UK GDPR & Your Data Rights

Plain-language data-rights notice

This notice explains, in plain language, the rights you have over your personal data and exactly how to use them — including how to ask us to remove your data. It sits alongside our full Privacy & Data Protection Policy.

Your rights at a glance

Important: removing health records is not always possible

⚠️ The law requires health and prescribing records to be kept for set periods (NHS records-management rules and controlled-drug law). So if you ask us to erase clinical data while we are still legally required to keep it, we may have to refuse that part of your request — and we will write to you explaining which data, and why.

When data can be erased, your clinic (as the controller of your records) directs it and we securely delete it. While the law still requires records to be kept, they remain available to your clinic to be produced — we do not make them unreadable during the retention period. When a clinic stops using the platform, its records are first returned to the clinic (so it can keep meeting its legal retention duty); only then is our residual copy permanently destroyed by “crypto-shredding” (destroying the encryption key that protects it).

How to make a request — step by step

1. Choose your route. If you are a patient, the quickest way is the “Request my data” tools in the ClinicalFlow platform. You can also contact our Data Protection Officer directly (details below). For your clinical records, your treating clinic or pharmacy is the data controller, and we will work with them to handle your request.
2. Tell us what you want. Say which right you are using (for example access or erasure) and which data it concerns (clinical, billing, communications, or all of it).
3. Confirm your identity. To protect your data, we verify who you are before we act. For routine access requests this is usually your secure login plus an ID check. For erasure requests, which cannot be undone, we apply an additional check — which may include a short video identity check with our DPO.
4. We process it. We acknowledge your request, give it a reference, and respond within one calendar month. For complex or multiple requests we may extend this by up to two further months, and we will tell you if so.
5. You receive a response. For access requests, we provide your data in a clear, downloadable form via a secure link. For erasure, we tell you what we have erased and what (if anything) we must keep, with the reason.

What it costs

Requests are normally free. We may charge a reasonable fee, or decline, only if a request is manifestly unfounded or excessive (for example, repetitive) — and we will explain if that applies.

Who to contact

Data Protection Officer: LHI Consulting — info@lhiconsult.com · c/o Cannexis Biopharma Ltd, 142-143 Parrock Street, Gravesend, Kent, DA12 1EY.

If you are a patient, you can also raise a request with your treating clinic or pharmacy, who hold your clinical records as the controller.

If you are unhappy with our response

Please tell us first so we can put it right — you can use our Data Protection Complaints Procedure, and we will acknowledge your complaint within 30 days. You also have the right to complain to the Information Commissioner's Office (ICO) at any time: ico.org.uk · helpline 0303 123 1113.