SendScript Privacy Policy

2.1 Data Protection Officer

SendScript processes health information about patients on a significant scale as a core part of its services.

(a) SendScript has appointed a Data Protection Officer under Article 37 of the UK GDPR. The Data Protection Officer can be contacted at dpo@sendscript.com or by post at the address above, marked for the attention of the Data Protection Officer.

2.2 India contact and Grievance Officer

SendScript's team includes personnel based in India who are employed or engaged by Sendscript Technologies Limited and form part of its operational and technology function.

For individuals in India, the following email contact is published for privacy questions, rights requests and grievances:

Email: Grievanceofficer@sendscript.com

This email contact is published to meet the requirement under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 for a grievance officer whose contact details are published, and to meet the equivalent requirement under the Digital Personal Data Protection framework as its provisions come into force. Grievances are addressed within the period stated in section 24.

4.1 Telemedicine

The telemedicine service may enable patients and healthcare professionals to arrange and attend remote consultations; participate in video or audio consultations; exchange secure messages; upload photographs, reports, referral documents or other files; complete pre-consultation forms; receive consultation-related communications; create or update clinical notes; issue referrals, prescriptions or investigation requests; and arrange follow-up care.

SendScript does not record or retain the audio or video content of ordinary telemedicine consultations by default. Clinical notes, messages, documents, appointment records and technical connection logs may be retained.

Where a recording function is enabled for a particular service, SendScript ensures that the user is clearly informed before recording begins, and the recording is only made where it is supported by an appropriate lawful basis and any necessary consent.

4.2 Electronic medical records

The electronic medical record or "EMR" service may allow authorised healthcare organisations and professionals to create and maintain patient records; document consultations, diagnoses and treatment plans; record allergies, medications and immunisations; request, receive and review laboratory or imaging results; create prescriptions and referrals; upload and manage documents; manage appointments, tasks and care workflows; communicate with patients and other authorised professionals; record consent, correspondence and administrative information; and maintain an audit history of access and changes.

The healthcare organisation using the EMR will normally determine why the patient record is created and how it is used for healthcare. SendScript will normally process that record on the organisation's behalf.

4.3 Radiology platform

The radiology service may facilitate imaging referrals and requests; appointment booking and management; clinical indications and safety questionnaires; communication between referring clinicians, patients and imaging providers; access to scan reports and, where enabled, images or secure image links; radiologist reporting workflows; status tracking; urgent-result or follow-up communications; billing and payment administration; and transfer of radiology information to the patient portal or relevant healthcare provider.

Depending on the service configuration, radiology information may include DICOM-related metadata, imaging identifiers, HL7 or FHIR messages, referral forms, scan reports, images, image links and related audit information.

4.4 Electronic prescriptions

The electronic prescription service may enable an authorised prescriber to create a prescription; select a medicine, dose, route, frequency, quantity and instructions; authorise a prescription using secure credentials or a PIN; issue a prescription token or notification to a patient; send a prescription to a participating pharmacy where requested or permitted; monitor whether the prescription has been sent, accessed or dispensed; receive dispensing-status information; and maintain an audit record showing relevant prescription activity.

Prescription information may include the identity and professional details of the prescriber, patient details, medication information, prescription dates, authorisation events, the selected pharmacy and dispensing information.

4.5 Healthcare marketplaces

SendScript may operate marketplaces through which users can search for, compare, contact or book specialist doctors; general practitioners or other healthcare professionals; clinics and hospitals; diagnostic or radiology providers; pharmacies; and other healthcare services.

Marketplace profiles may contain information intended to be publicly visible, such as professional or organisation name; profile photograph or logo; qualifications and experience; professional registration information; languages; clinical interests and services; clinic address and contact details; consultation formats; fees; availability; ratings or reviews; and regulatory, accreditation or verification information.

A participating healthcare professional, clinic or pharmacy is generally responsible for the healthcare or pharmacy services it provides. SendScript's role may be limited to providing the marketplace, booking, communication, payment or technology functionality.

4.6 Pharmacy platform

The pharmacy platform may allow authorised pharmacies and pharmacy personnel to receive and review prescriptions; verify patient and prescription details; record prescription acceptance, rejection or clarification; document dispensing; update dispensing status; communicate with a prescriber or patient; arrange collection or delivery; manage pharmacy staff access; manage transactions, invoices and related records; and maintain a dispensing and audit history.

The pharmacy remains responsible for its professional, legal, clinical, dispensing, record-keeping and patient-safety obligations.

4.7 Patient portal and mobile application

Where available, patients may use a SendScript account to view appointments; access records made available to them; receive prescriptions or prescription tokens; access reports and results; communicate with providers; upload documents; manage personal details; receive notifications; book services; and share selected records with an authorised person or healthcare provider.

The availability of particular information depends on the healthcare provider's configuration, applicable law and clinical considerations.

5.1 When SendScript is normally a controller

SendScript will normally act as a controller for information used to operate the SendScript website; manage SendScript's own business contacts and enquiries; create and administer professional or organisation accounts; manage SendScript subscriptions, contracts and invoices; verify healthcare professionals, clinics, pharmacies or organisations; publish and manage marketplace listings; manage SendScript's direct customer support; protect the platform, investigate misuse and maintain security logs; manage SendScript marketing preferences; administer corporate transactions and legal claims; conduct appropriately anonymised or aggregated service analysis; and comply with SendScript's own legal obligations.

SendScript may also be a controller for parts of a patient account, booking or payment process where SendScript independently determines why and how that information is required.

Annex 5 sets out the lawful basis SendScript relies on for each purpose for which it acts as a controller.

5.2 When SendScript is normally a processor

SendScript will normally act as a processor when a clinic, doctor, hospital, pharmacy, radiology provider or other healthcare organisation uses SendScript to process patient medical records; consultation notes; diagnoses and treatment information; prescriptions; dispensing information; radiology referrals, images or reports; laboratory information; patient communications; clinical documents; appointment information; care-related tasks and workflows; or other patient information entered or generated under that organisation's authority.

In these circumstances the healthcare organisation is normally the controller; the healthcare organisation determines the lawful basis and special-category condition; SendScript processes the information in accordance with the customer's instructions and the applicable agreement; requests concerning the clinical record may need to be referred to the relevant healthcare organisation; and the healthcare organisation determines the applicable clinical-record retention period, subject to law.

5.3 Independent and joint responsibilities

Some services involve more than one controller. For example, SendScript may be responsible for marketplace account administration while a doctor is separately responsible for the clinical consultation. A pharmacy may be responsible for dispensing while SendScript is responsible for operating the prescription-delivery infrastructure.

Where SendScript and another organisation jointly determine a particular processing activity, the parties enter a joint controller arrangement under Article 26 of the UK GDPR allocating their respective responsibilities, and the essence of that arrangement is made available to affected individuals on request.

6.1 Identity information

This may include name; title; date of birth; age; gender or sex where clinically or legally relevant; patient or customer identifier; profile photograph; signature; identity-verification information; passport, driving-licence or other identification information where necessary; relationship to a patient; parental-responsibility or guardianship information; and insurance or membership identifiers.

6.2 Contact information

This may include email address; telephone number; residential, correspondence, billing or delivery address; emergency-contact information; communication preferences; and preferred language.

6.3 Account and authentication information

This may include username; encrypted or securely protected authentication credentials; account type; organisation; assigned role and permissions; multi-factor authentication information; secure PIN events; login dates and times; failed-login information; session information; password-reset activity; and account-status information.

We do not disclose passwords or secure PINs to other users. Credentials should not be shared.

6.4 Health and medical information

This may include symptoms and presenting complaints; medical, surgical, psychiatric, family and social history; diagnoses; allergies and sensitivities; medications; immunisations; clinical observations and measurements; consultation notes; care and treatment plans; laboratory requests and results; imaging requests, images and reports; referral information; prescription and dispensing information; pregnancy or reproductive information where clinically relevant; genetic or biometric information where a service requires it; photographs, recordings or documents supplied for clinical review; correspondence concerning care; consent and capacity information; information concerning disability or support requirements; and other information relevant to healthcare or patient safety.

Health information is special-category personal information under UK law and may constitute sensitive personal data or information under applicable Indian law.

6.5 Prescription and pharmacy information

This may include medication name; formulation and strength; dose; route; frequency; duration; quantity; prescribing instructions; prescription date; prescriber; prescription token or identifier; prescription status; selected pharmacy; dispensing date; quantity dispensed; collection or delivery status; pharmacy notes; and communications concerning clarification, substitution, availability or safety.

6.6 Radiology information

This may include referring provider; clinical indication; requested imaging modality and body area; appointment preferences; safety questionnaire responses; allergy or contrast information; implant, device or previous-procedure information; pregnancy information where relevant; prior imaging information; scan images; imaging metadata; scan reports; radiologist details; report status; urgent findings notifications; and follow-up information.

6.7 Professional and organisation information

For clinicians, pharmacies, radiology providers, clinics, hospitals and staff, this may include job title; professional qualifications; professional registration number; speciality; professional history; organisation and department; work address and contact details; licences, registrations or accreditations; insurance or indemnity information; identity-verification documents; staff role and permissions; signature; prescriber or dispenser identifiers; availability and pricing; contractual and billing information; and public profile information.

6.8 Appointment and communication information

This may include appointment date, time, type and location; booking status; cancellation and non-attendance information; waiting-list information; consultation type; reminders; secure messages; email or SMS delivery status; support correspondence; call records; feedback; survey responses; and complaints.

6.9 Financial and transaction information

This may include billing name and address; invoice information; payment amount; currency; payment status; transaction identifier; refund information; insurer or sponsor details; bank information for professional or organisation payments; and relevant accounting information.

Depending on the payment method, payment-card information may be collected directly by an authorised payment provider. SendScript may receive a payment token, transaction reference or confirmation rather than the full card number or security code.

6.10 Device, technical and usage information

This may include IP address; browser type and version; device type; operating system; application version; language; time zone; device identifiers; approximate location inferred from an IP address; login and session information; pages and features used; links selected; date, time and duration of activity; crash or error information; network and connectivity information; security events; and audit logs.

6.11 Marketplace and review information

This may include search and filter selections; saved providers; enquiries; booking requests; professional profile information; availability; prices; reviews; ratings; responses to reviews; moderation information; and evidence used to verify a profile or review.

6.12 Information about offences, safeguarding or risk

In limited circumstances, a healthcare provider may record information concerning safeguarding; violence or risk; fraud; prescription misuse; professional restrictions; criminal allegations or convictions; or legal proceedings.

Such information is only processed where there is an appropriate legal basis, an appropriate condition under Schedule 1 to the Data Protection Act 2018 where one is required, and a demonstrable operational need.

7.1 Directly from you

For example, when you create an account; complete a form; book a service; attend a consultation; upload a document; send a message; make a payment; submit a review; contact customer support; register an organisation; create a professional profile; or provide information at an event or demonstration.

7.2 From healthcare and operational partners

This may include information from doctors and other healthcare professionals; clinics and hospitals; pharmacies; radiology and diagnostic providers; laboratories; insurers or assistance companies; referral organisations; employers where an occupational-health service is lawfully arranged; delivery providers; and payment providers.

7.3 From public and professional sources

For professional verification or marketplace administration, we may consult professional registers; regulator websites; healthcare-provider registers; public company registers; organisation websites; publicly available professional profiles; and other lawful public sources.

7.4 Automatically

Technical information may be collected through cookies; software development kits; server logs; authentication systems; application telemetry; security-monitoring systems; and similar technologies.

8.1 Providing and administering the platform

This includes creating accounts; authenticating users; assigning roles and permissions; providing platform functionality; maintaining records; enabling uploads and downloads; delivering notifications; providing customer support; troubleshooting; maintaining availability; and managing subscriptions.

8.2 Facilitating healthcare

This includes arranging consultations; supporting clinical documentation; making patient information available to authorised professionals; facilitating prescriptions; facilitating dispensing; arranging diagnostic appointments; transmitting results and reports; managing referrals; supporting clinical communication; and maintaining a care-related audit trail.

SendScript does not replace the independent clinical judgement of a qualified healthcare professional.

8.3 Operating marketplaces

This includes creating and publishing profiles; verifying professional or organisation information; enabling search and comparison; processing enquiries and bookings; displaying availability and fees; administering reviews; preventing false listings; managing disputes; and analysing marketplace performance.

8.4 Payments and financial administration

This includes processing charges; issuing invoices; managing subscriptions; paying providers; administering refunds; detecting payment fraud; reconciling transactions; collecting amounts due; and meeting accounting and tax obligations.

8.5 Communicating with users

This includes appointment reminders; prescription notifications; report-availability notifications; service messages; security alerts; changes to terms or policies; support communications; complaint handling; operational updates; and marketing where permitted.

8.6 Security, audit and fraud prevention

This includes verifying identity and professional status; monitoring access; maintaining audit logs; detecting suspicious or unauthorised use; preventing fraud; investigating incidents; protecting patients, professionals and organisations; maintaining platform integrity; and establishing, exercising or defending legal claims.

8.7 Improving SendScript

This includes measuring platform performance; resolving errors; understanding feature use; conducting quality assurance; testing changes; developing new functionality; producing aggregated statistics; and improving accessibility and user experience.

Identifiable patient information is not used for unrelated product development merely because it is available. Production data is not copied into development or test environments unless there is a documented necessity, lawful authority and appropriate safeguards, and any such access is recorded in accordance with section 14.2.

8.8 Compliance and public safety

This includes meeting legal and regulatory requirements; responding to valid legal requests; cooperating with regulators; complying with professional and clinical-safety requirements; responding to safeguarding concerns; protecting vital interests in an emergency; and reporting incidents where legally required.

9.1 Contract

Processing may be necessary to provide a service requested by you; administer your account; process a booking or payment; provide a marketplace listing; perform a contract with a healthcare organisation; or take steps at your request before entering a contract.

9.2 Legal obligation

Processing may be necessary to comply with data-protection law; tax and accounting requirements; court orders; regulatory requirements; professional or healthcare requirements; fraud-prevention obligations; or other applicable law.

9.3 Legitimate interests

SendScript may rely on legitimate interests where necessary and proportionate, including to operate and improve the platform; administer business relationships; manage professional profiles; protect platform security; prevent misuse and fraud; maintain appropriate audit records; understand service performance; recover money owed; manage legal claims; and communicate with business contacts.

SendScript carries out and records a legitimate interests assessment before relying on this basis, balancing its interests against the rights, freedoms and interests of the individual. A summary of the relevant assessment is available on request to privacy@sendscript.com.

9.4 Recognised legitimate interests

Where the statutory conditions in Annex 9 to the UK GDPR are met, SendScript may rely on a recognised legitimate interest for an eligible purpose, such as preventing crime, safeguarding vulnerable individuals or responding to an emergency.

SendScript does not rely on this basis for routine commercial security monitoring or product analytics. Those activities are carried out under the ordinary legitimate interests basis in section 9.3, with a balancing assessment.

9.5 Vital interests

Information may be processed where necessary to protect someone's life or physical safety, particularly where the individual is unable to provide consent.

9.6 Public task

A healthcare customer may rely on public-task grounds where it is exercising an official function. SendScript does not rely on public task for its own processing.

9.7 Consent

Consent may be used for optional processing, such as certain marketing communications; optional cookies; an optional recording; an optional sharing function; publication of information not otherwise required; or another specific use for which genuine choice is available.

Consent may be withdrawn at any time, and withdrawing it is as easy as giving it. To withdraw consent, use the relevant control in your account, the unsubscribe link in a marketing message, or email privacy@sendscript.com. Withdrawal does not affect processing already carried out lawfully before withdrawal.

10.1 UK special-category conditions

Where SendScript acts as a controller for health information, it must have both an Article 6 lawful basis and an Article 9 condition, together with any condition required under Schedule 1 to the Data Protection Act 2018.

Depending on the circumstances, the Article 9 condition may include health or social care, where processing is necessary for medical diagnosis, treatment, care or management of health services and the legal requirements concerning professional secrecy or confidentiality are met; explicit consent, for a specific optional use; vital interests, where the person is physically or legally incapable of giving consent; legal claims, where necessary to establish, exercise or defend a claim; substantial public interest, where an applicable statutory condition is satisfied; public health, where the legal requirements apply; or research or statistical purposes, where the applicable safeguards and legal conditions are satisfied.

SendScript does not assume that a health-data condition applies simply because the platform is used in healthcare. Where a condition in Part 1 or Part 2 of Schedule 1 to the Data Protection Act 2018 is relied on, SendScript maintains the appropriate policy document that legislation requires.

Where SendScript is a processor, the healthcare customer is responsible for identifying the relevant Article 6 basis and Article 9 condition. SendScript processes the information under the customer's instructions.

10.2 Professional confidentiality

Health information may be accessed by authorised healthcare professionals; authorised members of the relevant healthcare organisation; SendScript personnel with an operational need; approved service providers acting under confidentiality and data-processing obligations; and other recipients authorised by the patient, controller or law.

Access does not permit a person to use health information for personal, unrelated or unauthorised purposes. SendScript personnel are bound by contractual confidentiality obligations, access is role-based and logged, and misuse is treated as a disciplinary matter.

10.3 Indian sensitive information

While applicable Indian requirements remain in force, medical records, health information, financial information, passwords and certain biometric information may be treated as sensitive personal data or information under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011.

SendScript applies reasonable security and confidentiality safeguards to such information and is implementing the DPDP framework as the relevant provisions commence, on the timetable described in section 3.

11.1 Telemedicine

For telemedicine, we may process identity and contact information; appointment information; clinical forms; live audio and video transmission; connection and device information; messages; clinical notes; uploaded documents; prescriptions; referrals; payment information; and follow-up communications.

Audio and video content is not routinely recorded by default. Technical information needed to connect, secure and troubleshoot the consultation may be logged.

The treating healthcare professional is responsible for the clinical consultation, diagnosis, advice, treatment and medical record.

11.2 EMR

For the EMR, SendScript processes information entered, uploaded, received or generated by the healthcare customer and its authorised users. SendScript does not independently decide what should be written in an individual patient's clinical record.

Access to an EMR is controlled through user accounts, roles and permissions configured by or for the healthcare organisation.

11.3 Radiology

For radiology, information may be shared between the patient; referring clinician; referring organisation; scan provider; radiologist; authorised administrative personnel; payment or insurance provider where applicable; and technical providers necessary to deliver reports or images.

The scan provider and reporting radiologist remain responsible for their clinical and regulatory duties.

11.4 Electronic prescriptions

Prescription information may be made available to the patient; the prescriber; authorised members of the prescriber's organisation; the pharmacy selected or authorised to dispense; authorised pharmacy staff; delivery providers where delivery is requested and permitted; and regulators or authorities where legally required.

A prescription token is confidential and should be treated in the same way as any other secure credential. SendScript applies verification and security controls before a prescription can be accessed and dispensed.

The patient receives the prescription token through the SendScript patient application and by email. When presenting the token to a pharmacy, the patient must also provide their date of birth as an additional verification detail. The pharmacy enters the prescription token, the patient’s date of birth and the pharmacy’s details into the SendScript system.

Once the information has been verified, the pharmacy can securely view and download the prescription for dispensing. When the prescription is dispensed, its status is updated within SendScript and the prescribing clinician is notified that the prescription has been dispensed.

Each prescription token is single-use and cannot be used again after the prescription has been dispensed. SendScript maintains an audit trail for each prescription, including the prescription ID, token activity, pharmacy details and dispensing status.

These controls reduce, but do not entirely eliminate, the risk of unauthorised access. Patients must not share, forward, publish or otherwise disclose their prescription token or verification information to anyone other than the pharmacy dispensing the prescription. If you believe that a prescription token has been disclosed to someone who should not have access to it, contact us immediately at privacy@sendscript.com so that the token can be reviewed and, where appropriate, cancelled.

11.5 Pharmacy

The pharmacy is responsible for verifying prescriptions; determining whether dispensing is lawful and clinically appropriate; counselling the patient; maintaining required dispensing records; fulfilling professional obligations; and managing medicine collection or delivery.

SendScript may maintain status and audit information showing which pharmacy accessed or dispensed a prescription.

11.6 Marketplace

When you contact or book a provider through a marketplace, SendScript may provide the provider with information necessary to respond or fulfil the booking; the provider will normally become an independent controller of information it receives; the provider's own privacy notice will apply to its healthcare service; SendScript may retain booking, transaction and communication information for administration, safety and dispute management; and public profile information may remain visible until the profile is removed or suspended.

12.1 Healthcare providers

This may include doctors; nurses; pharmacists; radiologists; diagnostic professionals; clinics; hospitals; pharmacies; scan centres; laboratories; and other professionals involved in care.

12.2 Organisations using SendScript

Information may be accessible to authorised administrators and staff of the organisation responsible for the relevant account or patient record.

12.3 Service providers

We may use service providers for cloud hosting; data storage and backup; communications; video connectivity; email and SMS delivery; payment processing; customer support; identity and professional verification; cybersecurity; error monitoring; analytics; document processing; and professional advice.

Service providers are selected and managed in accordance with applicable data-protection requirements. Where they act as processors, they process information only for agreed purposes and under a written contract meeting the requirements of Article 28 of the UK GDPR.

12.4 Payment and financial organisations

Information may be shared with payment processors; acquiring banks; financial institutions; fraud-prevention services; insurers; and accounting providers.

12.5 Delivery providers

Where medicine, a test kit, a document or another item is delivered, necessary information may be shared with a delivery or logistics provider.

Delivery providers do not receive clinical information that is unnecessary for delivery.

12.6 Regulators, courts and public authorities

Information may be disclosed where required or permitted by law, including to courts; law-enforcement bodies; data-protection authorities; healthcare or pharmacy regulators; safeguarding bodies; tax authorities; and other competent authorities.

SendScript assesses the validity and scope of a request before disclosure unless prohibited from doing so.

12.7 Professional advisers

Information may be shared with legal advisers, auditors, insurers, consultants or other professional advisers where necessary and subject to confidentiality obligations.

12.8 Corporate transactions

Information may be disclosed in connection with an investment; financing; reorganisation; sale; merger; acquisition; transfer of assets; or insolvency process.

Only information reasonably necessary for the transaction is disclosed, and appropriate confidentiality and data-protection safeguards are applied.

12.9 With your direction or authorisation

Information may be shared where you ask us to send a record to a provider; share a prescription with a pharmacy; invite a family member or representative; generate a sharing link; provide information to an insurer; or otherwise make information available to a nominated person.

You should verify the recipient before sharing information.

SendScript does not sell personal information, and does not share personal information with third parties for their own independent marketing purposes.

14.1 Regional data hosting

SendScript's data-hosting arrangements are designed around regional data residency.

Unless otherwise agreed in writing for a particular customer or service, UK production patient data is hosted in the United Kingdom, and India production patient data is hosted in India.

A specific customer agreement, integration or service may require a different arrangement. Where this occurs, the arrangement is assessed and documented before it is implemented.

14.2 India-based SendScript team

SendScript has team members in India who form part of Sendscript Technologies Limited.

India-based personnel do not have routine, unrestricted access to identifiable UK production patient information.

Their normal development and testing activities use synthetic data, anonymised information, or appropriately pseudonymised information.

Where exceptional access to identifiable production information is genuinely necessary for an authorised support, security or incident-management purpose, access is approved; limited to the minimum information required; role-based; time-limited where practicable; authenticated; logged and monitored; subject to confidentiality requirements; and covered by an appropriate international-transfer mechanism where required.

14.3 UK restricted transfers

Remote access from India to UK personal information may constitute an international restricted transfer even where the individual accessing the information works for the same company.

Where UK law requires a transfer safeguard, SendScript uses a UK adequacy regulation or data bridge; the UK International Data Transfer Agreement; the UK Addendum to the EU Standard Contractual Clauses; binding corporate rules, where applicable; or another legally recognised mechanism.

India is not currently the subject of UK adequacy regulations. Transfers to and access from India therefore rely on the International Data Transfer Agreement or the UK Addendum, supported by a transfer risk assessment.

SendScript carries out a transfer risk assessment to establish whether the protection for the information would be materially lower following the transfer, and applies supplementary safeguards where appropriate. A copy of the relevant assessment is available to business customers on request.

14.4 Transfers from India

Personal information processed in India may be transferred outside India subject to applicable law; the relevant customer agreement; patient or user notices; security requirements; sector-specific restrictions; and any general or special restriction issued by the Government of India.

Rule 15 of the Digital Personal Data Protection Rules 2025 permits transfers outside India subject to any restrictions the Central Government specifies. That rule is subject to the phased commencement described in section 3.

14.5 Other international providers

Some approved service providers may process information in another country.

Before using such a provider, SendScript assesses the country of processing; the type and sensitivity of the information; the provider's role; contractual protections; access controls; onward transfers; government-access risk; deletion arrangements; and applicable transfer requirements.

15.1 User security responsibilities

You should use a strong and unique password; enable multi-factor authentication where available; keep prescription and sharing tokens confidential; sign out of shared devices; keep your contact details current; report suspicious activity promptly; not share professional accounts; not download patient information to unauthorised devices; and comply with your organisation's security requirements.

15.2 Personal-data incidents

Where SendScript becomes aware of a personal-data incident, it will, without undue delay, investigate; take proportionate containment and remediation measures; preserve relevant evidence; inform the relevant controller where SendScript is a processor; and notify a regulator or affected individual where SendScript is legally required to do so.

Where SendScript is a controller and a personal data breach is notifiable, it notifies the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it, and notifies affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Where SendScript is a processor, it notifies the relevant controller without undue delay after becoming aware of the breach. Separate reporting obligations apply in India as the relevant provisions of the Digital Personal Data Protection Rules 2025 come into force.

16.1 Clinical records

Clinical records held in an EMR, pharmacy or radiology service will normally be retained according to the healthcare controller's documented retention schedule; applicable healthcare and professional requirements; relevant health-record guidance; patient-safety requirements; and the applicable contract.

Closing a SendScript account does not necessarily require deletion of the clinical record.

A right-to-erasure request may not apply where the information must be retained for healthcare, legal, regulatory, public-interest or legal-claims purposes. Health-record retention is governed by a documented schedule and periodic review.

16.2 Business and transaction records

Contracts, invoices, payment records and related business information may be retained for the applicable accounting, tax, audit and legal limitation periods.

16.3 Marketplace information

A professional or organisation profile may be retained while the account or listing is active.

After deactivation, information may be retained where necessary for transaction records; complaint handling; fraud prevention; professional verification; contractual enforcement; or legal claims.

Public visibility will normally cease before all underlying administrative records are deleted.

16.4 Support and communications

Support requests and communications may be retained for as long as necessary to resolve the request; improve support; evidence instructions; investigate a complaint; maintain safety; or defend a legal claim.

16.5 Security and audit information

Security logs, login records and audit histories may be retained according to a defined security and compliance schedule.

Clinical audit entries may need to remain linked to the clinical record to preserve record integrity.

16.6 Backups

Information may remain in secure backups for a limited period after deletion from the active system.

Backup information is protected and is not restored for ordinary operational use after a valid deletion unless required for recovery, security or law.

16.7 Deletion, return and anonymisation

At the end of a business customer contract, patient information will be returned; made available for export; retained for an agreed transition period; deleted; or handled in another agreed manner, in accordance with the contract and applicable law.

18.1 UK children

In the United Kingdom, where SendScript relies on consent to offer an information society service directly to a child, section 9 of the Data Protection Act 2018 sets the minimum age for that consent at 13. A child below that age can only give consent through a person holding parental responsibility.

SendScript's minimum age for holding a patient portal account in the United Kingdom is 16 years of age. Below that age, a patient's information is accessed through an account held by a parent, a person with parental responsibility or a legal guardian, subject to the treating provider's configuration and clinical judgement.

The legal rules for a child's healthcare information are not determined solely by the age used for consent to online services.

A healthcare provider must consider parental responsibility; the child's maturity and understanding; capacity or competence; confidentiality; safeguarding; best interests; and applicable healthcare law and professional guidance.

18.2 India children

Under the Indian DPDP framework, a child is generally a person under 18.

Where the relevant provisions apply, verifiable parental consent may be required unless an applicable statutory exemption applies.

The DPDP Rules include limited healthcare-related exceptions for processing by clinical establishments and healthcare professionals where processing is restricted to health services necessary to protect the child's health.

18.3 Safeguards

When processing children's information, SendScript and the relevant provider will collect only necessary information; use age-appropriate privacy information where appropriate; restrict access; avoid unnecessary profiling or marketing; protect location and contact information; verify the authority of an adult where necessary; and prioritise the child's safety and interests.

SendScript takes account of the ICO's Age Appropriate Design Code where its services are likely to be accessed by children in the United Kingdom.

20.1 Anonymised information

Information is anonymised only where individuals are no longer identifiable by reasonably available means.

Genuinely anonymised information may be used for service statistics; capacity planning; performance analysis; security analysis; product improvement; business reporting; and research or innovation.

SendScript does not attempt to re-identify genuinely anonymised information.

20.2 Aggregated information

Aggregated information may include statistics such as appointment volumes; prescription-status totals; scan-booking trends; platform performance; usage by service type; or marketplace demand.

Outputs are structured to reduce re-identification risk.

20.3 Pseudonymised information

Pseudonymised information remains personal information where it can be linked back to an individual using additional information. It continues to receive data-protection safeguards.

20.4 Research

Identifiable health information is not used for an unrelated research project merely because it is stored on SendScript.

Research involving identifiable or pseudonymised information must have a defined purpose; an appropriate lawful basis and condition; necessary approvals; data-minimisation measures; appropriate transparency; access controls; and contractual and ethical safeguards where applicable.

21.1 Service communications

SendScript may send communications necessary to provide or administer a service, including account verification; security alerts; appointment reminders; prescription notifications; report notifications; support responses; payment information; operational updates; and changes to terms or policies.

These are not marketing communications, and you cannot opt out of them while you hold an account or are receiving a service.

21.2 Marketing

Where lawful, SendScript may send information about SendScript products; new features; professional services; events; educational material; or relevant offers.

Electronic marketing is sent in accordance with applicable data-protection and electronic-communications law, including the Privacy and Electronic Communications (EC Directive) Regulations 2003.

SendScript obtains consent where it is required. Where SendScript relies on the soft opt-in for existing customers, it does so only for its own similar products and services, and an opt-out is offered in every message.

21.3 Opting out

You may opt out by using the unsubscribe option in a marketing message; changing available communication preferences; or emailing privacy@sendscript.com.

Opting out of marketing does not stop essential service, safety, account, prescription or contractual communications.

21.4 Marketing involving health information

SendScript does not use identifiable health information to infer sensitive marketing interests or target advertising without a specific lawful basis and any required explicit consent.

SendScript does not sell patient health information to advertisers.

22.1 Essential technologies

Essential technologies may be used where necessary to provide a service requested by the user; secure an account; maintain a session; remember privacy choices; process a payment; or protect the platform.

22.2 Analytics and functional technologies

SendScript may use analytics or functional technologies to understand and improve the service.

Consent is requested where it is legally required. The Data (Use and Access) Act 2025 introduced a limited exemption from the consent requirement for certain statistical and functionality purposes, provided clear information and an opt-out are given. Where SendScript relies on that exemption, it gives that information and that opt-out.

22.3 Advertising technologies

Advertising or cross-site tracking technologies are not placed without consent where consent is legally required.

Further detail is set out in the Cookie Policy and in the consent-management interface on our website.

23.1 How to exercise a right

Email privacy@sendscript.com with your name; account email or other identifier; the organisation or healthcare provider involved; the right you wish to exercise; the information or period concerned; and any other detail that will help locate the information.

23.2 Identity verification

We may request proportionate information to verify your identity; your authority to act for another person; and the scope of the request.

This is intended to prevent information being disclosed to an unauthorised person.

Where we need further information to identify you or to clarify the scope of your request, the statutory response period is paused until you provide it.

23.3 Requests concerning healthcare-customer records

Where SendScript is a processor, we may refer the request to the healthcare controller; ask you to contact that organisation directly; or assist the healthcare controller in responding.

SendScript cannot independently delete or alter a controller's clinical record contrary to the controller's lawful instructions.

Where we refer your request to a healthcare controller, we tell you who that organisation is and how to contact it.

23.4 Response time and fees

Requests are handled without undue delay and in any event within one month of receipt.

That period may be extended by up to two further months where the request is complex or where we have received a number of requests from you. If we extend the period, we tell you within one month of receiving your request and explain why. Our searches in response to an access request are those that are reasonable and proportionate. We do not charge a fee for handling a request. Where a request is manifestly unfounded or excessive we may charge a reasonable fee to cover our administrative costs, or refuse to act on the request, and we will explain our reasons and your right to complain.

25.1 UK regulator

You may complain to the UK data protection regulator at any time. You are encouraged, but not required, to contact SendScript first so that we have an opportunity to investigate.

The UK supervisory authority is the Information Commissioner's Office:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom

Under Part 6 of the Data (Use and Access) Act 2025 the Information Commissioner's Office is to be replaced by a new body, the Information Commission. At the date of this Privacy Policy the transfer of functions has not been commenced and the Information Commissioner's Office remains the supervisory authority. This Privacy Policy will be updated when the transfer takes effect.

25.2 India regulator

Where the relevant provisions and complaint routes are operational, an individual in India may be able to complain to the Data Protection Board of India after using the applicable grievance-redress process described in section 24.