Last updated: 14 October 2026
1. Who we are
eHealth Solutions Ltd is a UK healthcare technology company, registered in England and Wales (company number 13084298), of Tricorne Stables, 15a Sandy Lane, Wokingham, England, RG41 4DD (“we”, “us”, “our”). We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].
Our products include EMRpro, ePrivate Prescription (EPP), LabLink, the eHealth Rx Network and eHealth PGD. This policy explains how we use personal data when you visit our websites, contact us, become a customer or use our software, and the rights you have under the UK GDPR and the Data Protection Act 2018.
2. Our role: controller and processor
When we are the controller. We decide how and why personal data is used for our own customers, their staff and website visitors: for example account, contact, billing, support, professional verification and marketing information.
When we are a processor. Pharmacies, clinics, prescribers and other healthcare providers use our software to record and manage their patients’ care. For that clinical and patient information, the healthcare provider is the controller and we process it only on their documented instructions, under a written agreement with them.
If you are a patient, the healthcare provider treating you is responsible for your information. Please contact them about your care, your records or your data protection rights. If you contact us, we will pass your request to the provider.
3. Information we collect
- Contact and professional details: name, job title, organisation, email address, phone number and professional registration number
- Verification information: checks of professional registration with bodies such as the GMC and GPhC, using their public registers
- Billing information: subscription, invoice and payment records. Card payments are handled by our payment provider; we do not store full card numbers
- Account and usage information: sign-in history, activity and audit logs from our software
- Website information: technical data such as IP address, browser and device type, and the pages you visit
- Enquiries and correspondence: information you send us through forms, by email, by phone or at events
- Clinical and patient information entered into our software by healthcare providers, which we process on their behalf (see section 2)
4. How we use your information and our legal basis
- To provide our software and services, manage accounts and provide support: necessary to perform our contract with you or your organisation
- To verify professional registration: our legitimate interests, and our customers’ interests, in making sure only qualified professionals carry out clinical activity
- To keep our systems secure, keep audit trails, and prevent fraud and misuse: our legitimate interests, and in some cases our legal obligations
- To bill customers and keep financial records: contract and legal obligation
- To improve our products and services: our legitimate interests, using aggregated or de-identified information wherever possible
- To send product news and updates to business contacts: our legitimate interests. Where the law requires consent, for example for some emails to individuals, we ask for it first. You can opt out at any time
- To comply with the law and respond to regulators: legal obligation
- Clinical and patient information: processed as a processor on the healthcare provider’s instructions. The provider is responsible for the lawful basis, which for health data is normally the provision of health care (UK GDPR Articles 6(1)(e) or (f) and 9(2)(h))
We do not sell or rent personal data.
5. Who we share information with
- Healthcare providers and services you or your provider choose, as part of the service: for example, sending a prescription to a pharmacy, or a test request to a laboratory
- Technology providers who host and support our software, deliver emails and process payments, under contracts that require them to protect the data
- Regulators and authorities such as the GPhC, CQC, ICO and HMRC, where the law requires it
- Professional advisers, such as our lawyers, accountants and insurers
- A buyer or successor, if all or part of our business is sold or reorganised, under the same protections
6. International transfers
Some of our technology providers may store or process data outside the UK. Where they do, we make sure the transfer is protected by appropriate safeguards, such as a UK adequacy decision or the UK International Data Transfer Agreement or Addendum. Contact us if you would like more information.
7. How long we keep information
- Account and contact information: while you are a customer, and for a reasonable period afterwards to deal with any questions or claims
- Financial records: for as long as the law requires, normally six years
- Clinical and patient records: in line with the healthcare provider’s instructions and the records-retention rules that apply to them
- Marketing contacts: until you opt out or the contact is no longer relevant. We review our lists regularly
When information is no longer needed, we delete it or anonymise it.
8. How we protect information
We use technical and organisational measures appropriate to healthcare data, including:
- Encryption of data in transit and at rest
- Role-based access, so people only see what their role needs
- Two-factor authentication
- Audit logs of access and activity
- Regular backups
- Penetration testing
- Cyber Essentials certification, with our practices aligned to the NHS Data Security and Protection Toolkit
Users are responsible for keeping their own login details secure. If a personal data breach occurs, we will tell the affected healthcare providers, the ICO and individuals where the law requires.
9. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased in some circumstances
- Restrict how we use your data
- Object to how we use your data, including for direct marketing at any time
- Receive your data in a portable format
- Withdraw your consent at any time, where we rely on consent
To use any of these rights, contact us using the details in section 13. We will respond within one month. If your request concerns patient records held by a healthcare provider, we will pass it to that provider.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to deal with your concerns first.
10. Cookies
Cookies are small files placed on your device when you visit a website. Our websites use cookies that are strictly necessary for them to work, for example to keep the site secure and to keep you signed in to our software. We only use analytics or other non-essential cookies if you agree to them, and you can change your choice at any time. You can also block or delete cookies in your browser settings, although some parts of our websites may then not work.
11. Links to other websites
Our websites may link to other sites. We are not responsible for how they handle personal data, so please read their privacy policies.
12. Changes to this policy
We will update this policy when our practices or the law change, and show the date of the latest version at the top of this page. Where a change significantly affects how we use your data, we will tell our customers directly.
13. Contact us
For questions about this policy or to exercise your rights, contact our Data Protection Officer:
Email: info@ehealthsolutions.co.uk (please put “Data protection” in the subject line)
Phone: 0800 002 5923
Post: Data Protection Officer, eHealth Solutions Ltd, Tricorne Stables, 15a Sandy Lane, Wokingham, England, RG41 4DD
