We at Quincy respect your privacy and we commit to safeguarding your personal data.

This policy describes the information we collect or you share with us when you visit our website (quincy.health) (regardless of where you visit it from), access and use the Quincy Platform, use our Services or, in the case of patients, where your clinician uses our Services to manage your prescriptions. This policy explain, how your data is used, stored and safeguarded, and your choices regarding this information.

SCOPE

This policy outlines how we at QH Solutions Ltd collect and process your personal data through your use of our website (quincy.health), and through your use of Quincy Platform  or Quincy App), the Quincy App our products and services (collectively our “Services”).

In this Policy, we use a number of definitions:

• “Clinic”: means the medical practice using the Quincy Services to manage their patients’ prescriptions.

• “Registered Practitioner”: means doctors, physicians and any professional with a license to prescribed regulated medicines in the UK.

• “Admin”: refers to an employee of a Clinic who may manage the Clinic’s Quincy Account or who may input prescriptions into Quincy for approval by a Registered Practitioner.

Quincy provides software and solutions to enable registered medical practices and licensed pharmacies to manage their patients’ medical prescriptions and we do not provide medical advice, services or any dispensary services. All prescriptions managed via Quincy are fulfilled by the relevant pharmacy or licensed dispensary.

This privacy policy covers how we use information for different types of data subjects who interact with our service, namely:

• Admins: we collect and process personal information of account administrators and other individuals employed by Clinics who are our customers and who interact with Quincy, the Quincy Services and the Quincy Platform.

• Registered Practitioners: all Registered Practitioners must create an account with Quincy to issue prescriptions via the Quincy Platform. As part of this we collect and process personal information about you for the purposes of vetting your licensed status and for our own compliance purposes. We also collect information associated with your use of the Quincy Services in respect of Clinics that you have linked your account to.

• Patients: we collect and process personal information about patients whose medical prescriptions are managed via the Quincy Platform. In most cases we are not responsible for the decisions about this data (known as the data controller) but rather process this information on behalf of your Clinic and Registered Practitioner. In cases where you pay for your medical prescriptions directly via Quincy, we will collect and process personal information associated with your payment and transaction information as well as your delivery address.

• Website Visitors: we utilize cookies and similar technologies on our website for purposes set out in this Policy and our Cookie Policy and collect and process personal information about visitors to your website.

This policy does not apply to our workforce or other individuals who apply for a position at our company.

It is important that you read this privacy policy together with any other policy on data processing or other notices we may provide on specific occasions so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.

DATA CONTROLLER AND CONTACT DETAILS

QH Solutions Ltd is the data controller for the purposes of this privacy policy and is responsible for your personal data; all references to “we”, “use” or “our” refer to QH Solutions Ltd.

Our details are as follows:

71-75 Shelton Street,

Covent Garden,

London,

United Kingdom,

WC2H 9JQ

In respect of data about patient we are not the data controller and only act on the instructions of your Clinic and Registered Practitioner.

HOW TO CONTACT US ABOUT YOUR RIGHTS AND DATA

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us at team@quincy.health.

We are regulated by the Information Commissioner’s Office and you have the right to make a complaint at any time to them. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

THIRD-PARTY LINKS

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit, connect with, or are referred to.

INFORMATION COLLECTED ABOUT YOU

We have set out below the personal data about you we may collect, use, store and transfer when you interact with us through our Services. Personal data means any information from which you can identify you, it does not include information we collected on an anonymous basis.

• Identity & Contact Data: includes your title, first name, last name, date of birth, email address, home address, telephone number, whether you are a patient, Registered Practitioner or Admin, your associated Clinic and:

  • in the case of Doctors, including your photographic ID and your relevant professional number (e.g., GMC number), to verify you are registered and of good standing. We utilize third-party partner, Yoti, who will use facial recognition technology to authenticate your identification for such purposes.

• Medical & Prescription Data: as Clinic and Registered Practitioners use our Services to assist them in managing their patients’ medical prescriptions, naturally we receive various information about your medical situation and your prescriptions, including information about your prescription such as its unique ID number and the type, brand and quantity of medication, as well as any other information your Registered Practitioner may include on your prescriptions.

• Financial Data & Transaction Data: includes your payment card details, billing address, as well as details about payments to and from you and other details of any purchases you have made from us.

• Profile Data: includes your username and password, details of your Quincy account, information about the prescriptions and orders made by you, your profile and account preferences, and any information provided through direction interactions with us. In addition, if you are a Registered Practitioner, we also collect your GMC reference number or similar details from your responsible professional body, your field of specialism (e.g., pain, neurology, paediatrics etc.), details on any CQC checks against your clinic or GP practice, details of any patients you add to your account.

• Usage Data: includes information created about you through your use of our Services, such as unique identifiers, activity logs, and your interactions with us. 

• Technical Data: includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website or Services. 

• Marketing & Communications Data: includes your preferences in receiving marketing from us and our third parties, other interactions with us, such as feedback to surveys or with our technical support or customer services teams, as well as your communication preferences.

We also collect, use and share aggregated data about you. This includes statistical or demographic data, which could be derived from your personal data but is not considered personal data in its own right as this data on its own would not allow anyone to directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

Our Services do involve the collection of certain types of information which we treat particularly sensitively. We refer to this information as “Special Category Data” and it includes:

• information about your health, in particular your health Medical & Prescription Data; and,

• biometric data, in particular for Registered Practitioners we use facial recognition technology to verify your account.

We have implemented additional safeguards with regards to the collection, use and storage of this data.

INFORMATION PROCESSED WHERE WE ARE NOT THE CONTROLLER

How your data is collected

We use different methods to collect data from and about you including through:

Direct interactions. You may give us your Identity, Contact, Financial, Profile, Marketing and Communications Data by interacting with us through our website or Services, filling in forms or completing any registration process, or by corresponding with us. This includes personal data you provide when you:

• create an account in the Quincy Platform;

• subscribe to any of our mailing lists or request marketing to be sent to you;

• select your marketing and communications preferences;

• complete a survey; or

• give us feedback or contact us.

When using the Services. Through your use of our Services, and in particular the Quincy Platform, we will collect, process and store your Usage Data. Where your employer has registered has assigned you an account to use our Services through the Quincy Platform, we may also receive your Profile Data when you use the Service.

When your Clinic or Registered Practitioner shares it with us. If you are a patient and your Clinic or Registered Practitioner uses Quincy to manage prescriptions, we will receive your Medical & Prescription Data. Our platform will use this to create records of your prescriptions on behalf of your Clinic and Registered Practitioner.

Automated technologies or interactions. As you interact with both our website and Services, we automatically collect various information about you, such as the device you use when you interact with us, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.

Third parties or publicly available sources. We will receive personal data about you from various third parties as set out below:

• Identity & Contact Data from the following parties:

  • Get Address: we utilise the Get Address look-up tool to help you complete your address details. This tool works by cross referencing Ordnance Survey's complete list of UK postcodes with various other data sources.

  • GMC & CQC: for Registered Practitioners registering an account with us, we verify both your status, as well as that of your clinic or GP practice, with your responsible professional body (e.g.,, the General Medical Council) and Care Quality Commission, respectively.

• Technical Data from the following parties:

  • analytics providers such as Google Analytics;

  • advertising networks; and

  • search information providers.

• Contact, Financial and Transaction Data from providers of technical, payment and delivery services, such as our third-party payment processors, or social media platforms, such as LinkedIn, where you sign up to Quincy through referral from these platforms.

HOW WE USE YOUR INFORMATION

We collect, process, store and disclose personal data for a variety of different reasons, but in all cases when the law allows us to.

For the personal data identified in this policy where we act as the data controller, we rely on the following lawful basis to processing your data:

1. Consent: we use your consent as a legal basis for processing your personal data or for the purposes of marketing communications, in particular, where you register your interest with us through our website or otherwise (such as at a trade show or networking event). You have the right to withdraw consent at any time by contacting us, or by opting out through any marketing communication we may provide.

2. Contractual Obligations: where we need to perform the contract we are about to enter into or have entered into with your employer.

3. Regulatory or Legal Obligations: where we need to comply with a legal obligation.

4. Legitimate Interests: where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We rely on a wide range of legitimate interests as a business:

   1. for marketing activities (other than where we rely on your consent);

   2. to correspond or communicate with you;

   3. to verify the accuracy of data that we hold about you;

   4. to preserve the integrity of our network and information security and, in particular, for us to take steps to protect your information against loss or damage, theft or unauthorised access;

   5. for prevention of fraud and other criminal activities;

   6. to improve our website, products and Services, in particular through analysing how you interact with us through our website, products and Services to more generally improve your user experience;

   7. for the management of queries, complaints, or claims, including when complying with a request from you in connection with the exercise of your data protection rights;

   8. for the establishment and defence of our legal rights.

Where we act a data processor on behalf of our customers, we will predominantly rely on contractual obligations, legitimate interests and legal obligations as justification for processing your data.

SPECIAL CATEGORY DATA

For certain types of information identified in this policy as Special Category Data, we rely on the following lawful bases:

·        Medical & Prescription Data: for all health and medical related data provided to us by your Clinic or Registered Practitioner, we process this information as a data processor unless you pay for your subscriptions directly through Quincy and we are arrange in delivering them to you. This means that it is your Clinic or Registered Practitioner who determines the lawful reasons for processing this data but the will most likely be processing your personal information in order to supply a medical dispensary service to you (i.e., for the performance of a contract with you), and to deliver health care services to you (i.e., the provision of managed pain or therapeutic relief by fulfilling your prescription). Where we are arranging delivery of prescribed medication to you we rely on performance of a contract with you as the basis for processing your personal information.

·        Identity Data: in light of the sensitive nature of prescribing medication, we ensure our verification process for Registered Practitioners is as rigorous as it can be.  A key aspect of this process involves us using a third-party verification provider who uses facial recognition technology to scan your face against the ID you have submitted. When you scan your face using the verification tool, you will be asked to confirm that you provide your Explicit Consent to your use of your image for this specific purpose. Our verification process is there to ensure only licensed professionals are able to raise prescriptions through Quincy. However, if you are uncomfortable with providing consent to the use of our facial recognition technology, we can provide alternate means of verifying your identity.

Summary of how and why we use your information

We have summarised below the various ways we use your personal data and our legal basis for doing so.