Privacy Policy

MedShr Ltd respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data when you visit our website and application (regardless of where you visit it from) and tell you about your privacy rights and how the law protects you.

Please use the Glossary at the end of this document to understand the meaning of some of the terms used in this privacy notice.

1. Important information and who we are

Purpose of this privacy notice

This privacy notice aims to give you information on how MedShr Ltd collects and processes your personal data through your use of this website and application. That includes any data you provide when you register, verify your account, post cases or comments, take part in our educational programmes, webinars and CPD activities, sign up to our newsletter or editorial programme, or take part in a competition.

MedShr is a professional network for verified healthcare professionals. Its website and application are not intended for children, and we do not knowingly collect data relating to children.

It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them. In particular, please read it together with our cookie policy and our page Who we share your data with.

Controller

MedShr Ltd (a company registered in England and Wales, number 08928248) is the controller and responsible for your personal data (collectively referred to as "MedShr", "we", "us" or "our" in this privacy notice).

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.

• Full name of legal entity: MedShr Ltd

• Name: Jude Venn

• Email address: info@medshr.net

• Postal address: 95 Archel Road, London, W14 9QL, United Kingdom

MedShr Ltd is based in the UK, so UK data protection law applies to your personal data wherever you live. If you are in the European Union, the EU General Data Protection Regulation also applies. If you are in Australia, please also read the annex at the end of this notice.

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk), or to the data protection authority where you live. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Changes to the privacy notice and your duty to inform us of changes

This version was last updated on [date]. Historic versions can be obtained by contacting us. If we make significant changes, we will tell you by email or in the app before they take effect.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

Third-party links

Our website and application may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and applications and are not responsible for their privacy statements. When you leave our website and application, we encourage you to read the privacy notice of every website you visit.

2. The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:

• Identity Data includes your name, title, MedShr member ID and profile photo.

• Contact Data includes your email address and, if you give them to us, your phone number and billing address.

• Profile Data includes your professional role, specialty, seniority, workplace or institution, country, the groups you belong to, your interests, and your username and password.

• Verification Data includes the information we use to confirm that you are a healthcare professional: your professional or academic email address, your professional registration number, the organisation you sign in through, and any identity or professional documents you upload.

• Content Data includes the cases, images, videos, documents, comments, polls and messages you post or send, and emails you send to us, with any attachments.

• CPD and Learning Data includes the modules and webinars you take part in, your assessment answers, your webinar watch time, your CPD certificates and any reflections you write.

• Transaction Data includes details of the subscriptions and other products you buy from us, and your payment status. Card details go directly to our payment provider, Stripe; we never see them.

• Technical Data includes your internet protocol (IP) address, browser type and version, time zone setting, operating system, device type, app version, app and device identifiers, push notification tokens, and your approximate location if you allow the app to use it. If you allow it on your device, it also includes your device's advertising identifier.

• Usage Data includes information about how you use our website, application, products and services, such as the pages and cases you view, what you search for, and the emails and notifications you open.

• Marketing and Communications Data includes your preferences in receiving marketing from us and third parties, your cookie choices, and your communication preferences.

We also collect, use and share Aggregated Data such as statistical, polling or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law, as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website and application feature, or to report to a sponsor how many members took part in a programme. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data, which will be used in accordance with this privacy notice.

Special Categories of Personal Data

We do not ask you for any Special Categories of Personal Data about yourself (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

Patient information in clinical cases

Members must remove information that identifies a patient before posting a case. Clinical images and case details are still information about a patient's health. When a member asks a patient for consent to use their images through our consent service (consent.medshr.net), we store the consent record, including the patient's or their representative's name, email address and signature, in encrypted form. If a patient withdraws consent, we delete the images and return the case to draft. [Lawful basis and Article 9 condition to be confirmed by counsel.]

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with access to MedShr). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

3. How is your personal data collected?

We use different methods to collect data from and about you, including through:

• Direct interactions. You may give us your Identity, Contact, Profile, Verification, Content, CPD and Learning, and Transaction Data by filling in forms or by corresponding with us by email or otherwise. This includes personal data you provide when you register, verify your account, post or comment, take part in a programme or webinar, buy a subscription, or contact us.

• Automated technologies or interactions. As you interact with our website and application, we automatically collect Technical and Usage Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookie policy for further details.

• Third parties or publicly available sources. We receive personal data about you from various third parties, as set out below:

• services you sign in with: if you sign in with Google, Apple, Facebook or LinkedIn, that service sends us your name and email address (or, with Apple, a private relay address if you choose to hide yours);

• your organisation: if you sign in through your society, employer or university, it tells us who you are, and may confirm that you are a healthcare professional;

• advertising partners: if you arrive through one of our adverts and you have allowed marketing cookies, we receive an identifier for the advert you clicked;

• patients, through our consent service, when a member asks a patient for consent to use their images.

4. How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.

• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

• Where we or a third party (including pharmaceutical companies) need to comply with a legal or regulatory obligation. This may include, but is not limited to, accurate and compliant pharmacovigilance reporting.

• Where you have given us your consent.

Please see the Glossary to find out more about the types of lawful basis that we will rely on to process your personal data.

Generally, we do not rely on consent as a legal basis for processing your personal data, other than for sending third-party direct marketing communications to you, for analytics and marketing cookies on our website, and for sharing data with advertising partners. You have the right to withdraw consent at any time by changing your choices in Cookie settings at the foot of any page, or by contacting us.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We have established the following personal data control mechanisms.

Promotional offers from us

We may use your Identity, Contact, Technical, Usage, Profile and CPD and Learning Data to form a view on what we think you may want or need, or what may be of interest to you, which may include promotional content from pharmaceutical or other life science companies. This is how we decide which content, communications, products, services and offers may be relevant for you (we call this marketing). It is a form of profiling: we use your role, specialty, seniority, country, verification status, the groups you belong to and your activity on MedShr. Some sponsored content is only available to verified members in particular roles or countries. Sponsored content is labelled as sponsored.

We do not give sponsors your name or contact details unless you expressly agree. Sponsors receive aggregated reports only.

Marketing communications from us may be sent via email, mobile push notifications, or through the MedShr app or web platform. You can ask us or third parties to stop sending you marketing communications at any time (see “Opting out” below), and you can object to this profiling at any time by contacting us.

You will receive marketing communications from us if you have requested information from us, purchased goods or services from us, registered as a member, or provided us with your details when you entered a competition or registered for a promotion, and, in each case, you have not opted out of receiving that marketing.

Third-party marketing

We will get your express opt-in consent before we share your personal data with any company outside MedShr Ltd for marketing purposes.

Advertising partners

We use advertising platforms (Meta, LinkedIn and Google) to measure and improve our own advertising.

• On our website, we only do this if you agree to marketing cookies. We then share cookies, your IP address and an identifier for the advert you clicked. When you confirm your account or are verified, we also share a hashed (scrambled) version of your email address. Because these events relate to signing up to or being verified on MedShr, they tell the platform that you are, or may be, a healthcare professional. You can withdraw your consent at any time with Cookie settings at the foot of any page.

• In our apps, we share app events, such as confirming your account or being verified, together with your device’s advertising identifier, with Meta, to measure our app advertising. On iPhone, the advertising identifier is only available if you allow the app to track you when asked. On Android, you can reset or delete your advertising identifier in your device settings. [Update when the apps ask for consent.]

For Meta, MedShr and Meta Platforms, Inc. are joint controllers for collecting this data and sending it to Meta. Meta is responsible for what it does with the data after that, under its own privacy policy. Google and LinkedIn are likewise responsible for their own use of the data. [Joint controllership wording to be confirmed by counsel.]

Opting out

You can ask us or third parties to stop sending you marketing messages at any time by logging into the website or application and checking or unchecking relevant boxes to adjust your marketing preferences, by following the opt-out links on any marketing message sent to you, or by contacting us at any time.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a product/service purchase, product/service experience or other transactions, or to service messages about your account.

Cookies

We use cookies and similar technologies on our website and in our apps. On our website, analytics and marketing cookies are only used with your consent, and you can change your choices at any time with Cookie settings at the foot of any page. You can also set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse all cookies, please note that you will not be able to sign in to this website. For more information about the cookies we use, please see our cookie policy.

Automated decision-making

Some decisions about your account are made automatically, using fixed rules rather than artificial intelligence:

• Verification. We verify you automatically if your email address is from a professional or academic domain we recognise, or if you sign in through a partner organisation that verifies its members. Otherwise a member of our team reviews the documents you upload.

• Access. Until you are verified, or if your declared role is not a clinical role, you cannot comment, publish cases, or see some content, including some sponsored content.

• Sign-up. We do not allow registration from email domains belonging to pharmaceutical and other industry organisations.

• CPD certificates. We award certificates automatically when you pass a module’s assessment, or when you watch at least the required share of a webinar (normally 75%).

• Reported content. When a member reports a post, it is hidden automatically until our team has reviewed it.

These decisions use your email address, declared role, profile, institution, how you signed in, your assessment answers, your webinar watch time and members’ reports. They affect what you can do on MedShr, whether your content is visible, and whether you receive a CPD certificate.

If you disagree with an automated decision, email info@medshr.net. You can tell us why, and a member of our team will review the decision and can change it.

AI tools. Our team uses AI tools (Anthropic’s Claude) to help review cases submitted for CPD accreditation. The tool sees the case and its discussion, including the names of members who commented. It suggests whether the case meets the accreditation criteria; a member of our team always makes the decision. Anthropic may not use your data to train its models.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. Disclosures of your personal data

We may have to share your personal data with the parties set out below for the purposes set out in the table in paragraph 4 above.

• External Third Parties as set out in the Glossary. Our page Who we share your data with lists each of our service providers, what they do for us, and where they process data.

• Other members, who can see your name, role, specialty, workplace and the content you post, as described in our terms.

• Services you choose to connect, such as FourteenFish if you connect your CPD portfolio, or a social network when you share a post.

• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes, and only permit them to process your personal data for specified purposes and in accordance with our instructions. The exceptions are advertising partners (see “Advertising partners” above) and our payment provider, Stripe, which is also responsible in its own right for some payment data, for example to prevent fraud.

Push notifications are delivered to your device through Apple’s push notification service (on iPhone) or Google’s Firebase Cloud Messaging (on Android). The text of a notification can include a member’s name and the title of a case.

6. International transfers

MedShr Ltd is based in the United Kingdom. We host MedShr, including our databases and file storage, on servers in the European Union (Belgium) and the UK (London). Many of our external third parties are based outside the UK, mainly in the United States, so their processing of your personal data will involve a transfer of data outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data under UK law. This includes the European Union and the European Economic Area, where we host your data.

• Where we use providers based in the US, we may transfer data to them if they are certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), which requires them to provide similar protection to personal data shared between the UK and the US.

• Where we use certain service providers, we may use specific contracts approved for use in the UK, which give personal data the same protection it has in the UK: the International Data Transfer Agreement, or the European Commission’s standard contractual clauses with the UK Addendum.

If you are in the European Union, we use the EU equivalents. If you use MedShr from another country, local law may also give you rights over cross-border transfers.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK, or a copy of the safeguards that apply.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Identity documents you upload for verification are stored encrypted. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach, and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention

How long will you use my personal data for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. In particular:

• Identity documents you upload for verification are deleted within 90 days. If we have not reviewed them within 60 days, we delete them and ask you to upload them again.

• Account data and content are kept while your account is open. If you close your account, we delete or anonymise your data in our live systems straight away, and in our analytics systems within 24 hours. Copies in our backups are removed within 30 days. Some logs, including IP addresses, are kept for up to 180 days, for security and to help us prevent registrations from industry organisations. We keep data longer only where the law requires us to.

• Patient consent records are stored encrypted, with a separate key for each case. When the case is deleted, or the patient withdraws consent, we delete the key, so the record can no longer be read. Encrypted backup copies are removed within 90 days.

• Pharmacovigilance reports are kept for as long as the law requires.

By law we have to keep basic information about our customers (including Contact, Identity and Transaction Data) for six years after they cease being customers, for tax purposes.

In some circumstances you can ask us to delete your data: see “Request erasure” below for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

9. Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. Please see the Glossary to find out more about these rights:

• Request access to your personal data

• Request correction of your personal data

• Request erasure of your personal data

• Object to processing of your personal data

• Request restriction of processing your personal data

• Request transfer of your personal data

• Right to withdraw consent

• Rights relating to automated decision-making

If you wish to exercise any of the rights set out above, please contact us. You can also update most of your profile yourself in your account settings.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Complaints

If you are unhappy with how we have handled your personal data, please contact our DPO first at info@medshr.net. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You also have the right to complain to the ICO, or to the data protection authority where you live (see section 1). [30-day acknowledgement to be confirmed by counsel.]

10. Glossary

LAWFUL BASIS

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

Consent means you have given clear permission for us to process your personal data for a specific purpose. You can withdraw it at any time.

THIRD PARTIES

External Third Parties

• Service providers acting as processors, based in and outside the UK, who provide IT, hosting, system administration, email, payment, notification, webinar and technology services. Our page Who we share your data with lists them.

• Advertising partners (Meta, LinkedIn and Google), with your consent on our website (see “Advertising partners”).

• Professional advisers acting as processors or joint controllers, including lawyers, bankers, auditors and insurers, based in and outside the UK, who provide consultancy, banking, legal, insurance and accounting services.

• HM Revenue & Customs, the Information Commissioner’s Office, medicines regulators and other authorities acting as processors or joint controllers, based in the United Kingdom, who require reporting of processing activities in certain circumstances.

YOUR LEGAL RIGHTS

You have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request correction of the personal data that we hold about you, if it is incomplete or inaccurate.

• Request erasure of your personal data, where there is no good reason for us continuing to process it.

• Object to processing of your personal data where we are relying on a legitimate interest, including profiling, and to direct marketing at any time.

• Request restriction of processing of your personal data in some circumstances, for example while we check its accuracy.

• Request the transfer of your personal data to you or to a third party, in a structured, commonly used, machine-readable format.

• Withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent.

• Not be subject to a decision based solely on automated processing that has a significant effect on you without safeguards. You can make representations, ask for a person to review the decision, and contest it (see “Automated decision-making”).

Annex: Additional information for users in Australia

This annex applies if you use MedShr in Australia. MedShr Ltd handles your personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as well as UK data protection law. Where this annex differs from the rest of this privacy notice, this annex applies to you.

Personal information we collect and hold. We collect the kinds of personal information described in section 2. This includes your name, professional role, specialty, seniority, workplace, email address, professional registration number, any identity or professional documents you upload so we can verify you, your posts and comments, your CPD records, and information about how you use MedShr.

How we collect and hold it. We collect personal information mainly from you: when you register, verify your account, post or comment, attend webinars, and use the app or website. If you sign in through a partner organisation, we receive your name and verification status from it. We hold your information electronically on secure servers in the European Union and the UK, operated by us and our service providers.

Why we collect, hold, use and disclose it. We do so for the purposes set out in section 4: to provide and secure MedShr, verify that members are healthcare professionals, run educational programmes and CPD, communicate with you, meet legal obligations (including pharmacovigilance reporting), and, where you have agreed, share information with advertising partners.

Sponsored programmes and targeting. Some educational content on MedShr is sponsored by pharmaceutical or other life science companies. We use your role, specialty, seniority, country and activity on MedShr to decide which content, sponsored content and messages to show you. We do not give sponsors your name or contact details unless you expressly agree. Sponsors receive aggregated reports only. You can object to this targeting by contacting us.

Advertising partners. On our website, if you agree to marketing cookies, we share limited information with advertising platforms (Meta, LinkedIn and Google) to measure and improve our own advertising. This can include a hashed (scrambled) version of your email address and the fact that you signed up to, or were verified on, MedShr. In our apps, we share app events and your device’s advertising identifier with Meta, as described in section 4.

Direct marketing. You can opt out of marketing at any time through your account settings, the unsubscribe link in any message, or by contacting us. We will not charge you for opting out.

Overseas disclosure. MedShr Ltd is based in the United Kingdom, so your personal information will be disclosed to, and held in, the UK. It is also held in the European Union (mainly Belgium and Ireland), and disclosed to service providers in the United States. Some providers, such as Stripe, Cloudflare and Google, operate globally and may process it in other countries. Our page Who we share your data with lists each provider and where it processes data. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs.

Automated decisions. Some decisions about your account are made by computer programs using your personal information, as described in section 4 under “Automated decision-making”: automatic verification, limits on what unverified members can do, blocking sign-ups from industry email domains, awarding CPD certificates, and hiding reported content until it is reviewed. These programs use your email address, declared role, profile, institution, how you signed in, your assessment answers, your webinar watch time and members’ reports. Our team also uses AI tools to help, not replace, its decisions on CPD accreditation of cases. If you think an automated decision about you is wrong, contact us at info@medshr.net and a person will review it.

Access and correction. You can access and update most of your information in your account settings. You can also ask us for access to, or correction of, the personal information we hold about you by emailing info@medshr.net. We will respond within 30 days. If we refuse, we will tell you why in writing and how to complain.

Complaints. If you think we have breached the APPs, please contact our DPO at info@medshr.net or at MedShr Ltd, 95 Archel Road, London, W14 9QL, United Kingdom. We will acknowledge your complaint promptly, investigate it, and respond in writing within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or on 1300 363 992.