).
Right to erasure (“right to be forgotten”) (Article 17).
Right to restrict processing (Article 18).
Right to data portability (Article 20).
Right to object (Article 21).
Rights related to automated decision-making and profiling (Article 22).

To exercise your rights, contact us using the details above. We will respond within one month.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we handle your data:
Website: www.ico.org.uk
Telephone: 0303 123 1113

If we rely on your consent (for example, for marketing), you may withdraw that consent at any time by:

Clicking the “unsubscribe” link in any marketing email,
Updating your account settings (if available), or
Contacting us directly at help@iqdoctor.co.uk

10. Automated decision-making

We do not carry out automated decision-making or profiling that has a legal or similarly significant effect on you.

11. Children’s data

Our services are intended for adults aged 18 and over. We do not knowingly collect information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Data breaches

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and also notify the ICO within 72 hours, as required by law.

13. Cookies & tracking

We use cookies and similar technologies to operate our website, understand how our website and services are used, improve their performance and effectiveness and, where you give permission, support advertising and personalisation.

These may include:

Strictly necessary cookies – required for the operation, security and integrity of our website and services, including session management and identifying automated bots and crawlers. These technologies cannot be switched off.
Analytics and statistical cookies – help us understand how our website is used, including website traffic, user journeys, interactions and performance, so that we can measure and improve our services.
Advertising and personalisation cookies – used for advertising, measurement and personalisation where you have given the required permission.

Where our use of analytics technologies meets the statistical purposes exception under the Privacy and Electronic Communications Regulations (PECR), these technologies may be enabled without obtaining your prior consent. Where we rely on this exception, the relevant storage or access is used solely for the purpose of collecting statistical information about how our website or services are used with a view to improving them.

You can object to the use of analytics for statistical purposes at any time by opening Cookie Settings and switching off Statistics. Once you object, we will stop the relevant storage or access for this purpose.

Advertising and personalisation technologies are treated separately and, where consent is required, will only be enabled where you have chosen to allow them through our Cookie Settings.

You can review or update your cookie preferences at any time through Cookie Settings.

Name of Cookie	Category	First / Third Party	Provider	Purpose
PHPSESSID	Necessary	First Party	iQ Doctor	System-required cookie used to maintain the user's website session and support essential website functionality.
is_bot	Necessary	First Party	iQ Doctor	System-required cookie used to identify and distinguish legitimate website visitors from automated bots and crawlers. This supports the security, integrity and reliable operation of the website and cannot be switched off.
CookieConsent	Necessary	First Party	Cookiebot	Stores the user's cookie preferences so that their choices can be remembered and respected on subsequent visits.
_ga	Statistics	First Party	Google Analytics	Used to distinguish visitors using a randomly generated identifier and generate statistical information about how our website and services are used.
_ga_S8SK8KFGW0	Statistics	First Party	Google Analytics	Used to maintain session information and support statistical analysis of how visitors interact with our website and services.
_gid	Statistics	First Party	Google Analytics	Used to distinguish visitors and generate statistical information about website usage.
FPID	Statistics	First Party	Google / iQ Doctor	First-party identifier used as part of our server-side analytics configuration to support statistical measurement of website usage.
FPLC	Statistics	First Party	Google / iQ Doctor	Used as part of our server-side analytics configuration to support statistical measurement across our website.
_clck	Statistics	First Party	Microsoft Clarity	Retains a Clarity browser identifier and preferences to help us understand how visitors interact with our website.
_clsk	Statistics	First Party	Microsoft Clarity	Connects multiple page views into a single session to support website interaction and performance analytics.
CLID	Statistics	Third Party	Microsoft Clarity	Used by Microsoft Clarity to identify a browser and provide information about interactions with our website.
_gcl_au	Marketing	First Party	Google	Used by Google advertising services to support advertising and conversion measurement where marketing permission has been provided.
test_cookie	Marketing	Third Party	Google / DoubleClick	Used by Google's advertising services to determine whether the browser supports cookies.
_fbp	Marketing	First Party	Meta	Used by Meta to support advertising delivery, conversion measurement and personalisation where marketing permission has been provided.
_uetsid	Marketing	First Party	Microsoft Advertising	Used by Microsoft Advertising to support advertising measurement and understand interactions following advertising activity.
uet_vid	Marketing	First Party	Microsoft Advertising	Used by Microsoft Advertising to identify a browser and support advertising measurement and personalisation where marketing permission has been provided.
MUID	Marketing	Third Party	Microsoft	Used by Microsoft to identify unique browsers and support advertising measurement and personalisation.
MR	Marketing	Third Party	Microsoft	Used by Microsoft advertising services to support advertising measurement and maintain information associated with advertising activity.
ANONCHK	Marketing	Third Party	Microsoft	Used by Microsoft advertising services to support advertising measurement and personalisation.
SM	Marketing	Third Party	Microsoft	Used by Microsoft services to synchronise browser identifiers used in connection with measurement and advertising services.
SRM_B	Marketing	Third Party	Microsoft	Used by Microsoft services in connection with advertising, measurement and personalisation.

14. Clinical & Regulatory Disclosures

In some cases, we are legally required to share your personal data with regulators or professional bodies. For example, we may need to provide information to the General Pharmaceutical Council (GPhC) or the NHS to comply with healthcare oversight obligations.

15. Changes to this policy

We keep this Privacy Notice under regular review. Updates will be published on this page with a new “last updated” date.