PLEASE READ THIS POLICY CAREFULLY BEFORE USING getUBetter SERVICES
You must be 18 years or older to use our Services.
Protecting your privacy and personal data is very important to getUBetter (“us”, “our”, “we” or “getUBetter”). It is vitally important to us that our customers feel secure when using our “Services”, as further described in this policy.
About Us
We're getUBetter Limited, a company registered in England and Wales (company number 08330528). Our office is The Old Dairy, Ashton Hill Farm Weston Road, Failand, Bristol, England, BS8 3US, UK. Our VAT number is 191176892. We are responsible for operating this Website and our associated Services, including the processing of your personal data.
Unless stated otherwise in this privacy policy, we shall be the data controller of your personal data.
Summary
This privacy policy, collectively with our terms and conditions in the provision of our Services (as defined below), sets out our responsibility and commitment to protecting the privacy and confidentiality of your personal data. In particular, this policy details the basis on which any personal data we collect from you, or that you provide to us, will be processed by getUBetter when you:
(together, the “Services”);
Please read this privacy policy carefully to understand the types of personal data we collect from you, how we use that personal data, the circumstances under which we will share it with third parties, and your rights in relation to the personal data you provide to us. It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.
This privacy policy is provided in a layered format so you can click through to the specific areas below:
The data we collect about you
Processing of sensitive personal data
How is your personal data collected?
How we use your personal data and justification of use
Marketing
Where we store your personal data
Disclosure of your personal data
How long we retain your personal data
Your rights
Change to our privacy policy
Cookies
Contact
What we do
Our Website, Apps, WebApp and the Services available through these methods are provided by us, and we partner with NHS Trusts and other healthcare providers to provide you with access to recovery and prevention self-management guidance and advice and, as appropriate, other health services in your area. To inform you about the services in your area, our Services also contain information provided by third parties. For example, through our Services, you will be able to request treatments with NHS service providers or other local service providers, and, when appropriate we will refer your details to that service provider in accordance with, and as described in, this privacy policy.
You can choose for us to introduce you to any of these services, or there may be links to such third-party websites, application, or plug-ins through our Services. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. Please note that these third parties have their own privacy policies and that we do not accept any responsibility or liability for their policies or processing of your personal data. When you leave our Website, WebApp or our App, we encourage you to read the privacy policy of every other website you visit.
We also partner with other third-party partners (as further described in the ‘How is your personal data collected?’ section). Where you engage with the services provided by any such third parties which uses our technology, or if we have been engaged by a third party to provide you with the Services, we will be acting as a processor of your personal data, and the relevant third-party will be the data controller. The third-party will have their own privacy policies which will explain how they use your personal data, which we encourage you to read. We do not accept any responsibility or liability for their policies or their processing of your personal data.
The data we collect about you
Personal data means any information about an individual from which that person can be identified.
We explain the different types of personal data we collect, use, store and transfer about you which we have grouped together as follows:
If you do not provide personal data which we request from you, we may be unable to provide you with our defined Services.
Processing of sensitive personal data
The nature of the Services means that, where necessary to act in your best interests, we need to be able to process certain sensitive data about your symptoms and health concerns. Due to its sensitivity, health data has the protected status of “special category data” under data protection law and we are subject to additional compliance obligations to ensure such data is adequately protected. Some of the data you provide to us (including details of your symptoms) will constitute special category data. We explain how we use this data in the below table.
We also collect anonymised aggregated data about how you use our Services. This data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, when lawfully permitted to do so we may aggregate technical data collected from you to calculate the percentage of users accessing a specific feature on our App, or we may create anonymous, aggregated reports such as statistics, ratings, analysis, and reviews that we may provide for research purpose. Your feedback and use of our Services helps improve recovery for you, others and future generations.
How is your personal data collected?
We collect and process the following data about you:
You will be asked to provide us with your personal data when you:
We automatically collect technical data about your equipment, browsing actions and patterns and usage data about how you use our Apps or WebApp, as further described in the How we use your personal data and justification of use section below.
Please see the How we use your personal data and justification of use section below for further information.
Our Partners will change from time to time. If you would like further information about our current Partners, please contact us using the contact details set out below.
Other than our Partners identified above, we do not receive personal data from other sources.
How we use your personal data and justification of use.
We have data protection compliance procedures in place to oversee the effective and secure processing of your personal data and we will only use your personal data where the law allows us to. Use of personal data under applicable data protection laws must be justified under one of a number of legal “grounds” and we are required to set out the ground in respect of each use of your personal data in this policy. These are the principal grounds that justify our use of your personal data, and most commonly, we will use your personal data in the following circumstances:
We have set out below, in a table format, a description of all the ways we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.
|
Purpose / activity |
Type of Personal Data |
Lawful basis for processing |
|
WebApp / App |
||
|
To provide you with access to our App or WebApp to use our Services and create an account for you |
Registration Data |
Consent
Necessary for our legitimate interests (so we can identify you when you access our Services) |
|
To provide you with our Services on the App and WebApp |
Identity Data
Registration Data
Recovery Data |
Consent
Performance of a contract with you
We also rely on your explicit consent to process your health data for this purpose |
|
As part of our Services, to obtain your NHS Number and link your Recovery Data to your NHS Number so that your medical records are updated to inform your clinician if you have registered to use the App. |
Identity Data
Registration Data
NHS Number |
Performance of a contract with you
We also rely on your explicit consent to process your health data for this purpose |
|
To support your recovery by sending emails with updates |
Identity Data
Registration Data |
Performance of a contract with you |
|
To connect and refer you to your healthcare providers (including doctors, GP surgeries, hospitals, healthcare providers) (our clients) and local services of your choice on the App or WebApp |
Identity Data
Registration Data
|
Performance of a contract with you
We also rely on your explicit consent to process your health data for this purpose |
|
To contact you where you have difficulty using the App or WebApp |
Email address
Recovery Data |
Performance of a contract with you
We also rely on your explicit consent to process your health data for this purpose |
|
To notify you about changes to our Services |
Identity Data
Registration Data |
Performance of a contract with you |
|
Create electronic versions of documents for you to provide to your practitioner |
Identity Data
Registration Data
Recovery Data |
Performance of a contract with you
We also rely on your explicit consent to process your health data for this purpose |
|
To remember you so that you don’t have to re-enter your details each time you log in |
Identity Data
Registration Data |
Necessary for our legitimate interests (to ensure we provide you easy access and a great level of service) |
|
For our internal operations, including, data analysis and data statistics |
Identity Data
Registration Data
Technical Data
Usage Data |
Necessary for our legitimate interests (to administer and improve our Services) |
|
For evaluation of our Services we share with our NHS partners (NECS) identifiable data that they then anonymise to enable aggregated data to track and improve our Services |
Identity Data
Registration Data
Recovery Data
Usage Data |
Necessary for our legitimate interests (to administer and improve our Services) |
|
Clinical portal |
||
|
To enable you to access our clinical portal. |
Unique username and password |
Performance of a contract with you |
|
Our Partners Apps |
||
|
To register you as a user of our Partner’s app and services and create you an account to access such services |
Email address (provided to us by our Partner)
Registration Data (provided to us by you when we create an account for you to access the Partner’s services) |
Necessary for our legitimate interests (to perform our obligations under our contract with the relevant Partner and to ensure you are able to access and benefit from the use of their app and services) |
|
Website, App and our WebApp |
||
|
To use data analytics to improve, test and update our Services, Website, App and WebApp, marketing, customer relationships and to monitor its performance and effectiveness |
Technical Data
Usage Data |
Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy) |
|
To administer and protect our business, Website, App and WebApp (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) |
Identity Data
Registration
Technical Data |
Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)
Necessary to comply with a legal obligation |
|
Develop and test new products, services and features |
Technical Data
Usage Data |
Necessary for our legitimate interests (to improve our Services) |
|
For you to participate in clinical research |
Identity Data
Registration Data
Recovery Data |
Consent
We also rely on your explicit consent to process your health data for this purpose |
|
Improve user experience and the quality of the content available. |
Technical Data |
Necessary for our legitimate interests (to define types of customers for our Services, keep our Website, App and Webapp relevant, to develop our business and inform our marketing strategy) |
|
To make suggestions and recommendations to you about services that may be of interest to you |
Usage Data Technical Data |
Necessary for our legitimate interests (to develop our Services and grow our business) |
|
To help us identify and fix defects or errors in our systems |
Usage Data
Technical Data |
Necessary for our legitimate interests (to ensure our Services and systems are running as they should) |
|
To give you reminders, emails or alerts |
Identity Data
Registration Data |
Consent |
Marketing
We may use personal data for marketing products and services to you in the following ways:
Types of marketing activity:
We will only use your personal data to send you electronic marketing messages if we have consent from you to do so (or if you are an existing customer and have not opted out of receiving marketing materials).
We will provide an option to unsubscribe or opt-out of further communication on any electronic marketing communication sent to you or you may opt out by contacting us at any time using the details set out at the end of this privacy policy.
Where we store your personal data
The personal data that we collect from you (including email addresses that form part of our prospective marketing database) are processed only in the UK and stored at a UK data centre. Sensitive personal data between our “Apps” or “Webapp” and our server is transferred in encrypted form using Secure Socket Layer (“SSL”).
Your passwords and data for our Apps, WebApp, Website and our Partners’ apps are stored on getUBetter servers in encrypted form. We do not disclose your account details to any third party. It is your responsibility to keep your password secure. When transmitting sensitive personal data, you should always make sure that your browser can validate the getUBetter certificate. Unfortunately, the transmission of personal data via the internet is not completely secure. Although getUBetter will do its best to protect your personal data, we cannot guarantee the security of your data transmitted to our Website, any transmission is at your own risk. Once we have received your personal data, we will use strict procedures and security features to try to prevent any unauthorised access.
Transfers of personal data outside of the UK
We do not actively share any personal data outside the UK.
In the unlikely event where we need to send your data outside the UK, we will ensure that any such transfers are only undertaken following an assessment of the level of protection afforded in the receiving country or jurisdiction, and will put in place the international data transfer agreement (“IDTA”) or UK addendum to the new EU Standard Contractual Clauses (“UK Addendum”) to ensure that your data is protected with the appropriate technical and organisational controls.
Disclosure of your personal data
We may also disclose your personal data to the following third parties for the purposes specified in the above table:
We will not sell your personal data (or any other data you provide us with) to third parties, however, we reserve the right to share any data, which has been anonymised and/or aggregated. You acknowledge and accept that we own all right, title and interest in and to any derived data or aggregated and/or anonymised data collected or created by us.
How long we retain your personal data
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
Our retention periods reflect the NHS Records Management Code of Practice for Health and Social Care 2016 and also based on business needs and your personal data that is no longer needed is either irreversibly anonymised (and the anonymised personal data may be retained) or securely destroyed.
Please get in touch using the details set out below if you require further information about our retention periods.
Your rights
Under data protection legislation, you have various rights in relation to your personal data. All of these rights can be exercised by contacting us at contact@getUBetter.com.
You have the following rights in relation to your personal data:
Where you request getUBetter to rectify or erase your personal data or restrict any processing of such personal data, getUBetter may notify third parties to whom such personal data has been disclosed of such request. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons, for example, the NHS may ask us to retain some data for legal purposes. Additionally, such third parties may have the right to retain and continue to process such personal data in its own right, for example doctors, GP Surgeries, Healthcare professionals, local health related services or Hospitals.
Asking us to stop processing your personal data means that, dependent upon our defined responsibility as data controller or data processor as per your Health Care Provider we will need to notify your Health Care Provider of your request. Your Health Care Provider Organisation has the legal responsibility to maintain a record of care provided so, ultimately, has the authority to respond to your request. On receipt of your request, getUbetter will acknowledge the request and keep you informed of the Health Care Provider's instructions. Where authority to stop processing your data is received, getUBetter will anonymise all identifiable data whilst retaining storage of the anonymised data on secure cloud-based data servers, which shall only be used for aggregate data analysis. Asking us to stop processing your personal data or deleting your personal data will likely mean that you are no longer able to use getUBetter Services, or at least those aspects of the Services which require the processing of the types of personal data you have asked us to delete, which may result in you no longer being able to use the Services. We will notify you if this is the case at the time.
Automated decision-making
Automated decision-making takes place when an electronic system uses your personal data to make a decision without human intervention.
If we make an automated decision on you (and using your health data), we will obtain your explicit written consent and we will put measures in place to safeguard your rights. Automated decision-making is used on our App and WebApp to ensure we generate appropriate responses to any Recovery Data you submit (for example, if it appears that your symptoms have got worse, we may recommend that you contact your GP).
Changes to our privacy policy
Any changes we make to our privacy policy in the future will be posted on this page, and where appropriate, notified to you by email or notifications via the App or our Partner’s app (as applicable). We therefore encourage you to review it from time to time to stay informed of how we are processing your personal data.
Cookies
A cookie is a small file of letters and numbers that we or third parties may store on your browser or device. We use them to identify and distinguish you from other users of our services, which helps to provide you with a better experience.
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly.
Website
Our services are made available to individual users via the getUBetter mobile apps and webapp applications. This Privacy Policy reflects our responsibility to individual users in these applications. Our website, which has a marketing, thought leadership and information share purpose, is hosted and managed in a different environment. How we collect and use this data is described in an additional sub privacy policy found via this link.
Complaints
We encourage you to contact us first if you have any queries, comments or concerns about the way we handle your data (our details are in the section immediately below). We will try to put things right.
However, if you are not satisfied with our handling of any request by you in relation to your rights or concerns, you also have the right to make a complaint to a data protection supervisory authority, which, if you are based in:
Contact
We are committed to continually developing and promoting our compliance with the UK GDPR and data protection standards. You are welcome to contact us at contact@getUBetter.com if you have any questions, comments and requests regarding this privacy policy. For the purpose of the relevant data protection legislation, our data protection officer is Carey McClellan.
When contacting us we strongly recommend you don't email us confidential or personal data (unless otherwise requested by us, for example, where you’re exercising one of your data subject rights and we need to verify your identity).