HEXPRESS HEALTHCARE LTD PRIVACY POLICY & COOKIES

This website is owned and operated by Hexpress Healthcare Limited ("We", "Us", "Our", trading as 121doc CH providing products and services to users and visitors ("You", "Your"). We take your privacy very seriously and we aim to protect and respect your privacy, and to use technology to enhance your online security. We ask that you read this Privacy Policy carefully as it contains important information on who we are and how and why we are collect, retain, store, use, will use and share your personal information. This Privacy Policy also explains your rights in relation to your personal information and how you can contact us, regulators or supervisory authorities in the event you have a complaint.

When we collect and use your personal data, we are subject to the General Data Protection Regulation (GDPR) (EU) 2016/679 (the "Regulation") and for the purposes of the Regulation, Hexpress Healthcare Limited is the "Data Controller", that is, the company responsible for and controlling the processing of your personal data.

Key terms

Please see below definitions of some key terms used in this Privacy Policy:

We, Us, Ours	HEXPRESS HEALTHCARE LIMITED, trading as 121doc
Our Data Protection Officer	Crawford Brysland CMPLY LTD [email protected] +44 203 823 6004
Personal data or information	Any information relating to an identified or identifiable individual
Special category personal data or information	Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership Genetic and biometric data Health, sex life or sexual orientation data

What personal information we may collect about you

We may collect and use the following personal information about you:

Your name and contact details, including address, email address, telephone number and company details
Information to enable us to check and verify your identity, e.g. your date of birth, etc
Your opinions and medical/medical history details
Information about your gender
Your location data
Your billing information, transaction and payment card information
Your contact history, order and purchase history and saved items
Information to enable us to conduct credit and other financial checks
Information about your use of our website, IT, communication and other systems
Your responses to surveys, competitions and promotions

Before you can use certain areas of this website, you will be asked to register on it and to provide your personal information, including 'sensitive personal data' as defined by the Regulation. For example, we will obtain your personal data if you register to use this website, complete the medical questionnaire, send us feedback, send something, contact us for any reason, register for a service, and purchase products or services. We may also obtain sensitive personal information about you if you provide it by completing the online medical questionnaire. If you provide such information, you will be consenting to our processing it for the purpose of obtaining a medical opinion and purchasing the treatment. This personal information is required to provide products and services to you. If you do not provide the personal information we ask for, it may prevent us from providing products and services to you.

We may monitor your use of this website through the use of cookies and similar technical solutions. For example, we may monitor how often you visit the website, which pages you visit, traffic data, location data, and the originating domain name of a user's Internet service provider. This information helps us to build a profile of customers. Some of this information will be aggregated for statistical purposes, i.e. we will not be able to identify you individually. For more information about our use of cookies, please consult our Cookie Policy. Occasionally, we may receive information about you from other sources (such as credit reference agencies), which we will add to the information we already hold about you in order to help us personalise our service to you.

How your personal information is collected

We collect most of this personal information directly from you through our website and app or by telephone, SMS, email or video consultation. We may also collect information directly from third parties, e.g. sanctions screening providers, credit reference agencies and customer due diligence providers; and from third parties with your consent, e.g. your family doctor or GP; and from cookies on our website, and via our IT systems, e.g. automated monitoring of our websites and other technical systems such as our computer networks and connections, communication systems, e-mail and instant messaging systems.

How and why we use your personal information

Under data protection law, we can only use your personal information if we have a proper reason for doing so. Our reasons include but are not limited to:

To comply with our legal and regulatory obligations;
For the performance of our contract with you or to take steps at your request before entering into a contract;
For the purposes of medical diagnosis and the provision of healthcare and treatment;
For our legitimate interests or those of a third party; and
Where you have given consent.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.

The table below explains what we use (process) your personal information for and our reasons for doing so:

What we use your personal information for	Our reasons
To provide treatment to our customers and for billing and order fulfilment	Necessary for the purposes of medical diagnosis and for the provision of healthcare and treatment
To help us identify our customers and any accounts they hold with us.	For the performance of our contract with our customers, or to take steps at their request before entering into a contract
To notify our customers of any changes to this Website or to our services that may affect them.	To comply with our legal and regulatory obligations For our legitimate interests or those of a third party Because you have given consent
To prevent and detect fraud against customers, our company, our business partners and other service providers and agencies.	For our and third parties' legitimate interests, i.e. to combat and minimise fraud that can be harmful to customers, to us or to third parties.
To conduct checks to identify customers and to verify their identity.
For security vetting and screening for financial and other sanctions or embargoes.
For fraud prevention and detection.
For other processing necessary to comply with professional, legal and regulatory obligations that apply to us and third party service providers, e.g. health and safety regulations or rules of our regulatory authorities.
To gather and provide information required for audits, enquiries or investigations by government, professional or regulatory authorities.	To comply with our legal and regulatory obligations.
To ensure business policies are adhered to, such as security and Internet use policies.	For our and third parties' legitimate interests, i.e. to make sure that we follow our internal processes so that we can provide the best service to customers.
For operational reasons, such as administration, improving efficiency, training and quality control.	For our and third parties' legitimate interests, i.e. to be as efficient as possible so that we can provide the best service to customers at the best price.
To ensure the confidentiality of commercially sensitive information.	For our and third parties' legitimate interests, e.g. to protect trade secrets and other commercially valuable information.
	To comply with our legal and regulatory obligations.
For statistical and behavioural analysis, and research to support our corporate governance and help us manage our business, e.g. in relation to our business results, financial performance, customer base, product range or other efficiency measures.	For our and third parties' legitimate interests, i.e. to be as efficient as possible so that we can provide the best service to customers at the best price.
For customer profiling and analysis of customers' purchasing preferences.
To customise this website and its content to customers' personal preferences.
To prevent unauthorised access and unauthorised modifications of systems.	For our and third parties' legitimate interests, i.e. to prevent and detect criminal activity that could damage us, third party service providers and customers.
	To comply with our legal and regulatory obligations.
For statutory returns.	To comply with our legal and regulatory obligations.
To update and enhance customer records.	For the performance of contracts with customers or to take steps at their request before entering into a contract.
	To comply with our legal and regulatory obligations.
	For our and third parties' legitimate interests, e.g. making sure that we can contact our customers about existing orders and new products.
To ensure safe working practices, and facilitate staff administration and assessments.	To comply with our legal and regulatory obligations.
	For our and third parties' legitimate interests, e.g. to make sure that we follow our internal procedures and work efficiently so we can provide the best service to customers.
To provide marketing services to: Existing and former customers; Third parties who have previously expressed interest in our services; and Third parties with whom we have had no previous dealings.	For our and third parties' legitimate interests, i.e. to promote our business to existing and former customers.
For credit reference checks by external credit reference agencies.	For our and third parties' legitimate interests, i.e. to ensure that customers are able to pay for our products and for services.
For external audits and quality checks, e.g. for ISO or "Investors in People" and the audit of our accounts.	For our and third parties' legitimate interests, i.e. to maintain our accreditations, so that we can demonstrate that we operate at the highest standards.
	To comply with our legal and regulatory obligations.

Promotional communications and service updates

We may use your personal information to send you updates (by email, SMS, telephone or post) about our services, including exclusive offers, promotions or new services.

We have a legitimate interest in processing your personal information for promotional purposes (see above: "How and why we use your personal information"). This means we do not usually need your consent to send you promotional communications. However, if your consent is required, we will ask for your consent separately and clearly.

We will always treat your personal information with the utmost respect and we will never share it with other organisations for marketing or other purposes. If you have given us permission to process your personal information, we may share your personal information with group or partner companies, business partners including affiliates, and we or they may contact you (unless you have asked us or them not to do so) by post, email, telephone, SMS, text/picture/video message or fax, about our services, products, promotions, offers or charitable purposes that may be of interest to you.

You have the right to opt out of receiving promotional communications any time by:

Contacting us.
Using the link "unsubscribe" in our emails or "STOP" number in SMS.
Update your marketing preferences via your customer account or secure members area.

We may ask you to confirm or update your marketing preferences if you instruct us to provide further products and services in the future, or if there are changes in the law, in regulations, or the structure of our business.

Who we share your personal information with

We routinely share your personal information with:

Group or partner companies and business partners.
Third parties we work with to carry out our services and deliver products and services to you such as payment service providers, warehouses, delivery companies and courier services such as Royal Mail, UPS and others, and third parties who act on your behalf to collect your order from us and deliver it to you such as Kwik Shipments Limited.
Other third parties who help us with business operations, e.g. marketing agencies or web/website host providers.
Third parties you have authorised, such as social media sites with which you have linked your account, or third party payment providers.
Law enforcement agencies in connection with any investigation into the prevention of unlawful activity.
Credit reference agencies.
Insurers and brokers.
Banks and merchant account providers.
Regulators.

We share your personal information with third parties who help us to deliver targeted marketing campaigns and to personalise your experience online. These providers include Ve Global UK Limited. Click here to see Ve's privacy policy (https://www.ve.com/legal/privacy-policy) to see how your personal data is being processed. To opt out click here (https://www.ve.com/legal/privacy-policy#opting-out). You can opt out by:

Contacting Ve at [email protected] to inform Ve that you would like to opt-out of their use of your personal information
Deleting cookies from your devices and browsers
If you are using Safari browser version 11.2 or above, toggling the "Limit Ad Tracking" setting on your device orcomputer
Visiting https://www.youronlinechoices.com/uk/your-ad-choices, finding VE in the list of online behavioural advertising companies and selecting 'off'
If you have an Apple device, updating to iOS 6.0 or higher and setting Limit Ad Tracking to 'ON'
If you have an Android device, selecting "Google on your main settings menu, choosing the "Ads" option and selecting "Opt out of Ads Personalization"

We only allow service providers to handle your personal information if we are satisfied that they will take appropriate measures to protect your personal information. We also impose contractual obligations on service providers requiring them to use your personal information only to provide services to us or to you. In specific circumstances, we may share your personal information with external auditors, e.g. with respect to ISO or our "Investors in People" accreditation and the audit of our accounts.

We may disclose and exchange information about you with law enforcement agencies and regulators to comply with our legal and regulatory obligations.

We may also share your personal information with other parties, such as potential buyers of some or all of our business or during a business re-structuring. All personal information is normally anonymised, but this may not always be possible. The recipient of any information will be bound by confidentiality obligations.

Where your personal information is stored

Information may be held at our offices, the offices of our group or partner companies, by third party persons, service providers, agencies and agents , as described above (see "Who we share your personal information with").

Some of these third parties may be located outside the European Economic Area. For more information on how we shall safeguard your personal information in such circumstances, please see below "Transferring your personal information out of the EEA".

Protecting your personal information

We use adequate security measures to prevent the unwanted loss, misuse or unlawful access to your personal information, and continually test our systems. We limit access to your personal information to those with legitimate business reasons. The processing of your personal information takes place only in an authorised manner and confidentially.

We also have procedures to deal with suspected or alleged data security breaches. We will notify you and the relevant regulatory authorities of any suspected or alleged data security breach where we are legally required to do so.

We use technical and organisational security measures to protect your personal information, for example:

Your data is stored on secure servers.
Payment details are encrypted using SSL technology.
Access to your account is controlled by individual username and password that are unique to you.

While we make every reasonable effort to protect your personal information, you acknowledge that the use of the Internet is not completely secure and therefore we cannot guarantee the security or integrity of any personal information provided by you or transmitted to you via the Internet.

If you would like detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online challenges, please visit www.getsafeonline.org. Get Safe Online is supported by the UK government and leading companies.

Monitoring

We may monitor and record communications with you, including telephone calls and emails, for training, quality assurance, fraud prevention, and compliance.

Credit checking

To enable us and other group or partner companies to make credit decisions about you and to prevent fraud and money laundering, we may search the files of credit reference and fraud prevention agencies (which will record such searches). We may share information about how you manage your customer account with these agencies, and your information may be linked to records of other people who live at the same address and/or with whom you are financially connected. Other lenders or credit agencies may use this information to help them make credit decisions about you and those with whom you are financially connected, as well as for fraud prevention, debt collection and money laundering prevention. If you provide false or inaccurate information and we suspect fraud, we will record this.

How long your personal information will be kept

The Ministry of Health provides for a minimum retention period for health data. The company follows these guidelines at all times. Under the 2016 Record Management Code of Practice for Health and Social Care, the statutory retention period for medical data is 8 years, after which the records are reviewed and, if no longer required, destroyed.

We will retain your personal information for as long as you have an account with us or we provide you products and services to:

Fulfil our legal obligations about data retention.
Respond to any questions, complaints or claims made by you or on your behalf.
Show that we have treated you fairly.

We will not retain your personal information for longer than necessary for the purposes set out in this Privacy Policy. Different retention periods apply for different types of personal information. If the retention of your personal information is no longer necessary or required, we will delete or anonymise it.

Information about other individuals

If you provide us with information on behalf of someone else, you confirm that this person has designated you as their representative, has authorised you and appointed you to act on their behalf and to take the following actions on their behalf:

Receive data protection notices.
Consent to the transfer of their personal information abroad.
Consent to the processing of their personal information.
Consent to the processing of their sensitive personal information, such as health information.

Transferring your personal information out of the EEA

In order to provide our services and to meet all our obligations, it may be necessary for us to transfer your personal information outside the European Economic Area (EEA). We may share your personal information outside the EEA, e.g.:

With our business partners outside the EEA.
With your and our service providers located outside the EEA.
If you yourself are located outside the EEA.
If the services we provide have an international dimension.

By registering on this website, you agree that we may transfer your personal information outside the EEA. Please be assured that we always use all appropriate security measures to safeguard your personal information. These transfers are subject to special regulations under European and UK data protection laws.

We may transfer your personal information to countries that have been evaluated by the European Commission as providing an adequate level of protection for personal information. We may also transfer your personal information to non-EEA countries, which do not have the same data protection laws as the United Kingdom and the EEA; and in those circumstances, we will ensure that any transfer of personal information complies with our data protection laws and we will use standard data protection contract clauses, which have been approved by the European Commission, thus safeguarding your privacy rights and giving you access to remedies in the unlikely event of a security breach.

If you would like any further information, please contact us or our Data Protection Officer (see "How to contact us" below).

Your rights

You have the following rights, which you can exercise free of charge:

Right of access	The right to be provided with a copy of your personal information.
Right to rectification	The right to require us to correct any mistakes in your personal information.
Right to be forgotten	The right to require us to delete your personal information in certain situations. Please note: Pursuant to the Records Management Code of Practice for Health and Social Care 2016, we are legally required to keep your medical information for 8 years after using our service and cannot erase your personal information prior to this deadline.
Right to restriction of processing	The right to require us to restrict the processing of your personal information in certain circumstances, e.g. if you contest the accuracy of the information we hold.
Right to data portability	The right to receive the personal information you have provided to us in a structured, commonly used and machine-readable format and/or to transmit that information to a third party in certain situations.
Right to object	The right to object: At any time to your personal information being processed for direct marketing (including profiling) In certain circumstances to our continued processing of your personal data, e.g. processing carried out for the purpose of our legitimate interests.
Right against automated individual decision-making	The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects or similarly significantly adversely affects you.

For more information on each of these rights and the circumstances in which they apply, please contact us or use the information Commissioner's Office (ICO) zu den individuellen Rechten.

If you want to exercise any of these rights, please:

Email, call or write, to us or our Data Protection Officer (see below: "How to contact us");
Give us enough information to identify you (e.g. your full name, address, username, registration details and customer account or order reference number);
Give us a proof of your identity and address (copy of driver's license, identity card or passport and a recent utility bill or credit card statement);
Indicate what information is incorrect and what it should be replaced with (if you are requesting that we correct any inaccuracies in your information);
Indicate the communication channel you are complaining about (if you are asking us not to use your personal data for direct marketing in a certain way, e.g. email or telephone); and
Confirm the right you want to exercise and the information to which your request relates.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. You should read this Privacy Policy to ensure that you are aware of the most recent version that is in effect every time you access our website.

How to contact us

We are happy to answer your questions and welcome your feedback. Please contact us or our Data Protection Officer by post, email or telephone if you have questions about our Privacy Policy or the personal information we hold about you.

Our contact details are as follows:

Headquarters: 106 Lower Addiscombe Road, Croydon CR0 6AD, United Kingdom
Contact by email: [email protected]
Contact by phone: +49 1573 5991991

Our Data Protection Officer contact details are as follows:

Crawford Brysland
CMPLY LTD
[email protected]
+44 203 823 6004

How to complain

We hope that we or our Data Protection Officer can resolve any query or concern about our use of your information.

The General Data Protection Regulation also gives you the right to lodge a complaint with a regulatory authority, in particular in the EU (or EEA) country where you work, normally reside, or in which any alleged breach of data protection laws has occurred. The UK regulator is the Information Officer, which can be reached via https://ico.org.uk/make-a-complaint/ or by phone (0303 123 1113)

Need extra help?

If you require this Privacy Policy in another format (e.g. audio, large print, braille), please contact us (see above "How to contact us").

COOKIE POLICY

A cookie is a small text document that is stored on your computer (or other electronic device) while visiting our website.

We use cookies and other online tracking technologies, such as web beacons, action tags, local shared objects or one-pixel GIFs, on this website to:

Keep track of which products you put in your shopping basket and to facilitate the check-out process.
Recognise the user when visiting this website (this speeds up access to the website)
Get information about your preferences, online movements and internet usage.
Better understand the needs and interests of our visitors and customers, and subsequently conduct research and statistical analysis to improve our content, products and services.
Personalise and tailor our marketing and advertising efforts, and those of our partners, to suit your interests.
Make your visit to our website more efficient and enjoyable.

Information obtained through the use of cookies does not normally contain any of your personal information. However, we may receive information about your computer or other electronic devices, such as your IP address, browser information, and / or other Internet log information that you do not normally identify personally. We may collect your personal information, but only if it is voluntarily provided by you, for example by completing our online medical questionnaire or by purchasing our products or using our services.

In most cases, we need your consent to use cookies on this website. The exception to this is when a cookie is essential to perform certain services requested by you. This includes processes such as placing products in the shopping cart and the check-out process.

Approval

Browser settings

When you visit our website and allow your browser settings to be cookies, we interpret this as consent to the use of cookies and similar technologies as described in the policies.

If you change your mind about the use of cookies, you can modify your browser settings to automatically decline or disable cookies.

Note on the homepage

On our homepage is a note that describes how we use cookies and a reference link to this policy. If you use the website after the notice is displayed, we assume that you agree to the use of our cookies as described in the Cookie Policy and in the Privacy Policy.

Third-party cookies

We work with third parties who may also use cookies on our website. The third party providers are responsible for the cookies they use on our website. If you would like more information, please visit the website of the relevant third-party provider. Additional information can be found in the table below.

VE Global UK Limited — to help make the ads you see after browsing our website more relevant and interesting to you, VE Global UK Limited uses cookies. These cookies allow us to show you our advertisements on websites across the internet based on your past activity on our website and personalise what you see whilst browsing our website. Click here (https://www.ve.com/legal/cookie-policy) to see Ve's Cookie policy to see how your personal data is processed. To opt out click here (https://www.ve.com/legal/privacy-policy#opting-out). You can opt out by:

Contacting Ve at [email protected] to inform Ve that you would like to opt-out of their use of your personal information.
Deleting cookies from your devices and browsers.
If you are using Safari browser version 11.2 or above, toggling the "Limit Ad Tracking" setting on your device or computer.
Visiting https://www.youronlinechoices.com/uk/your-ad-choices, finding VE in the list of online behavioural advertising companies and selecting 'off'.
If you have an Apple device, updating to iOS 6.0 or higher and setting Limit Ad Tracking to 'ON'.
If you have an Android device, selecting "Google" on your main settings menu, choosing the "Ads" option and selecting "Opt out of Ads Personalization".

1. Absolutely necessary

"Absolutely necessary" cookies allow you to easily navigate through a page, to use the most important functions and to order products. These cookies do not collect information about you that could be used for promotional purposes or for tracking your browsing habits.

Consent to these cookies is a necessary condition for the secure use of the website. If you block these cookies, we cannot guarantee you the necessary security or anticipate the effects of using the website.

Here is a list of cookies that are considered "essential":

121doc cookies

PHPSESSID

Third-party cookies
COOKIE	HOST
JSESSIONID	secpay.com

2. Performance

"Performance" cookies collect information about how you use our website, such as which pages you visit and if you experience difficulties. These cookies do not collect any information that could identify you. All information collected is anonymous and only serves to improve the operation and usability of the website and to see what really interests visitors.

If you use our website, this indicates that you accept the performance cookies. Accepting these cookies is a condition for using the website. If you block these cookies, we cannot guarantee which services our website can provide for you.

Here is a list of cookies that we call performance cookies:

121doc cookies

__utma

__utmb

__utmc

PAPVisitorId

ysm_bbk1U257HHBN7MJQVE8CHUV3QAQMI0

Third-party cookies
COOKIE	HOST
_utma _utmb _utmc _utmz	secpay.com
_utma _utmb _utmc _utmv _utmz	S3-eu-west-1.amazonaws.com
Pref VISITOR_INFO1_LIVE	youtube.com
PAPVisitorId	hexpressaffiliates.com
B	yahoo.com
BX	overture.com
yes_email_invite	bizrate.com

3. Functionality

"Functionality" cookies serve to provide certain services or to remember already saved settings and thus make your visit to the website more comfortable.

You can decide if you want to use these cookies or not. If you do not allow these cookies, we cannot offer you some of our services and may have to reduce the service we can offer you. It is also possible that blocking these cookies will not allow us to remember that you had declined a specific service.

Here is a list of cookies we count as "functionality":

121doc cookies

IS_REDIRECT

REDIRECT_URL

Third-party cookies
COOKIE	HOST
LivePersonID HumanClickKEY HumanClickACTIVE HumanClickSiteContainerID_58906084	liveperson.net

4. Additional services

Cookies for "additional services" are provided by third-party providers and used for these services, such as the 'Like' button or the 'Share' button. These third parties provide these services to see that you have visited our website.

You can decide for yourself whether you want to use these cookies or not. If you do not allow these cookies, you may be unable to use some services. All these cookies are provided and managed by third parties, and you can usually control and block these cookies yourself using third-party services.

Here is a list of cookies we count as "Additional Services":

121doc cookies

__atuvc

is_returning

remember

Third-party cookies
COOKIE	HOST
di dt loc XTC uid UVC uit PSC	addthis.com
Pref	google.com
guest_id PID	twitter.com
_xgcid _xguid _mpush	xgraph.net
sess uuid2	adnxs.com

Manage your cookies

If you would like more information on how we manage our cookies.

Disable cookies

If you do not accept our cookies, you may adjust your browser settings to refuse cookies. If you decide to take this step, we point out that you may not be able to use some features of our website.

Additional Information

For more information about cookies and their deactivation, please visit the following websites in English: www.aboutcookies.org , www.allaboutcookies.org or www.youronlinechoices.eu .