Introduction

At a Glance

Detail

1. Health and Care Professionals

2. Patients (Direct Contact Only)

3. Prospective Buyers and NHS Commissioners

4. User and Market Research Participants

5. Job Applicants and Sourced Talent

6. Medical Device Safety and Regulatory Monitoring

7. Use of Artificial Intelligence

Policies

‍Retention, sharing, transfers and your rights

Privacy Notice

Who are we?

We are Accurx. We provide software to enable health and social care teams to communicate with each other and with patients.

Your trust in our data security and privacy is at the heart of what we do. This Privacy Notice explains when and how we collect and use your personal data when acting as a Data Controller (meaning we decide how and why your data is processed).

This Privacy Notice covers Accurx acting as a Data Controller for

Health & care professionals using our platform
NHS commissioners & prospective buyers
Patients who contact us directly
User & market research participants
Job applicants & sourced talent
Medical device safety monitoring

Data Controller

Accurx Limited, 7 Curtain Road, London EC2A 3LT |Company no. 10184077

Data Protection Officer (“DPO”)

dpo@accurx.com

General enquiries

support@accurx.com

ICO registration

ZA202115 (click here for more details)

Last Updated

29 July 2026

Important Note for Patients:

If a GP practice, hospital, or pharmacy uses Accurx to text or message you, they are the Data Controller. In those cases, we act as a Data Processor under their strict instructions, and this notice does not apply. You can read how we handle patient data on behalf of the NHS here.

At a glance

How we use your data

Find your role in the table for the key facts. See section 2 below for full detail about how we use your data. We may collect metadata as well as the categories of data listed below and in this Privacy Notice.

Who you are	Key data we collect	Why we use it (and lawful basis)	How long we keep it
Health and care professionals	Name, email, role, organisation, phone number, usage events	To provide and improve our platform (Legitimate Interests)	Account lifetime - see Retention
Patients	Name, email, phone number, query content, usage events	To handle your query and improve our platform (Legitimate Interests)	Up to 24 months
Prospective buyers & NHS Commissioners	Name, email, communications	Procurement discussions (Legitimate Interests)	Up to 48 months
User & market research participants	Name, age, email, research responses	Product improvement (Legitimate Interests or Consent)	Up to 48 months
Job applicants & sourced talent	Name, email, CV, notes, assessments, correspondence	Recruitment (Legitimate Interests and Legal Obligation)	Up to 24 months

Who you are	Key data we collect	Why we use it (and lawful basis)	How long we keep it
Health and care professionals	Name, email, role, organisation, phone number, usage events	To provide and improve our platform (Legitimate Interests)	Account lifetime plus [X] months

Who you are	Key data we collect	Why we use it (and lawful basis)	How long we keep it
Patients (direct contact only)	Name, email, phone number, query content	To handle your query (Legitimate Interests)	Up to 24 months

Who you are	Key data we collect	Why we use it (and lawful basis)	How long we keep it
Prospective buyers & NHS Commissioners	Name, email, communications	Procurement discussions (Legitimate Interests)	Up to 48 months

Who you are	Key data we collect	Why we use it (and lawful basis)	How long we keep it
User & market research participants	Name, age, email, research responses	Product improvement (Legitimate Interests or Consent)	Up to 48 months

Who you are	Key data we collect	Why we use it (and lawful basis)	How long we keep it
Job applicants & sourced talent	Name, email, CV, notes, assessments, correspondence	Recruitment (Legitimate Interests and Legal Obligation)	Up to 24 months

How we use your data

Choose the category below that applies to you to see what data we collect, why, and our legal justification under UK GDPR. We may collect metadata as well as the categories of data listed below and in this Privacy Notice.

1. Health and care professionals

If you work at a GP practice, hospital, pharmacy or other healthcare organisation and use Accurx, we collect data in three contexts: account registration, platform use, and direct contact.

Purpose	Data we use	Lawful basis	Further detail
Health and care professionals	Full name Email address Professional role Organisation Telephone number IP address at registration Authentication credentials Metadata	Legitimate Interests To run our platform effectively and maintain audit trails required by NHS Information Governance	Credentials are stored so they authenticate you without revealing your original password.
Communications about product updates, services and events	Full name Email address	Legitimate Interests To update you on products, events, and features.	You can opt out at any time by emailing support@accurx.com

Purpose	Data we use	Lawful basis	Further detail
Managing billing	Full name Email address Contact details Professional role Organisation Usage events Account data	Legitimate Interests To ensure appropriate and accurate invoicing for the use of our platform
Platform improvement and analytics (reporting, forecasting, planning)	Platform usage metrics (such as pages viewed, buttons clicked, features used) Cookies and similar technologies	Legitimate Interests To improve performance and functionality and to develop new features Consent Any underlying data collection via non-essential cookies relies on your consent.	See our Cookie Policy for full details of the cookies we use.
Detecting and correcting faults and errors	Platform usage metrics (such as pages viewed, buttons clicked, features used) Cookies and similar technologies Error Logs	Legitimate Interests To detect faults, and maintain and improve our functionality and service reliability
Preventing and investigating misuse or security incidents	Platform usage metrics (such as pages viewed, buttons clicked, features used) Account data IP address	Legitimate Interests Platform security and compliance with our Terms & Conditions and Acceptable Use Policy
NHS Information Governance audit trail compliance	Platform usage metrics (such as pages viewed, buttons clicked, features used) Account data	Legitimate Interests Compliance with NHS IG standards	Some of this processing is carried out on behalf of your employing healthcare organisation under a Data Processing Agreement. See that agreement for full details.
Sharing anonymised usage statistics with NHS bodies (such as NHS England and ICBs)	Anonymised, aggregated usage metrics	Legitimate Interests On behalf of and as requested by your healthcare organisation or regulatory bodies	Governed by the Data Processing Agreement between Accurx and your employer. Individual data is not shared — only anonymised statistics. See that agreement for full details.

Purpose	Data we use	Lawful basis	Further detail
Handling your support query, complaint or feedback	Full Name Email address Telephone number Social media handles Content of your message	Legitimate Interests Responding to queries efficiently
Marketing & Feedback	Full name Email address Professional role Organisation Telephone number Metadata Usage Metrics	Legitimate Interests To update you on products, events, and features.	You can opt out at any time by emailing support@accurx.com

2. Patients

This section only covers data Accurx controls directly, for example when you contact us yourself (e.g. our support team or use our website chat directly) or platform usage metrics. Where Accurx processes patient data under instructions from your healthcare organisation (such as a GP practice, hospital or pharmacy), we act as a Data Processor under their strict instructions, and this notice does not apply to that processing. You can read how we handle patient data on behalf of the NHS here.

NHS Login:

Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS England. NHS England is the controller for any personal information you provided to NHS England to get an NHS login account and verify your identity, and uses that personal information solely for that single purpose. For this personal information, our role is a “Processor” only and we must act under the instructions provided by NHS England (as the “controller”) when verifying your identity. To see NHS England's Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.

Purpose	Data we use	Lawful basis	Further detail
Handling your support query, complaint or feedback	Full name Email address Telephone number Message content	Legitimate Interests To resolve your technical support queries quickly and efficiently
Improving our services via anonymisation and pseudonymisation	Anonymised or pseudonymised data that cannot identify you	Legitimate Interests To improve performance and functionality and to develop new features Not applicable for anonymised data as it falls outside UK GDPR	We may carefully anonymise or pseudonymise your personal data so that it can no longer be associated with you, and use this to improve our services. Where we anonymise your data we may use this indefinitely without notifying you.

Purpose	Data we use	Lawful basis	Further detail
Improving our services via anonymisation and pseudonymisation	Anonymised or pseudonymised data that cannot identify you	Legitimate Interests To improve performance and functionality and to develop new features Not applicable for - anonymised data as it falls outside UK GDPR	We may carefully anonymise or pseudonymise your personal data so that it can no longer be associated with you, and use this to improve our services. Where we anonymise your data we may use this indefinitely without notifying you.
Platform improvement and analytics (reporting, forecasting, planning)	Platform usage metrics (such as pages viewed, buttons clicked, features used) Cookies and similar technologies	Legitimate Interests To improve performance and functionality and to develop new features Consent Any underlying data collection via non-essential cookies relies on your consent.	See our Cookie Policy for full details of the cookies we use.

3. Prospective buyers & NHS Commissioners

If you are involved in commissioning or procuring software for a healthcare organisation, we process your data as follows.

Purpose	Data we use	Lawful basis	Further detail
Procurement and sales discussions	Full name Email address Contact Information Communication history Metadata	Legitimate Interests To manage corporate business relationships and discuss software procurement

4. User & market research participants

We conduct research with healthcare professionals and patients to improve existing products and inform development of new ones. When you volunteer to help us test or design new features, we process your data as follows.

Purpose	Data we use	Lawful basis	Further detail
Conducting user and market research	Full name Age Email address Survey / interview responses	Legitimate Interests or Consent To ensure our products meet clinical needs and to optimise our software	If we rely on your explicit Consent, we will request it before the research begins
Improving our services via anonymisation	Anonymised data that cannot identify you	Not applicable - anonymised data falls outside UK GDPR	We may carefully anonymise your personal data so that it can no longer be associated with you, and use this to improve our services. Where we anonymise your data we may use this indefinitely without notifying you.

5. Job applicants & sourced talent

If you apply for a role at Accurx, sign up for job alerts or events, or are identified by our team as a potential candidate, we process your data as follows.

Purpose	Data we use	Lawful basis	Further detail
Reviewing application and interview process	Full name Email address Telephone number CV Employment history Interview notes to assess your candidacy Staff/referee feedback	Legitimate Interests To find talent and steps to enter an employment contract Legal Obligation To check your right to work

Purpose	Data we use	Lawful basis	Further detail
Alerts and marketing consent	Full name Email address Role preferences	Consent If you sign up to be notified of future jobs or events, we send these updates based entirely on your consent	Consent can be withdrawn at any time

Purpose	Data we use	Lawful basis	Further detail
Contacting you about roles that suit your profile	Full name Social media profile URL (e.g. LinkedIn)	Legitimate Interests To find talent suitable for open roles	We may save your name and profile URL. We hold this to check for a potential match unless you engage with us to join our long-term talent pool.

6. Medical Device safety and regulatory monitoring

When you use our services, your healthcare provider (e.g., your NHS GP practice or hospital) is the primary organisation responsible for your personal data. Where Accurx software is registered as an official medical device, the law strictly requires us as the manufacturer to constantly monitor the software’s clinical safety and accuracy. This is known as "Post-Market Surveillance". To meet these legal safety standards, we occasionally review limited, sampled extracts of clinical logs and triage data to ensure the software is making safe, accurate assessments. For this specific and limited safety purpose, we act as an independent Data Controller and process your data as follows.

Purpose	Data we use	Lawful basis	Further detail
Monitoring clinical safety and accuracy of medical devices	Full name Address Email address Telephone number Demographic details (including name, date of birth, gender) NHS number Health data (such as recordings, transcripts, images, documents, online consultation submissions)	Legal Obligation For this processing of Personal Data we are required to comply with medical device safety laws. Public Interest For processing Special Category (Health) Data we do this in the area of public health, ensuring high standards of quality and safety of healthcare and medical devices.	To protect your data we minimise the data used for safety reviews as much as possible, applying pseudonymisation (removing direct identifiers like names or NHS numbers) wherever feasible. This data is strictly restricted to our clinical safety and regulatory teams and is never used for marketing or general commercial profiling.

7. Use of Artificial Intelligence

We use automated tools, including artificial intelligence (“AI”), to support the delivery, improvement, and security of our services. These tools act as assistants to our human teams; we do not use AI to make solely automated decisions that have a legal or significant effect on you. When using AI we process your data as follows.

Purpose	Data we use	Lawful basis	Further detail
Product Improvement & Analytics	Anonymised usage trends	Legitimate Interests To analyse anonymised usage trends and optimise our software's user interface
Customer Support	Query content (anonymised where possible)	Legitimate Interests To help our support teams summarise technical queries and draft responses faster
Recruitment Support	Application materials and candidate information	Legitimate Interests To assist our hiring team in sorting or summarising application materials.	All shortlisting and hiring decisions are made entirely by human recruiters.
Commercial Insights (Sales Calls)	Call transcript data (pseudonymised)	Legitimate Interests To analyse sales and onboarding call transcripts for training and commercial insights. We will always notify participants at the start of a call if an AI transcription tool is present, and you have the right to request that it be turned off
Security & Fraud Detection	Platform activity logs IP addresses	Legitimate Interests To monitor platform activity, detect malicious behavior, and protect user data

Our commitments to AI safety and privacy:

Human oversight: AI tools operate under strict human supervision. Humans remain accountable for our services, hiring, and business decisions.
Data minimisation & aggregation: Where AI tools analyse commercial trends or transcripts, we use aggregated or heavily pseudonymised data wherever possible. We strip out unnecessary identifying details before data is processed by AI.
No third-party model training: We do not allow our third-party AI service providers to use your personal data to train or improve their public, foundational AI models.
Security & vendor control: Any third-party AI vendor we use is bound by strict UK GDPR-compliant data processing agreements. If data is transferred outside the UK for AI processing, it is protected by approved international transfer mechanisms.

Retention, sharing, transfers and your rights)

You can expand each section below to read full details about how long we retain your data, who we may share it with, our controls for any international transfers of your data, cookies, and your rights and how to raise a complaint.

How long we keep information we collect about you depends on the type of information and how we collect and store it.

We retain data that you provide to us where we have an ongoing legitimate business need to do so (for example, as needed to comply with our legal obligations, resolve disputes and enforce our agreements).

When we have no ongoing legitimate business need to process your personal data, we securely delete the information or anonymise it or, if this is not possible, securely store your information and isolate it from any further processing until deletion is possible. We will delete this information at an earlier date if you request, as described in the Your Rights section below.

Data type	Retention period
Health and care professional (account data)	For as long as your organisation contracts with us, or until you delete your account
Health and care professional (direct support queries)	Up to 24 months after our last contact regarding that support query
Patients (platform usage metrics)	Up to 24 months after our last contact
Patients (direct support queries)	Up to 24 months after our last contact regarding that support query
Prospective buyers and NHS commissioners	Up to 48 months after the last contact with your organisation
Research participants	Up to 48 months after the project concludes (unless specified otherwise in your consent form)
Job applicants	Unsuccessful candidates: Up to 12 months after the hiring process ends (with your permission to keep your CV on file) Successful candidates: Up to 24 months after the hiring process ends (with your permission to keep your CV on file)
Medical device safety (post-market surveillance data)	In accordance with our legal requirements under medical device regulations

We never sell your data.

We only share your personal information when it is necessary, lawful, and proportionate to do so. We ensure any third parties who receive your information are bound by strict confidentiality and data protection obligations.

We may share personal data with the following categories of recipients:

Group	Parties your information may be shared with
Service providers and suppliers	We use carefully selected companies to help us provide, maintain, and improve our services. These include: IT hosting, cloud storage, and software providers; Communications platforms (for example, secure email, SMS, and video services); Customer support and helpdesk software. All such suppliers only act under our instructions and are not permitted to use your data for their own purposes. A current list of our sub-processors and service providers is available on our Sub-Processor Webpage.
Professional advisors and insurers	We may share data with our professional advisors - including lawyers, auditors, accountants, and insurers - when this is necessary to obtain professional advice, manage risk, or meet our legal and regulatory obligations.
Regulatory and public bodies	We may share information with regulators or public authorities (such as NHS England or the Information Commissioner’s Office), where we are legally required to do so.
Corporate transactions	If we undergo a reorganisation, merger, or sale of our business, we may share relevant personal data with prospective or actual buyers, investors, or professional advisors involved in the transaction. We will ensure appropriate confidentiality and data protection measures are in place before any such transfer.

Accurx Limited | 7 Curtain Road, London, England, EC2A 3LT | Company No: 10184077

Contents

Privacy Notice

Who are we?

Important Note for Patients:

At a glance

How we use your data

How we use your data

1. Health and care professionals

2. Patients

NHS Login:

3. Prospective buyers & NHS Commissioners

4. User & market research participants

5. Job applicants & sourced talent

6. Medical Device safety and regulatory monitoring

7. Use of Artificial Intelligence

Our commitments to AI safety and privacy:

Retention, sharing, transfers and your rights)