HandoverMed Ltd — Privacy Notice
- Version:
- 1.0
- Effective:
- 17th september 2026
- Last reviewed:
- 17th september 2026
- Owner:
- Data Protection Officer
Contents
- 1. Introduction
- 2. Personal information we collect, and why
- 3. Sharing your information
- 4. International transfers
- 5. How we protect your information
- 6. How long we keep your information
- 7. Marketing
- 8. Cookies and similar technologies
- 9. Your rights
- 10. Children
- 11. Links to other websites
- 12. Changes to this notice
- 13. Contact and complaints
- Change history
Using HOME by HandoverMed? If you are a patient whose care is recorded in HOME, or a member of staff who uses HOME at work, see the HOME by HandoverMed Privacy Notice. It explains how information in HOME is handled.
1. Introduction
This notice explains how HandoverMed Ltd ("HandoverMed", "we", "us") uses personal information in the course of running our business. It applies when you:
- visit our websites (handovermed.co.uk and handovermed.com)
- contact us, book a demonstration or ask us for updates
- work for one of our customers, prospective customers, suppliers or partners
- apply for a job with us
For this information, we are the controller: we decide how and why it is used.
It does not cover information held in our clinical handover software, HOME by HandoverMed. That is covered by the HOME by HandoverMed Privacy Notice. Our own staff and contractors receive a separate staff privacy notice.
Who we are
| Company | HandoverMed Ltd, a private limited company registered in England and Wales |
|---|---|
| Company number | 17341097 |
| Registered office | 119 Uxbridge Road, Harrow, England, HA3 6DJ |
| ICO registration number | ZC204034 |
Our Data Protection Officer can be contacted at privacy@handovermed.com, or by post at the address above, marked "Data Protection Officer". For general enquiries, email hello@handovermed.com.
2. Personal information we collect, and why
2.1 Website visitors
| What we collect | Why | Lawful basis |
|---|---|---|
| Technical information recorded when your browser connects to our website, such as IP address, browser and device type, pages requested, and date and time | To deliver the website, keep it secure, and detect and prevent misuse or attacks | Legitimate interests: running a secure, working website |
Our website may load content such as fonts from third-party networks. When your browser loads this content, that provider receives your IP address.
2.2 Enquiries, demonstrations and updates
| What we collect | Why | Lawful basis |
|---|---|---|
| Name, organisation, job role, email address, phone number (if you give it), your enquiry and our correspondence | To reply to you, arrange demonstrations and meetings, and keep a record of our conversation | Legitimate interests: responding to enquiries and building relationships with health and care organisations |
| Your contact preferences | To send you news and updates about HandoverMed and our products (see section 7) | Consent, or legitimate interests where the law allows us to contact you at work about services relevant to your organisation |
When you use the contact form on our website, your message is received by a form-handling service provider and passed to our email system.
Please do not include patient information or other sensitive health details in website forms or emails to us.
2.3 Customers and prospective customers
| What we collect | Why | Lawful basis |
|---|---|---|
| Names, job titles, work contact details and correspondence of people at organisations that use, or are considering, our products | To manage procurement, assurance and contracting; provide onboarding, training and account management; and handle service communications, invoicing and payments | Legitimate interests: running our business and managing relationships with organisations. Contract, where you personally are the party we contract with. |
| Contracts, invoices and payment records | To meet accounting, tax and company law requirements | Legal obligation |
2.4 Suppliers and partners
| What we collect | Why | Lawful basis |
|---|---|---|
| Names, job titles, work contact details and correspondence of people at our suppliers and partners | To buy and manage services, carry out security and data protection checks on suppliers, and pay invoices | Legitimate interests: managing our supply chain. Contract, where you personally are the party we contract with. |
2.5 Job applicants
| What we collect | Why | Lawful basis |
|---|---|---|
| CV, application details, qualifications, employment history, interview notes and references | To assess your application and communicate with you | Taking steps at your request before entering into a contract; legitimate interests in recruiting suitable people |
| Right-to-work documents | To confirm you are allowed to work in the UK | Legal obligation |
| Information about a disability or health condition, if you tell us, so that we can make adjustments | To support you through the recruitment process | Employment law obligations (UK GDPR Article 9(2)(b); Data Protection Act 2018, Schedule 1) |
| Criminal records check results, only where a role requires one | To assess suitability for roles with access to confidential health information | Legal obligation and the conditions in the Data Protection Act 2018, Schedule 1 |
2.6 Legal, security and administrative purposes
We may also use the information above:
- to handle data protection rights requests and complaints
- to investigate and manage security incidents
- to establish, exercise or defend legal claims
- to comply with the law, regulators, courts and law enforcement
- as part of a sale, merger or restructure of our business, subject to confidentiality
Lawful basis: legal obligation, or legitimate interests in protecting our business, our customers and the people whose information we hold.
Where we rely on legitimate interests, we have considered whether they are outweighed by your rights and freedoms. You can ask us for more detail, and you can object (see section 9).
3. Sharing your information
We share personal information only when necessary, and only with:
- Service providers that help us run our business, such as cloud and website hosting, form handling, email and communication, IT and security services, and software development and support. They act on our instructions under contracts that protect your information.
- Professional advisers, such as lawyers, accountants, auditors, insurers and assessors, who are under a duty of confidentiality.
- Regulators, law enforcement, courts and government bodies, where the law requires it or to protect rights, safety and security.
- A buyer or investor, and their advisers, if we sell or restructure our business. They must keep the information confidential.
We do not sell personal information, and we do not share it with third parties for their own marketing.
4. International transfers
Some of our service providers, such as website hosting, form-handling and email providers, are based in or may process information in other countries, such as the USA or countries in the European Economic Area.
When personal information is transferred outside the UK, we protect it using at least one of the following:
- UK adequacy regulations, which confirm that the destination protects information adequately (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified)
- the ICO's International Data Transfer Agreement, or the International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment
You can ask us for more information about these safeguards.
5. How we protect your information
We protect personal information with measures appropriate to its sensitivity, including:
- encryption in transit and at rest
- multi-factor authentication on our business systems
- access limited to the people who need it
- staff training and confidentiality obligations
- security and data protection checks on the suppliers we use
- an incident management process
We assess ourselves against the NHS Data Security and Protection Toolkit.
If a personal data breach happens, we act quickly to contain it. We tell the ICO and the people affected where the law requires.
6. How long we keep your information
We keep personal information only as long as we need it for the purposes in this notice, then securely delete or anonymise it.
| Information | How long we keep it |
|---|---|
| Website security and access logs | A short period, normally no longer than 90 days, unless needed to investigate an incident |
| Enquiries that do not lead to a business relationship | Up to 2 years after our last contact |
| Records of your marketing preferences | Until you unsubscribe. We keep a record of the unsubscribe so that we do not contact you again. |
| Contacts at customers, suppliers and partners | For the length of the relationship, then up to 6 years |
| Contracts, invoices and financial records | 6 years after the end of the financial year or contract they relate to |
| Job applications that are not successful | 6 months after the recruitment decision, or longer if you agree |
| Data protection rights requests and complaints | 3 years after the request or complaint is closed |
| Security incident records | 6 years after the incident is closed |
7. Marketing
We send news and updates only if you have asked us to, or where the law allows us to contact you at work about services relevant to your organisation.
Every message includes a simple way to unsubscribe. You can also email privacy@handovermed.com at any time. We do not buy marketing lists, and we do not share your details with others for their own marketing.
8. Cookies and similar technologies
We use only cookies and similar technologies that are strictly necessary for our website to work and stay secure. We do not use advertising or cross-site tracking cookies.
If we ever want to use optional cookies, such as analytics, we will ask your permission first, and you will be able to change your choice at any time.
9. Your rights
You have the right to:
- Be informed about how your information is used. This notice is part of that.
- Access your information and receive a copy of it.
- Rectification: have inaccurate information corrected, and incomplete information completed.
- Erasure: have your information deleted in certain circumstances.
- Restriction: limit how your information is used in certain circumstances.
- Object to our use of your information where we rely on legitimate interests. You can always object to direct marketing, and we will stop.
- Data portability: receive information you gave us in a portable format, or have it sent to another organisation, where our use is based on consent or a contract and carried out by automated means.
- Withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
- Not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make decisions like this.
Some rights apply only in certain circumstances or have exemptions. If we cannot meet your request in full, we will explain why.
How to make a request
- Email privacy@handovermed.com, or write to our Data Protection Officer at our registered office. You can also ask anyone at HandoverMed, verbally or in writing.
- We may ask for information to confirm your identity.
- We respond within one calendar month. If your request is complex, or you have made several requests, we may extend this by up to two further months. We will tell you if we need to.
- There is normally no charge.
10. Children
Our website and business services are intended for adults and organisations. We do not knowingly collect personal information from children through them.
11. Links to other websites
Our website may link to other websites, such as NHS and regulator websites. We are not responsible for how they handle personal information. Please read their privacy notices.
12. Changes to this notice
We review this notice at least once a year, and whenever we change how we use personal information. The version details at the top show when it was last updated. Significant changes are recorded in the change history below and highlighted on our website.
13. Contact and complaints
Data Protection Officer, HandoverMed Ltd
Email: privacy@handovermed.com
Post: 119 Uxbridge Road, Harrow, England, HA3 6DJ
If you are unhappy with how we have handled your personal information, please contact us first, so we can try to put it right. We will acknowledge your complaint within 30 days and respond without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Other formats: this notice is available in large print, easy read, printed copy or another language on request. Email privacy@handovermed.com.
Change history
| Version | Date | Summary of changes |
|---|---|---|
| 1.0 | 17th september 2026 | First published |