Patient Privacy Notice

Platform — patient-facing (template for tenant adoption)

About this notice — a co-brandable template. Your treating clinic or pharmacy is the controller of your clinical records; Cannexis Biopharma Ltd runs the ClinicalFlow platform as the clinic's processor, on its instructions. This notice is a template each clinic adopts and may add to; your clinic completes the clinic-name fields (shown in [square brackets]) before issuing it to you.

This notice explains, in plain language, how your information is used when your clinic or pharmacy uses the ClinicalFlow platform to care for you. Your care is provided by [your clinic or pharmacy name] (“your clinic”), who decides how your records are used. ClinicalFlow is the secure technology your clinic uses to do this; it is run by Cannexis Biopharma Ltd, a technology company — not a clinic.

What information we hold

• Who you are — your name, date of birth, address, contact details and NHS number;
• Your health — your medical history, conditions, allergies, medicines, and notes from your consultations;
• Your treatment — shared-care agreements, prescriptions and dispensing records;
• Payments — references and amounts (we do not hold your full card details).

Why we use it

We use your information to provide your care safely. The law lets health and care providers use sensitive health information for this purpose (UK GDPR Article 9(2)(h) — providing health and social care). Some uses are required by law, such as keeping controlled-drug records and keeping your records for a set time.

Do you have to provide this information?

To treat you safely and lawfully, your clinic needs certain information — who you are, your relevant medical history, and the details the law requires for prescribing and for controlled-drug records. Some of this is a legal requirement (for example controlled-drug records); other information is needed under the terms of your care. If you choose not to provide it, your clinic may be unable to assess your eligibility, prescribe for you, or continue your treatment.

NHS information

We are building secure connections to NHS services, which we add in stages. They are not all available yet. When NHS login goes live you will be able to sign in with it so we can check your NHS number. In a later stage, and only if you give explicit consent, your prescriber will be able to bring in relevant NHS records (such as your medicines and allergies) to care for you safely. You can always say no, and you can change your mind later. We will tell you here as each NHS connection becomes available. When it is live, this NHS information comes from the NHS — your verified details from the NHS Personal Demographics Service, and (only with your consent) records from NHS systems such as your GP record / Summary Care Record.

Automated safety checks

The platform runs automated checks that help your clinicians prescribe safely within agreed limits. These support your clinicians — they do not replace them, and a person always makes the decisions about your care. If an automated check affects your care, you can ask for a human to review it.

Who sees your information

Your clinical team see what they need to care for you. We also share information where needed with: your dispensing pharmacy; NHS services (with your consent); and our trusted technology suppliers who help run the platform securely (for example our UK hosting provider). They act under contract and only on instructions. We never sell your data.

Where your information is processed. Your records are stored in the UK. A few of our technology suppliers are based in the USA and process limited information there — the secure video service that runs your video consultations (which involves clinical content), and our text-message and email providers (contact details and reminders, with no clinical detail). These transfers are protected by recognised UK safeguards (the UK-US Data Bridge, or the UK International Data Transfer Agreement supported by a risk assessment).

How long we keep it

We keep clinical records for as long as the law requires. For adults this is generally 8 years after your treatment ends (NHS Records Management Code of Practice 2021). For children and young people, records are kept until their 25th birthday (or 26th if treatment ended at 17).

Your rights

You can ask to see your data, correct it, or have it erased (where the law allows), restrict or object to its use, and get a copy in a reusable format. Because health records must be kept by law, a request to delete clinical records may be refused while we are still required to keep them — and we will explain why. Where data can be erased, your clinic directs it and we securely delete it. While the law still requires your records to be kept, they remain available to your clinic — we do not make them unreadable during that time. When a clinic stops using the platform, your records are first returned to the clinic before our copy is permanently destroyed.

How to ask

Use the “Request my data” tools in the platform, speak to your clinic, or contact our Data Protection Officer (below). We respond within one month. Requests are normally free.

Keeping your information safe

Your data is encrypted, stored in the UK, access is strictly limited to those who need it, and every time someone opens your record it is logged. We work to recognised standards including Cyber Essentials and the NHS Data Security and Protection Toolkit.

Contacts

• Your clinic (controller of your records): [your clinic's name and contact details]
• Cannexis Data Protection Officer: LHI Consulting — info@lhiconsult.com

To raise a concern, you can use our Data Protection Complaints Procedure. You can also complain to the Information Commissioner's Office (ICO) at any time: ico.org.uk · 0303 123 1113.