Loading
Loading
At MediShout, we are committed to safeguarding the privacy and security of the personal information entrusted to us. This US Privacy Policy (“US Policy”) supplements our general Privacy Policy and explains how we collect, use, disclose and retain personal information relating to website visitors, prospective business contacts and individual residents of California, Texas, Colorado, Tennessee, Oklahoma, Connecticut, Minnesota, Alabama, New Hampshire, Rhode Island, Vermont, Maine, Massachusetts, North Carolina and other applicable US jurisdictions (collectively, “US residents”).
The rights and obligations described in this Policy depend on the applicable law, the nature of the personal information concerned, our activities and whether the relevant statutory requirements are satisfied.
We may process different kinds of personal data which we have categorised as follows:
Identity Data: This may include first name, maiden name, last name, marital status, title, date of birth and gender.
Contact Data: This may include email addresses and telephone numbers.
Technical Data: This may include internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our application and website.
Usage Data: This may include information about how you use our website, products and services.
Marketing and Communications Data: This may include your preferences in receiving marketing from us and your communication preferences.
Aggregated Data: This may include statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website or application feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.
Special Categories of Personal Data: This may include health and vulnerability related data.
Location Data: This may include data about your location.
Information received through business relationships: We may receive information about business contacts and authorised users from our customers, suppliers and other business partners where necessary to establish, administer or support our business relationships. We do not intend to process patient information through our initial US operations. If our activities change and we begin processing patient information or other sensitive healthcare information, we will assess the applicable legal requirements and update our practices and policies as necessary. Please do not provide patient information or other sensitive personal information to us unless the relevant service is expressly intended to receive it and you are authorised to provide it.
Medishout is a Data Processor for all data processed by us or our sub-processors on behalf of our customers. In these cases, our customer is the Data Controller, and their Privacy Policy governs how that data is collected and used. As such the relevant customer is responsible for determining the purposes and means of processing and for responding to requests concerning that information.
Medishout is a Data Processor for all data processed by us or our sub-processors on behalf of our customers. In these cases, our customer is the Data Controller and their Privacy Policy governs how that data is collected and used. Our processing obligations in these instances are strictly governed by the Data Processing Agreement we have in place with each customer.
We use this data for the following purposes:
Medishout may share personal information externally to the business. Where we choose to share your information, we shall do so for the following reasons:
Customers and business partners: including hospitals, suppliers and other organisations where disclosure is necessary to provide or support our services or manage a business relationship.
Technology and hosting providers: providers supporting our websites, application, hosting, cloud infrastructure, communications and productivity tools.
Security and IT service providers: providers supporting cybersecurity, monitoring, technical support, troubleshooting and incident management.
Professional advisers: including legal, accounting, audit and other professional advisers.
Recruitment and employment service providers: where necessary to administer recruitment or employment-related activities.
Public authorities and regulators: where required by law or where disclosure is otherwise lawful and appropriate.
Other parties involved in business transactions: where necessary in connection with a merger, acquisition, restructuring, financing or sale of all or part of our business, subject to applicable legal requirements.
We may also disclose personal information where necessary to establish, exercise or defend legal claims, protect our rights or the rights of others, or investigate suspected unlawful activity.
Where a third-party processes personal information on our behalf, we will seek to ensure that appropriate contractual and other safeguards are in place where required by applicable law.
We will not disclose personal information for purposes materially different from those described in this policy without providing any additional notice or obtaining any consent required by applicable law.
A list of our third-parties is set out below:
Our operational data is hosted in Microsoft Azure infrastructure located in the United States. Depending on the services and providers involved, personal information may also be accessed from or processed in other countries, including the United Kingdom, for purposes such as technical support, system administration, security and business operations.
We use appropriate contractual, technical and organisational measures to protect personal information in accordance with applicable legal requirements. Where applicable law requires additional information about international processing or safeguards, we will provide that information as required.
Medishout Ltd maintains a retention schedule which defines how long we will store your personal information. We will only store personal information for as long as we have a legitimate need to retain it, either for statutory/legal reasons or because we need the data to be able to provide you with services or for other legitimate business needs.
When we no longer need this information, we will anonymise your data and/or dispose of it securely as appropriate and permitted by applicable law.
Personal information may be held in paper and/or electronic format. Email correspondence and any notes from meetings are stored electronically. We may also retain information in spreadsheets or other systems which assist us with administration.
Depending on your state of residence, the circumstances of the processing and the applicable law, you may have rights concerning your personal information, including the right to:
Request confirmation of whether your personal information is being processed and access that information.
Request correction of inaccurate personal information.
Request deletion of personal information.
Request a copy of certain personal information in a portable and readily usable format.
Opt out of certain processing activities, where applicable, including the sale of personal information, targeted advertising or certain profiling.
Exercise any additional rights available under applicable law.
These rights are subject to applicable legal conditions and exceptions.
When we act as a processor
When we process personal information on behalf of a hospital, customer or other organisation, that organisation is responsible for determining how the information is used and responding to requests concerning it.
If your request relates to personal information that we process on behalf of such an organisation, you should contact that organisation directly.We will assist the relevant organisation in responding to privacy requests in accordance with our contractual obligations and applicable law.
When we act as a controller
We act as a controller when we determine the purposes and means of processing personal information for our own business purposes. Where applicable law gives you privacy rights in relation to personal information that we process as a controller, you may exercise those rights by contacting us.
The rights available to you depend on the applicable law and the circumstances of the processing. Nothing in this notice limits any rights available to you under applicable law.
How to Submit a Privacy Request
If your request concerns personal information that we process for our own purposes as a controller, you may contact us using the following details:
Email: dpo@medishout.co.uk
Where required by applicable law, we will respond to requests within the relevant statutory timeframe. We may need to verify your identity or authority to act on behalf of another person before responding.
MediShout Ltd does not currently use automated decision-making tools or profiling in the processing of your personal data.
We do not sell personal information for monetary or other valuable consideration, and we do not process personal information for targeted advertising. We do not share personal information for cross-context behavioural advertising.
Where applicable US state privacy law provides individuals with rights to opt out of the sale of personal information or its processing for targeted advertising, we do not engage in those activities. We will update this notice if our practices change and provide any additional notices, choices or opt-out mechanisms required by applicable law.
10. Data Security
We maintain administrative, technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction. The measures appropriate to a particular activity depend on the nature of the information, the risks involved and the circumstances of processing.
No method of transmitting or storing information can be guaranteed to be completely secure. We therefore cannot guarantee absolute security, but we take the necessary steps to protect the information entrusted to us.
Where applicable US state privacy law provides a right to appeal our decision regarding a privacy request, you may submit an appeal using the contact details provided in this policy.
Please identify the original request and explain why you believe our decision should be reconsidered. We will review your appeal and respond within the timeframe required by applicable law.
If we deny your appeal, we will provide any information required by applicable law about your right to submit a complaint to the relevant regulatory authority and how to submit that complaint.
Depending on your state of residence and the law that applies, the relevant authority may be your state Attorney General or another competent regulatory authority.
For California residents, the California Privacy Protection Agency (CPPA) is responsible for administering and enforcing the California Consumer Privacy Act. Information about the CPPA and its complaint process is available on its official website.
Nothing in this section limits any rights or remedies available to you under applicable law.
We continually review our Privacy Policy and update it where necessary. We advise that you regularly check our Privacy Policy for updates. We do not wish to bother you with lots of minor amendments, but where we make significant changes to our policy, we may contact you to inform you. We may also notify you in other ways from time to time about the processing of your personal information.
This Privacy Policy is version 2.5 and is valid from 00:01hrs on 15th October 2026. It replaces and supersedes all other Privacy Policies associated with MediShout Ltd.
No more switching between helpdesks, phone calls, emails or paper lists. With MediShout, everything is in one App.
