Data protection and security
How MedX Services Ltd handles personal information, keeps real patient data out of training, and what happens if something goes wrong.
Who is responsible for your data
MedX Services Ltd is the data controller for personal information collected through this website and our services. We are registered in England and Wales, company number 17369327, with our registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. For any data protection question, email info@medxservices.co.uk.
What we hold and why
| Information | Why we hold it | Lawful basis |
|---|---|---|
| Enquiry details: name, email, phone, message | To reply to your enquiry | Legitimate interests |
| Learner records: contact details, enrolment, attendance and progress | To deliver and administer training you have booked | Contract |
| Documents you send for career support, such as a CV or supporting statement | To provide the service you asked for | Contract |
| Simulator account details: name, email and activity within training scenarios | To give you access to the simulator and track your practice | Contract |
We do not need health information to provide our services, and we ask you not to send it. We collect only what each service needs.
Keeping real patient data out of training
MedX training is designed so that no real patient information is ever needed:
- Every patient, referral and pathway in our scenarios is fictional.
- Record identifiers are made up so they cannot be mistaken for real NHS numbers.
- The simulator has no connection to any NHS or other live patient system.
- Learners are told not to enter real patient information into any MedX environment. If it happens, we delete it as soon as we become aware of it.
Read more in our article Why MedX trains with synthetic patient data.
Who we share information with
We use a small number of service providers to run the business. They process information only on our instructions:
- Formspree processes messages sent through our enquiry form. Formspree is based in the United States, so form data may be processed there.
- WhatsApp (Meta) is used only if you choose to contact us that way. WhatsApp's own privacy terms apply to that service.
- Web, email and application hosting providers store this website, our email and the MedX Simulator.
Where information is processed outside the UK, we rely on the safeguards UK data protection law requires, such as the UK International Data Transfer Agreement or an adequacy decision.
How we protect information
- Our website and simulator are served over encrypted connections (HTTPS).
- Access to learner and client information is limited to MedX personnel who need it to deliver a service.
- We assessed the data protection risks of our training and simulation service before launch, through a data protection impact assessment, and we review it when the service changes.
- We keep information only for as long as we need it, and then delete or anonymise it.
If something goes wrong
If we discover a personal data breach, we will contain it, assess the risk and, where the law requires, report it to the Information Commissioner's Office within 72 hours. If a breach is likely to put you at high risk, we will tell you directly and explain what you can do.
Your rights and how to raise a concern
You can ask to see, correct or delete the information we hold about you, among other rights listed in our Privacy Policy. Email info@medxservices.co.uk and we will respond within one month. If you are unhappy with our response, you can complain to the Information Commissioner's Office at ico.org.uk.