Introduction
Welcome to GoWello's Privacy Policy. GoWello is committed to protecting your privacy and to processing personal data lawfully, fairly, and transparently.
This Privacy Policy explains how GoWello collects, uses, shares, retains, and protects personal data when you visit our website, register on the GoWello platform, use our services as a patient, clinician, prescriber, or clinic, or otherwise interact with us. It also explains your rights under the UK General Data Protection Regulation and the Data Protection Act 2018.
GoWello is a trading name of Excelsior Health Ltd, a company registered in England and Wales (Company Registration No. 10257312), with registered office at Unit 4, 40-40 Link, 30-34 Mill End Road, High Wycombe, HP12 4AX, United Kingdom (collectively, "GoWello", "we", "us", "our").
1. Important information and who we are
Purpose of this Privacy Policy
This Privacy Policy describes how GoWello handles your personal data. It applies to:
-
Patients who register on the GoWello platform
-
Clinicians, prescribers, and clinic staff who use the GoWello platform
-
Clinic owners and operators who contract with GoWello
-
Visitors to the GoWello website
-
Anyone whose information is publicly listed in third-party clinical directories and is referenced on or imported into the GoWello platform, including clinicians whose profiles GoWello may pre-populate from public sources such as the Private Healthcare Information Network (PHIN) or the relevant clinical regulator's public register
Our role under UK GDPR
GoWello operates in two distinct capacities depending on the activity:
Data Controller: GoWello is the Data Controller for personal data we collect about visitors to our website, account holders, marketing contacts, and clinicians whose profiles we pre-populate from public sources. We are also the Data Controller for usage telemetry, audit logs, billing data, and other platform-level data.
Data Processor: Where a clinic or clinician uses GoWello to host or process clinical patient records, the clinic or clinician is the Data Controller for that clinical data and GoWello acts as a Data Processor under Article 28 UK GDPR. Where a clinic uses an external electronic medical record system such as Semble and pushes only a prescription and the minimum necessary patient data to GoWello for prescription transmission, GoWello acts as a Processor for that limited dataset.
This dual role is set out in more detail in Section 4.
Contact details
GoWello (a trading name of Excelsior Health Ltd), Unit 4, 40-40 Link, 30-34 Mill End Road, High Wycombe, HP12 4AX, United Kingdom.
Email: info@gowello.co.uk
Data Protection Officer: Rosemary Fallows, contactable at info@gowello.co.uk.
You have the right at any time to make a complaint to the Information Commissioner's Office at www.ico.org.uk. We would welcome the opportunity to address your concerns first.
Changes to this Privacy Policy
We may change this Privacy Policy from time to time. The version date at the foot of this document indicates when it was last updated. We will notify registered users of any material changes by email or by a prominent notice on the GoWello platform before those changes take effect.
2. The data we collect
Categories of personal data
We collect, use, store, and transfer the following categories of personal data, depending on your relationship with us:
| Category | Examples |
|---|---|
| Identity Data | First name, last name, title, date of birth, gender, photograph, professional registration number where applicable (GMC, GPhC, NMC, GDC). |
| Contact Data | Postal address, email address, telephone numbers, delivery address. |
| Account Data | Username, password (stored as a salted hash, never in plain text), account preferences, security questions, multi-factor authentication tokens. |
| Clinical Data | Patient health information including medical (Special Category) history, allergies, medications, consultation notes, diagnoses, prescriptions, pathology and imaging results, and any other clinical record uploaded to or generated within GoWello. |
| Prescription Data | Drug name, strength, form, quantity, dose, frequency, route, indication, electronic signature, paper script reference where applicable, dispensing and delivery status. |
| Transaction Data | Payments to and from clinics and patients, billing records, fee schedules, invoices. |
| Technical Data | IP address, login data, browser type and version, operating system, device identifiers, time-zone setting, location, and other technology on the device used to access GoWello. |
| Usage Data | Information about how you use the website and platform, including pages visited, features used, click patterns, and session duration. |
| Marketing and Communications Data | Preferences in receiving marketing from us and from third parties, communication preferences, opt-in and opt-out history. |
Special Category Data
Clinical Data is treated as Special Category Data under Article 9 UK GDPR. We process Special Category Data only on the lawful bases set out in Section 4, which include the provision of health and social care under Article 9(2)(h) UK GDPR, and explicit consent under Article 9(2)(a) UK GDPR where applicable.
If you fail to provide personal data
Where we are required to collect personal data by law, by contract, or in order to deliver a clinical service, and you do not provide it, we may not be able to provide the service. If that is the case we will tell you at the time.
3. How we collect personal data
-
Direct interactions. You provide personal data when you fill in forms on our website or in the GoWello platform, register an account, book a consultation, request a prescription, contact us by post, email, or telephone, or provide feedback.
-
Automated technologies. When you interact with our website or platform we collect Technical Data and Usage Data using cookies, server logs, and similar technologies. Please see our Cookie Policy for details.
-
Third parties and public sources. We may receive personal data about clinicians and clinics from third parties and public sources, including the Private Healthcare Information Network (PHIN), the General Medical Council and other professional regulator public registers, Companies House, clinic websites, and analytics providers such as Google.
-
From clinics and clinicians. When a clinic onboards onto GoWello, the clinic may provide us with the personal data of its patients, prescribers, and staff in order to enable use of the platform. In those circumstances the clinic is the Data Controller and is responsible for ensuring it has the lawful basis and the necessary notices in place before transferring that data to GoWello.
4. How we use personal data and our lawful bases
We use personal data only when the law allows us to. The most common lawful bases we rely on are:
-
Performance of contract: where we need to perform a contract with you or take steps to enter into a contract.
-
Legitimate interests: where it is necessary for our legitimate interests, including running the business, providing the platform, and growing the business, and provided your interests and fundamental rights do not override those interests.
-
Legal obligation: where we need to comply with a legal or regulatory obligation.
-
Consent: where you have given us specific, informed, freely-given consent, for example to receive marketing communications.
-
Provision of health and social care (Article 9(2)(h)): where processing Special Category Data is necessary for the management of health or social care systems and services, on the basis of UK domestic law and subject to the conditions in Schedule 1 of the Data Protection Act 2018.
-
Substantial public interest, including the safeguarding of children and vulnerable adults (Article 9(2)(g)): where relevant.
Purposes for which we use personal data
| Purpose | Categories | Lawful basis |
|---|---|---|
| Register and manage your GoWello account | Identity, Contact, Account | Performance of contract |
| Enable clinical consultations and clinical record keeping | Identity, Contact, Clinical, Special Category | Performance of contract; provision of health and social care (acting as Processor for the clinic) |
| Generate and transmit prescriptions and forward to Pharmazon HomeCare | Identity, Contact, Clinical, Prescription, Special Category | Performance of contract; provision of health and social care |
| Process payments and manage billing | Identity, Contact, Transaction | Performance of contract; legal obligation (tax) |
| Communicate operationally about your account or a transaction | Identity, Contact, Account | Performance of contract; legitimate interest |
| Provide technical support | Identity, Contact, Account, Technical | Performance of contract; legitimate interest |
| Maintain audit logs for clinical and security purposes | Account, Usage, Technical, Clinical metadata | Legal obligation; legitimate interest |
| Detect and prevent fraud, misuse, and unlawful access | Identity, Contact, Technical, Usage | Legitimate interest; legal obligation |
| Pre-populate clinician profiles from public sources | Identity, Contact, Professional (industry directory and registration onboarding) | Legitimate interest |
| Send service updates | Identity, Contact | Legitimate interest |
| Send marketing where you have opted in | Identity, Contact, Marketing | Consent |
| Analyse usage and improve the platform | Technical, Usage | Legitimate interest |
Marketing
We will only send you marketing communications where you have opted in to receive them. You can withdraw consent at any time by using the unsubscribe link in any marketing email, by changing your account preferences, or by contacting us at info@gowello.co.uk.
We will not share your personal data with third parties for their own marketing purposes without your explicit opt-in consent.
Change of purpose
We will use your personal data only for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will tell you and we will explain the lawful basis that allows us to do so.
5. Sharing your personal data
We share personal data with the following categories of recipient, subject always to the safeguards set out in this Privacy Policy:
-
Pharmazon HomeCare: see the dedicated section below.
-
The clinic, clinician, or prescriber treating you: we transmit clinical data within the platform between you and the clinical professional providing your care.
-
Our Sub-processors: technology vendors who process personal data on our instructions, including hosting providers, EMR integration partners, payment processors, video consultation providers, messaging providers, and analytics providers. We require all Sub-processors to enter into a written data processing agreement compliant with Article 28 UK GDPR. A current list of our Sub-processors is available at [URL TO BE INSERTED].
-
Professional advisers: lawyers, accountants, auditors, insurers, and consultants where necessary for the management of our business.
-
Regulators and authorities: the Information Commissioner's Office, the General Pharmaceutical Council, the Care Quality Commission, the Medicines and Healthcare products Regulatory Agency, HM Revenue and Customs, courts, the police, and other regulators or authorities where we are legally required to do so or where it is necessary for the protection of vital interests.
-
Corporate transactions: if we discuss selling or transferring all or part of our business, we may share personal data with prospective buyers under suitable confidentiality terms.
Pharmazon HomeCare: the dispensing pharmacy
Where a prescription is generated through GoWello, or is shared with GoWello from a clinician's external electronic medical record, that prescription is transmitted to Pharmazon HomeCare for clinical screening, dispensing, and delivery.
Pharmazon HomeCare is a separate Data Controller in respect of your prescription, dispensing, and delivery information from the point at which Pharmazon HomeCare receives the prescription. GoWello and Pharmazon HomeCare are not Joint Controllers, and Pharmazon HomeCare does not act as a Data Processor for GoWello.
Pharmazon HomeCare is registered with the General Pharmaceutical Council (GPhC). It operates under its own Privacy Notice, Terms of Service, clinical governance framework, and Standard Operating Procedures, which you can review at www.pharmazonhomecare.com.
GoWello does not store, dispense, or deliver any medication. GoWello is a software platform that supports the clinical workflow between you, your clinician, and Pharmazon HomeCare.
6. International transfers
We store personal data on servers located in the United Kingdom by default. Some of our Sub-processors may process data outside the United Kingdom. Where personal data is transferred outside the United Kingdom, we ensure an equivalent level of protection by relying on one of the safeguards listed in Article 46 UK GDPR, including:
-
Transfers to countries the United Kingdom has determined to provide an adequate level of protection
-
The International Data Transfer Agreement issued by the Information Commissioner's Office (or the UK Addendum to the EU Standard Contractual Clauses), in force from 21 March 2022
-
Other appropriate safeguards approved under UK law
Please contact us at info@gowello.co.uk for further information about the specific mechanism used for any particular transfer.
7. Data security
We have implemented appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, or damage. These measures include:
-
Encryption of data in transit using TLS
-
Encryption of clinical data at rest
-
Role-based access controls and the principle of least privilege
-
Multi-factor authentication for staff and prescribers
-
Audit logging of access to clinical records
-
Vulnerability scanning, penetration testing, and patch management
-
Confidentiality obligations on all staff and contractors
-
Regular staff training in information governance and information security
-
A documented incident response process aligned to the requirements of the UK GDPR and the NHS Data Security and Protection Toolkit
We notify the Information Commissioner's Office of any personal data breach within 72 hours of becoming aware of it where we are legally required to do so, and we notify affected data subjects where the breach is likely to result in a high risk to their rights and freedoms.
8. Data retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.
In determining the appropriate retention period we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether those purposes can be achieved through other means, and applicable legal requirements.
Indicative retention periods
| Data category | Retention period |
|---|---|
| Clinical patient record (where GoWello is Processor) | Retained for the duration of the contract with the Clinic. On termination, returned to the Clinic in a structured machine-readable format and then deleted in accordance with the Clinic's documented instructions. |
| Prescription records held as Controller for audit purposes | At least 2 years from date of supply (medicines law minimum). |
| Prescriber and clinician records | At least 8 years from the date of last entry, in line with NHS records management code of practice (private healthcare typically follows this benchmark). |
| Adult patient account data | 7 years after account closure. |
| Transaction and tax records | 6 years from the end of the relevant tax year. |
| Marketing consent and contact history | Until consent is withdrawn, or 3 years from last contact. |
| Website usage and cookie data | As set out in the Cookie Policy, typically up to 24 months. |
| Identity and verification documents | 12 months after onboarding, unless required for longer to defend against a legal claim. |
9. Your legal rights
Under UK data protection law you have the following rights in relation to your personal data, subject to certain exemptions:
-
Right to be informed: to be told how we process your personal data, which is the purpose of this Privacy Policy.
-
Right of access: to obtain a copy of the personal data we hold about you.
-
Right to rectification: to have inaccurate or incomplete personal data corrected.
-
Right to erasure: to have your personal data deleted in certain circumstances. This right does not generally apply to clinical records where we are required to retain them by law or where the clinic that is the Data Controller is required to retain them.
-
Right to restrict processing: to ask us to suspend processing in certain circumstances.
-
Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
-
Right to object: to object to processing based on legitimate interests, including direct marketing.
-
Right not to be subject to automated individual decision-making: including profiling, that has a legal or similarly significant effect on you.
-
Right to withdraw consent: at any time, where we rely on consent as the lawful basis for processing.
To exercise any of these rights, please contact us at info@gowello.co.uk. We will respond within one calendar month. If your request is complex, we may extend this period by a further two months, in which case we will tell you within the first month.
Where the personal data in question is held by GoWello as a Data Processor on behalf of a Clinic or Clinician acting as the Data Controller, we will pass your request to the Controller and support them in responding to you.
10. Cookies
We use cookies and similar technologies on our website. Please see our Cookie Policy for details.
Contacting us
Postal address: GoWello, c/o Excelsior Health Ltd, Unit 4, 40-40 Link, 30-34 Mill End Road, High Wycombe, HP12 4AX, United Kingdom.
Email: info@gowello.co.uk
Data Protection Officer: Rosemary Fallows, contactable at info@gowello.co.uk.
Complaints
If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner's Office at www.ico.org.uk. We would prefer the opportunity to address your concerns first, so please contact us before approaching the ICO.