1. Who is responsible for your information?

iGovy.co.uk is operated by MedStack Ltd. MedStack Ltd is the data controller responsible for the limited personal information collected directly through iGovy.

2. What does this policy cover?

This policy covers personal information processed when you:

• Visit or use iGovy.co.uk;
• Submit a contact form;
• Reply to an email from us;
• Report a price, listing or website issue;
• Ask us to pass an enquiry to a named provider; or
• Exercise a privacy right.

It does not cover information collected independently by a pharmacy, clinic, prescriber, social network or other external website. Those organisations are responsible for their own privacy practices.

3. What information do we collect?

When you contact us

A contact form normally asks for only:

• Your name;
• Your email address;
• The reason for contacting us; and
• Your message.

In straightforward terms, we receive the form, read the question and use the supplied email address to reply.

We do not use contact-form details to create a marketing profile, send promotional emails or add you to an advertising list.

When you browse the website

Like most websites, our hosting and security systems may automatically record limited technical information needed to deliver and protect the website. This may include:

• Your IP address;
• Your browser and device type;
• The page requested and time of access;
• Basic error or diagnostic information; and
• Security events, such as suspected spam or malicious requests.

We may use aggregated website statistics to understand which pages are useful and whether the website is working correctly. We do not use these statistics to advertise to individuals.

4. How do we use personal information?

We use personal information only where reasonably necessary to:

• Receive, read and reply to an enquiry;
• Deal with a privacy request;
• Correct a reported price or website error;
• Maintain, secure and troubleshoot the website;
• Prevent spam, fraud, abuse or malicious activity;
• Keep essential business or legal records;
• Comply with a lawful request or legal obligation; or
• Establish, exercise or defend a legal claim.

What we do not do

We do not use personal information to:

• Advertise or market services to you;
• Build a marketing, behavioural or medical profile;
• Determine whether you qualify for treatment;
• Make prescribing or healthcare decisions;
• Track your treatment or weight-loss progress;
• Sell or rent your personal information; or
• Provide pharmacies with visitor or patient lists.

5. Medical and sensitive information

iGovy does not request, intentionally collect or retain medical information. We are not a healthcare provider and cannot advise on treatment, prescriptions, side effects or medical emergencies.

If medical, financial, identity-related or other sensitive private information is submitted accidentally, we will not use it to answer the enquiry or for any other purpose.

We will delete it as soon as it is identified and, in any event, within 24 hours of identification.

Where possible, we may still reply to explain that the question should be directed to your GP, prescriber, pharmacy, NHS 111 or the emergency services, as appropriate.

6. Do we share information with pharmacies?

We do not routinely share identifiable visitor or patient information with pharmacies, clinics or other providers.

We will only forward an enquiry or personal information to a provider where the person whose information it is has expressly asked us to do so. We do not assume permission simply because a message mentions a particular pharmacy.

If you ask us to forward an enquiry, we will only share the information reasonably needed to carry out that request. You may withdraw your request before the information is sent.

Essential service providers

Limited personal information may be handled by the service providers needed to operate our website and communications, such as website hosting, email, contact-form and security providers.

These organisations may only process information for the service they provide. They are not permitted by us to use contact-form information for advertising.

Legal disclosures

We may disclose information if required by law, a court order or a valid request from a competent authority. We may also disclose limited information where reasonably necessary to protect legal rights, investigate serious misuse or defend a legal claim.

7. What are our legal bases?

Under the UK GDPR and, where applicable, the EU GDPR, we need a lawful basis for processing personal information.

If we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was already lawful before consent was withdrawn.

8. Cookies and technical information

iGovy may use essential cookies or similar technologies needed for website security, privacy preferences and basic website functions.

Where optional website measurement is used, its purpose is to help us understand overall site use and performance. It is not used by iGovy to serve targeted advertising or create advertising profiles.

Where the law requires consent for a non-essential cookie, it should not be activated unless consent has been given. You can also restrict or remove cookies through your browser settings.

Security and server logs may be processed without cookie consent where they are strictly necessary to deliver, protect or diagnose the website.

9. Links to pharmacies and other websites

iGovy contains links to independent pharmacies, clinics, regulators and other external websites. When you follow a link, the receiving website processes information under its own privacy policy.

Some provider links may allow a provider to recognise that a visit originated from iGovy or attribute an eligible referral. This does not give iGovy access to your medical consultation, prescription, payment details or pharmacy account.

We do not send a provider your name, email address, contact-form message or medical details merely because you click one of its links.

A commercial relationship or referral fee does not permit either party to exchange identifiable patient information. It also does not turn contact-form information into advertising data.

10. How long do we retain information?

We keep ordinary contact-form correspondence only for as long as it is reasonably needed to answer the enquiry, manage any necessary follow-up and maintain proportionate business records.

We may retain correspondence for longer where it relates to an ongoing complaint, fraud, abuse, a legal obligation or an actual or anticipated legal claim.

Technical and security logs are retained for a limited period appropriate to website operation, fault diagnosis and security. Aggregated or genuinely anonymised statistics may be kept because they no longer identify an individual.

11. How do we protect information?

We use proportionate technical and organisational safeguards designed to protect personal information against loss, misuse, unauthorised access, alteration and disclosure.

These measures may include:

• Encrypted connections to the website;
• Access restrictions;
• Website and contact-form security controls;
• Spam and malicious-traffic detection;
• Software maintenance and security updates; and
• Limited access to correspondence.

No website or email system can guarantee absolute security. Therefore, please do not use our contact form to send medical records, identity documents, payment information or other sensitive material.

12. International data transfers

Some website, security or communication infrastructure may operate outside the United Kingdom or European Economic Area.

Where a restricted international transfer occurs and UK or European data protection law applies, we use an available lawful safeguard as required. This may include an adequacy decision, approved contractual clauses, the UK International Data Transfer Agreement or the UK Addendum.

13. Your UK and European privacy rights

Depending on the circumstances and the law that applies, you may have the right to:

• Ask whether we hold personal information about you;
• Request a copy of your personal information;
• Correct inaccurate or incomplete information;
• Ask us to delete information;
• Ask us to restrict certain processing;
• Object to processing based on legitimate interests;
• Receive eligible information in a portable format;
• Withdraw consent where processing relies on consent; and
• Complain to a data protection authority.

These rights are not absolute. For example, we may need to retain limited information to comply with the law or to establish, exercise or defend a legal claim.

We may ask for limited information to confirm your identity before responding. We will not ask for more information than is reasonably necessary.

Complaining in the United Kingdom

You may complain to the Information Commissioner's Office through the ICO complaints service . However, we would appreciate the opportunity to address your concern directly first.

European Economic Area

Where the EU GDPR applies, you may also complain to the data protection authority in the EU or EEA country where you live, work or believe an infringement took place.

14. Privacy rights in the United States

Some US state privacy laws give residents additional rights over personal information. Whether a particular law applies can depend on factors including the nature and scale of an organisation's activities.

Where applicable, rights may include access, correction, deletion, portability and the right to appeal a refused request. Some laws also provide rights concerning the sale of personal information, targeted advertising, profiling or qualifying data sharing.

California residents

If the California Consumer Privacy Act, as amended, applies to a request, an eligible California resident may have rights to know, access, correct or delete personal information and to receive non-discriminatory treatment for exercising a statutory right.

iGovy does not sell personal information or share it for cross-context behavioural advertising.

Submitting a US request

Use our contact page and state that the request concerns iGovy, together with your US state of residence. We may take proportionate steps to verify the request.

An authorised agent may act where the relevant law allows, although we may request evidence of their authority.

15. Automated decisions and profiling

We do not use personal information to make automated decisions about treatment, prescribing, credit, employment, insurance or eligibility. We do not create medical, behavioural or advertising profiles of visitors.

Provider tables may be sorted automatically using non-personal factors such as price or offer terms. This affects how provider information is displayed; it is not a decision about an individual visitor.

16. Children's privacy

iGovy is intended for adults and is not directed at children. We do not knowingly collect children's personal information for advertising, profiling or marketing.

If you believe that a child has submitted personal information through iGovy, please contact us so that we can review and delete it where appropriate.

17. Changes to this policy

We may update this policy when our website, service providers or legal obligations change. The latest version will be published on this page with a revised update date.

We will not turn contact-form information into advertising, profiling or pharmacy patient data. If our use of personal information changes materially, this policy and any legally required choices will be updated before the new use begins.

18. Contact us about your information

To ask a privacy question, exercise a privacy right or request deletion of an ordinary contact-form message, use the iGovy contact page.

Please include:

• That your request relates to iGovy.co.uk;
• Your name and the email address used to contact us;
• A clear description of your request; and
• Your country and, where relevant, state of residence.

Do not attach medical records, prescriptions, identification documents or payment information to your initial request.