Terms and Conditions
Welcome to Prosper Healthcare
1. The Terms and Conditions
2. Our services and usage policy
3. About us
4. Professional standards and qualifications
5. Privacy and security
a Privacy of your information
b Security
c Direct marketing
6. Registration and verifying your identity
7. Our commitment to you
a Professional responsibility
b Compliance
c Provide identification
d Prescribe in the best interest of the patient
8. Your commitments when using Prosper Healthcare Services
9. Notifying other Healthcare Professionls
10. Information and advice
11. Subscription service
12. Pricing
13. Placing and cancelling an order
14. Concluding a binding contract
15. Payment and refunds
16. Authorisation of orders for medicines
17. Choosing to collect or delivery medication (participated delivery pharmacy)
18. Refunds and your right to cancel
19. Our right to cancel
20. Prosper Healthcare and Asclepius Wellbeing Ltd
21. Our liability to you
22. Information on this website
23. Links from website and clinic software
24. Use of Prosper Healthcare Services outside of the United Kingdom
25. Third party rights
26. Waiver
27. Governing law
1 The Terms and Conditions
Please read the Terms and Conditions on which we supply product(s) and/or services to you before you submit your order to us. These terms tell you who we are, what to do if there is a problem and other important information.
2 Our services and usage policy
Throughout these Terms and Conditions, Services provided by Prosper Healthcare website remotely via phone, video or in person are referred to ‘our Services’ or ‘the Services’. Any advice given over the phone or video chat will be referred to as ‘remote Services’.
By using our Services, you are confirming you have read, understood and agree to be legally bound by these Terms and Conditions which cover all Services we provide.
If you require further information regarding the Terms and Conditions please contact us at Prosper Healthcare via email: info@prosperhealthcare.co.uk or by post: 77 Avondale Road, Kettering, NN16 8PL.
3 About Us
Prosper Healthcare is a trading name of Asclepius Wellbeing Ltd, a company incorporated in England and Wales under company number 12380227.
Prosper Healthcare Services include providing advice, diagnosing, deciding to not diagnose and treating several medical conditions.
For specific conditions, a follow up assessment will be mandatory after initial treatment for a pharmacist prescriber to continue treatment within an appropriate timeframe.
4 Professional standards and qualifications
4. Professional standards and qualifications
For healthcare regulatory purposes, Prosper Healthcare Services are provided by pharmacist independent prescribers registered with, and regulated by, the General Pharmaceutical Council.
We keep our regulatory obligations under regular review. Where any Service we provide falls within a CQC regulated activity or requires any other regulatory approval, registration, licence or authorisation, we will hold, maintain or apply for the required registration, licence or approval before providing that Service.
Our pharmacist independent prescribers are responsible for prescribing safely and appropriately within their professional scope of practice and competence. They must comply with applicable General Pharmaceutical Council standards, relevant professional guidance, and the Royal Pharmaceutical Society Competency Framework for all prescribers.
All pharmacist independent prescribers providing Prosper Healthcare Services are registered with the General Pharmaceutical Council. The name and General Pharmaceutical Council registration number of the prescriber will be made available at the start of the consultation or where otherwise appropriate.
Our Services may be limited, suspended or refused at the judgement of the prescriber or director where use of the Services appears inappropriate, excessive, unsafe, outside the prescriber’s competence, outside the scope of the Service, or otherwise unsuitable.
This is not an emergency or acute medical service. You must not use Prosper Healthcare Services if you are having a medical emergency, mental health emergency, or urgent clinical situation. This includes any person experiencing suicidal thoughts, suicidal intent, serious self-harm risk, overdose, or risk of harm to others.
In the event of a medical or mental health emergency, you should call 999 immediately.
You should call 999 immediately and not use our Services in the following situations:
– loss of consciousness;
– breathing difficulties;
– a sudden confused state;
– chest pain;
– severe bleeding that cannot be stopped;
– severe allergic reaction or anaphylaxis;
– fits or seizures that are not stopping;
– severe burns or scalds;
– serious self-harm, suspected overdose, suicidal intent, or risk of harm to others;
– suspected heart attack or stroke;
– major trauma, including a serious road traffic accident, stabbing, shooting, fall from height, or serious head injury.
5 Privacy and security
Your privacy is important to us and the following information explains how we will use and protect it.
5. Privacy and security
Your privacy is important to us. The following section explains how we use and protect information submitted through Prosper Healthcare Services.
a. Privacy of your information
Asclepius Wellbeing Ltd, trading as Prosper Healthcare, complies with applicable UK data protection law.
Information you provide to us will be used to provide safe and effective care, treatment, prescribing, identity verification, payment processing, account management, service administration, clinical governance, security, audit, and legal or regulatory compliance.
Personal information may be shared with organisations that help us provide your care or operate our Services. This may include your named GP practice, your chosen pharmacy, identity verification providers, payment providers, IT service providers, hosting providers, professional advisers, regulators, emergency services, safeguarding bodies, or other healthcare providers where this is necessary or permitted by law.
Please read our Privacy Notice for full details of how we collect, use, store and share personal data.
b. Security
Prosper Healthcare Services use HTTPS/TLS, firewalls, role-based access controls, secure sessions, CSRF protection, security headers, audit logging, secure cloud infrastructure, and other technical and organisational measures to protect information submitted through the website, CRM and related systems.
Public website/front-end services may be hosted through 20i, while application data, databases, backups, storage and related cloud infrastructure may be hosted through Amazon Web Services. Where 20i provides website or application hosting for any part of the Service, it may process limited technical, hosting, log or service data necessary to provide that hosting.
Access to personal and clinical data is restricted to authorised users who have a business, clinical, legal or operational need to access it. Access to sensitive records is monitored through security and audit controls.
However, there is a risk that electronic communications may be intercepted or read by others, and we cannot guarantee that our website will be secure or free from bugs or viruses. To reduce this risk, any device used to access our website or online patient record should be suitably protected, including by using appropriate security software and keeping your device, browser and software updated.
You must not misuse the Services by:
– knowingly introducing viruses, trojans, worms, logic bombs or other material that is malicious or technologically harmful;
– attempting to gain unauthorised access to the Services, the servers on which they are stored, or any server, computer or database connected to the Services;
– attacking the Services via a denial-of-service attack or distributed denial-of-service attack.
By breaching this provision, you may commit a criminal offence under the Computer Misuse Act 1990. We may report any such breach to the relevant law enforcement authorities and co-operate with those authorities, including by disclosing your identity where legally permitted or required. In the event of such a breach, your right to use the Services will cease immediately.
c. Direct marketing
Where you have given consent, or where we are otherwise permitted to do so under applicable data protection and electronic marketing rules, Prosper Healthcare may send you direct marketing communications about our Services.
You can opt out of marketing at any time by using the unsubscribe link in a marketing message, updating your preferences where available, or contacting us at info@prosperhealthcare.co.uk.
Service-related communications are not marketing. We may still send you necessary service messages relating to your account, consultations, prescriptions, payments, safety notices, legal obligations or clinical care.
6 Registration and verifying your identity
6. Registration and verifying your identity
In order to use Prosper Healthcare Services, you may be required to register and create a secure online patient record.
We reserve the right to suspend or terminate access at any time if we reasonably believe that your continued use of the Services may prejudice us, other users, clinical safety, system security, regulatory compliance, or the safe operation of the Services.
By registering to use Prosper Healthcare Services, you confirm that:
– the information you provide is accurate, complete and up to date;
– you are aged 18 or over, or aged 16 or over for Emergency Hormonal Contraception where that Service is expressly made available to individuals aged 16 or over;
– you will keep your username, password and login details confidential;
– you will take reasonable steps to protect your online patient record;
– you will not share your login details with anyone else;
– you will not register more than once or create an account for another person unless we expressly permit this.
Verifying your identity
We use Stripe Identity to help verify that patients are genuine and to support fraud prevention, patient safety and regulatory compliance. This may be required for some Services and may take place at your first applicable order, where your details change, or where further verification is reasonably required.
Where applicable, the information you provide at registration, checkout or identity verification may be validated by Stripe Payments Europe, Ltd. Stripe Identity may involve checking identity documents, matching identity information and, where applicable, facial verification.
Stripe may process your personal data in accordance with its own privacy notice where it acts independently, and in accordance with our instructions where it processes data on our behalf.
Stripe can be contacted at:
Stripe Payments Europe, Ltd.
1 Grand Canal Street Lower
Grand Canal Dock
Dublin
D02 H210
Ireland
By registering with us and using our Services, you confirm that:
– Stripe and/or its appointed agents may carry out necessary identity verification processes, including validation of identity documents and facial matching where applicable;
– the information you provide is complete, true and correct to the best of your knowledge;
– you have read our Privacy Notice and understand that identity verification data may be processed for fraud prevention, patient safety, regulatory compliance and service security.
Please view our Privacy Notice for further information on how we use your personal data.
7 Our commitment to you
Each of our pharmacist prescribers commits to:
- a) Professional responsibility
Take professional responsibility for each patient who uses Prosper Healthcare services to the standards of prescribers in the UK. - b) Compliance
Provide a professional service of the same standard regardless whether it is a remote services or face to face service. - c) Provide identification
At the start of the consultation, your prescriber will provide you with their name and General Pharmaceutical Council professional registration number. - d) Prescribe in the best interests of the patient
Medication will only be prescribed or not prescribed by the judgement of the prescriber. The prescriber will make their decision in the patient’s best interest and hold the right to refuse to treat if deemed inappropriate or unsafe. The following list of medications will not under any circumstances be issued by Prosper Healthcare prescribers:
- Medication listed as controlled medication from the BNF including schedule 1-5 including sedative and hypnotics, strong painkillers or anxiolytics; and
- Medication that require specialist prescribing or medication that requires monitoring, this includes interactions with other medication which may then require monitoring; and
- Medication used to treat conditions not listed on the website.
8 Your commitments when using Prosper Healthcare Services
As the patient, you commit to:
– Only register for yourself and do not attempt to register more than once.
– Answering all questions from questionnaires, remote Services, or face to face truthfully and admitting if unsure and must not attempt to mislead the prescribing decision.
– Making us aware if there are any changes to your medical records.
– Only taking medication as directed by prescriber instructions.
– Contacting us if you are uncertain about administration, dosage or have any other concerns.
– Not sharing any medication which has been prescribed for your use only.
– Respecting the decision of the prescriber.
– Treating staff members with respect. We will not tolerate any abusive or aggressive behaviour to any of our staff members. If behaviour is deemed abusive or aggression, we have the right to terminate your account.
9 Notifying healthcare providers
As part of registration to Prosper Healthcare Services, you have agreed we can notify your GP of your treatment including diagnosis and medication provided by us. This is important for safety, transfer and continuity of care. You have the option to opt out of this service but you will have the responsibility to contact your GP.
You will be notified and be advised when your care is deemed not within the competency of the prescriber and a referral to an appropriate healthcare provider is required. However, in specific situations such as an emergency situation your information may be provided without your consent to social services or emergency services. Some examples where this may happen if we thought there was a safeguarding concern involving themselves or another party, if a patient was at immediate risk to themselves or others and if a serious crime has occurred or may occur.
10 Information and advice
The information and advice provided by Prosper Healthcare will be based on the information you have provided from questionnaires, face to face consultations or remote Services. You accept it is your responsibility to ensure this information is accurate and up to date. We are not responsible for the consequences of medication prescribed if you fail to intentionally or not provide information which can affect your care. You agree to only follow the advice given by the prescriber and not what is on the website, which is for information use only.
11 Subscription service
Some of the conditions being treated can fall into a subscription service if repeated medication is required.
By signing up to our subscription service, you agree to be charged the repeat payment of the specified amount from the payment card you used when signing up to the service. This is known as a Continuous Payment Authority. If your payment fails and you do not update your card details when prompted, your repeat prescription will automatically be terminated. You can cancel your plan at any time by contacting our administration team and you will not be charged a cancellation fee. However, if a prescription has been reviewed and sent to a pharmacy when you attempt to cancel, you may still be charged for that specified payment. Our prescribers have the right to review your suitability for your subscription plan at any given time and can terminate your plan if they deem you unsuitable for the service. For patient safety, it is mandatory for you to complete medication review of your treatment. Depending on your condition this will vary in length but will be known to you at the start of your treatment. If you choose not to engage or complete review questionnaire before your next treatment is due, your plan will be automatically terminated and you will be notified of this.
12 Pricing
All prices on this website are in pounds sterling and include VAT unless stated otherwise.
We take care to ensure that all pricing information on our website is accurate but occasionally there may be an error. We guarantee to refund the difference if an error has occurred, and a higher price is charged.
13. Placing and cancelling an order
An order is placed by either booking a consultation service or completing a questionnaire via our remote Services. The latter will assess the appropriateness and suitability of any medication before it being prescribed. You have the right to cancel a consultation service three days prior to the date of consultation or in the case of our remote Services before the questionnaire has been reviewed by our pharmacist without incurring any charge. After this period, you will have no legal right to cancel your order under The Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, as it will be deemed as a completed consultation.
14. Concluding a binding contract
On receipt of an order from you to purchase services from us, we will confirm that we have received the order by sending a confirmation email to the contact email address that you supplied. Your order is an offer to purchase a service and will not be binding on us until either prescribe your medicine, commence a clinical service or consultation, whichever occurs first. The quantity of medication prescribed or the frequency of ordering before a review consultation required will be dependent on condition and prescribers judgement and discretion. The prescriber’s decision may be based on the best interest of the patient, legal restrictions and good practice. The decision must be respected. The director also reserves the right to reject any order if suspicious activity is suspected.
15. Payment and refunds
In providing payment card details, you confirm that you are authorised to use the card and authorise us, or our payment service provider, to take payment in full for the items in your order and any associated delivery fees and any other charges that become due to us under these terms and conditions. The transaction will appear on your bank or card statement as ‘Prosper Healthcare’.
Refunds, if applicable, will only be made using Stripe to the card originally used for payment. Refunds may take up to five working days to appear on a card statement.
All of our prescriptions are valid for six months from the prescription date. If you request another prescription due to your prescription being out of date, you will be charged for a new consultation fee to determine the appropriateness of the medication.
If you choose to pay via Stripe, then your use of the service is governed by the Stripe user agreement in force from time to time. Please refer to the Stripe user agreement for details of the terms and conditions applicable to payments and refunds processed through Stripe.
Where payment by bank transfer is preferred, please make payment to:
Account name: Asclepius Wellbeing Ltd
Sort code: 30-98-97
Account number: 83618960
16. Authorisation of orders for medicines
Prosper Healthcare prescribers requires all relevant information to make a decision for the patient. For the first consultation for a new condition previously not assessed by Prosper Healthcare, there is a requirement either a face to face consultation or remote consultation must take place before medication is issued. This can be with or without a filled questionnaire. You must complete any further information requested by the prescriber for repeat authorisation if requested.
17. Choosing to collect or delivery medication (participated delivery pharmacy)
Prosper Healthcare has the facilities to send a prescription to any pharmacy in the UK securely and safely. The service user should advise the prescriber their pharmacy preference and the prescriber will then be restricted to send a prescription to your nominated pharmacy directly. In the event of a face to face consultation a paper prescription can be printed and given to the patient.
Prosper Healthcare is not responsible of the service of your chosen pharmacy delivery of order or collection service. It is the responsibility of the patient and chosen pharmacy to ensure the patient can receive medication and start their treatment within an appropriate time period without causing a delay which may worsen their health.
Prosper Healthcare has not partnered, have a contract or benefit from using any services from any pharmacies. If you have participated in a subscription service, you will be notified via email when a prescription has been sent to your nominated pharmacy.
If your chosen pharmacy does not have the item in stock, we have the option for another pharmacy to dispense the medication or a suitable alternative can be prescribed if appropiate. It is your duty to inform us if an item is unavailable or the pharmacy can respond.
If you have chosen Prosper Healthcare to deliver your medicines, it is your duty to confirm the address before ordering a medication.
18. Refunds and your right to cancel
- No refund will be given for cancellation of consultations relating to medicines within three days or if medication has been assessed regardless if it has been prescribed.
- For any other item which is not medicine related and thereby not covered under section 13 but requires us to provide a service alone you have the right to cancel up to three days after payment. However, where we have already begun to provide that service at your request, you will still be liable for costs relating to the service we have already provided.
19. Our right to cancel
Prosper Healthcare reserves the right to cancel a consultation or refuse supply in the following circumstances:
(a) We cannot verify your identity;
(b) Insufficient information regarding past medical history;
(c) You are determined not eligible to use our services;
(d) Payment issue including payment decline.
You are responsible for providing sufficient information as to your identity and when agreeing to book a consultation. A refund in these cases is non-refundable. A refund to payment card used for the original transaction is available for scenarios (c) and (d).
In the event a prescriber deciding not to diagnose or treat a condition, this decision will be fully documented in patient record. This can be obtained by the patient upon request.
20. Prosper Healthcare and Asclepius Wellbeing Ltd
Prosper Healthcare Services are operated by Asclepius Wellbeing Ltd, and Asclepius Wellbeing Ltd has no liability to you in respect of your use of the service. You agree that any claim you make in connection with Prosper Healthcare Services will only be brought against Prosper Healthcare Medical Services.
21. Our liability to you
Prosper Healthcare accepts full clinical responsibility for all its patients to the full extent that the law requires. We will not be liable for any loss or damage (in contract negligence or otherwise) where:
There is no breach of a legal duty of care owed to you by us; or
The loss or damage is not a reasonably foreseeable result of any such breach; or
Any loss or damage or increased risk of loss or damage results from a breach by you of these Terms and Conditions.
We are not responsible for:
- loss or damage caused by you providing inaccurate or incomplete information;
- loss of your emotional well-being including, but not limited to, any embarrassment caused;
- loss of income or anticipated profits;
- loss of opportunity;
- loss of goodwill or injury to reputation;
- losses suffered by third parties; or
- any indirect, consequential, special, or exemplary damages arising from the use of the service regardless of the form of action.
Nothing in these Terms and Conditions excludes or limits our liability for death or personal injury caused by our negligence or for fraud or fraudulent misrepresentation. Nothing in these Terms and Conditions affects your statutory rights.
22. Information on this website
The content on our website relating to medication, conditions and services is provided to the general public for information purposes only. We will endeavour to maintain this to the best of our ability, however, with new guidelines and medication constantly being reviewed and a constant improvement in our Services, on occasions you may find this information slightly outdated. It is therefore vital the patient only follows specific directions from the prescriber instead.
23. Links from website and clinic software
A link will be provided to your email address for ID verification, questionnaires and payment. These links are safely provided.
24. Use of Prosper Healthcare Services outside of the United Kingdom
Prosper Healthcare Services make no claims or representations that any or all of the content on this website, or the Prosper Healthcare Services may be lawfully viewed, downloaded or used outside the United Kingdom. Unless otherwise expressly stated, the content, this website and the Prosper Healthcare Services are directed solely at users who access the Service from within the United Kingdom. If you choose to use the Service from outside of the United Kingdom you do so at your own risk and are responsible for compliance with the laws of our jurisdiction. We provide our services in accordance with UK laws and regulations and cannot guarantee that this will comply with the rules of the country where you are located. If you are not a UK resident, then you must be located in the UK at the time of your medical consultation.
25. Third party rights
Nothing in these Terms and Conditions is intended to, nor shall it confer a benefit on any third party under the Contracts (Rights of Third Parties) Act 1999 and a person who is not a party to these Terms and Conditions has no rights to enforce them.
26. Waiver
No delay or decision not to enforce rights under these Terms and Conditions will constitute a waiver of the right to do so and will not affect rights in relation to a subsequent breach.
27. Governing law
These Terms and Conditions are subject to the Laws of England and Wales and each of us hereby submits to the non-exclusive jurisdiction of the English and Welsh courts.
WE RESERVE THE RIGHT TO CHANGE THESE TERMS AND CONDITIONS AT ANY TIME. THE NEW VERSION WILL BE POSTED ON THIS WEBSITE AND WILL TAKE EFFECT IMMEDIATELY UPON POSTING.
IF YOU USE THIS WEBSITE AFTER THE NEW TERMS AND CONDITIONS HAVE COME INTO EFFECT, YOU WILL BE INDICATING YOUR AGREEMENT TO BE BOUND BY THE NEW TERMS AND CONDITIONS.
privacy policy
PRIVACY NOTICE
Asclepius Wellbeing Ltd, trading as Prosper Healthcare
Version last updated: 16 May 2026
1. WHO WE ARE AND IMPORTANT INFORMATION
This privacy notice explains how Asclepius Wellbeing Ltd, trading as Prosper Healthcare, collects, uses, stores and shares personal data when you use our website, CRM, online patient record, consultations, prescription services, identity verification, payment services and related healthcare services.
Asclepius Wellbeing Ltd is a company incorporated in England and Wales under company number 12380227. Prosper Healthcare is a trading name of Asclepius Wellbeing Ltd.
For the purposes of UK data protection law, Asclepius Wellbeing Ltd is the controller responsible for your personal data.
Our contact details are:
Prosper Healthcare
77 Avondale Road
Kettering
NN16 8PL
Email: info@prosperhealthcare.co.uk
For data protection matters, please contact our data protection contact at:
info@prosperhealthcare.co.uk
This privacy notice is intended to inform you how and why we process your personal data. It does not create a blanket consent to all processing. Where we rely on consent for a specific use of your data, we will ask for that consent separately.
We may ask you to confirm that you have read this privacy notice when creating an account or using our services.
Our services are generally intended for individuals aged 18 or over, except where we expressly provide a service to individuals aged 16 or over, such as Emergency Hormonal Contraception, in accordance with applicable law, professional standards and safeguarding requirements.
This website may include links to third-party websites, plug-ins and applications. We do not control those third-party websites and are not responsible for their privacy notices. When you leave our website, we encourage you to read the privacy notice of every website you visit.
2. THE PERSONAL DATA WE COLLECT ABOUT YOU
Personal data means any information about an individual from which that person can be identified.
We may collect, use, store and share the following types of personal data:
Identity Data
This may include your first name, last name, username or similar identifier, date of birth, sex, gender where relevant to clinical care, NHS number where provided, passport number, driving licence number or other identity document information.
Contact Data
This may include your email address, telephone number, postal address, delivery address and billing address.
Health Data
This may include your GP details, medical history, consultation notes, questionnaire responses, symptoms, diagnoses, medication history, allergies, prescriptions, treatment decisions, clinical communications, patient notes, test results where applicable, and any other information relating to your health, care or medical status.
Identity Verification Data
This may include information used to confirm your identity, such as identity document details, images, verification results, fraud checks, facial matching information where applicable, and verification status. Where biometric data is processed for the purpose of uniquely identifying you, it may be treated as special category data under UK data protection law.
Financial Data
This may include information needed to process payments through our payment provider. We do not usually store full payment card details ourselves.
Transaction Data
This may include details of services, consultations, prescriptions, products, orders, payments, cancellations, refunds and related communications.
Technical Data
This may include your internet protocol address, login data, browser type and version, time zone setting and location, device information, operating system and platform, cookies, security logs, session data and other technology identifiers from the devices you use to access our website or services.
Usage Data
This may include information about how you use our website, online patient record, CRM, forms, questionnaires, services and communications.
Communication Data
This may include messages, emails, telephone call records, support requests, complaints, feedback, service messages and records of contact with us.
Marketing Data
This may include your preferences in receiving marketing from us and your communication preferences.
We may monitor and record communications with you, including telephone calls and emails, for training, quality assurance, fraud prevention, patient safety, dispute resolution and compliance purposes.
Please do not provide personal data about other people unless this is necessary for your care, you have authority to do so, or you are asked to provide it for a valid healthcare, safeguarding, emergency or legal reason.
3. HOW WE COLLECT YOUR PERSONAL DATA
We collect personal data in the following ways:
Directly from you
You may give us personal data when you:
– create an account;
– complete a medical questionnaire;
– book or attend a consultation;
– request a prescription or healthcare service;
– provide identity verification information;
– make a payment;
– contact us by email, phone, post or online form;
– provide feedback, complaints or reviews;
– subscribe to communications;
– update your online patient record;
– apply to work with us.
Automatically from your device
When you use our website or services, we may automatically collect Technical Data and Usage Data using cookies, server logs and similar technologies.
From third parties
We may receive personal data from third parties such as:
– identity verification providers, including Stripe Identity;
– payment providers, including Stripe;
– pharmacies;
– GP practices or other healthcare providers;
– laboratories or diagnostic providers where applicable;
– IT, hosting, security and communications providers;
– analytics providers;
– fraud prevention and security providers;
– regulators, professional bodies or public authorities where applicable.
If you provide false or inaccurate information, or if we suspect fraud, we may record this and may be unable to provide services to you.
4. HOW WE USE YOUR PERSONAL DATA
We will only use your personal data where the law allows us to.
The lawful bases we may rely on under Article 6 UK GDPR include:
Performance of a contract
Where processing is necessary to provide services you have requested or to take steps before entering into a contract with you.
Legal obligation
Where processing is necessary for us to comply with legal or regulatory obligations.
Legitimate interests
Where processing is necessary for our legitimate interests or the legitimate interests of another person, provided your rights and freedoms do not override those interests.
Consent
Where you have given consent for a specific purpose, such as certain marketing communications or specific processing where consent is required.
Vital interests
Where processing is necessary to protect someone’s life or prevent serious harm.
Public task or public interest
Where applicable, for certain healthcare, safeguarding or regulatory purposes.
Special category data, including health data
Health data and some identity verification data may be special category data. Where we process special category data, we must have both an Article 6 lawful basis and an Article 9 condition.
The Article 9 conditions we may rely on include:
– processing necessary for the provision of health or social care, diagnosis, treatment, prescribing, pharmacy services or the management of health services;
– processing by or under the responsibility of healthcare professionals subject to confidentiality obligations;
– explicit consent, where required for a specific purpose;
– processing necessary to protect vital interests where a person cannot give consent;
– processing necessary for reasons of substantial public interest, such as safeguarding or preventing fraud, where applicable;
– processing necessary for legal claims or regulatory matters.
We may use your personal data for the following purposes:
To create and manage your account
We use Identity Data and Contact Data to register you, create your online patient record, authenticate you, manage your login and provide account access.
To provide healthcare services
We use Identity Data, Contact Data, Health Data, Communication Data and Transaction Data to assess your medical questionnaire, provide consultations, make clinical decisions, issue or decline prescriptions, provide advice, manage follow-up care, and keep clinical records.
To verify your identity
We use Identity Data, Contact Data and Identity Verification Data to confirm that you are a genuine patient, prevent fraud, support patient safety and comply with legal, regulatory and professional requirements.
To process payments and refunds
We use Identity Data, Contact Data, Financial Data and Transaction Data to process payments, subscriptions, refunds, invoices and related financial administration.
To communicate with you
We use Contact Data, Identity Data, Health Data and Communication Data to send service messages, appointment information, prescription updates, safety notices, account notifications, support replies and other service-related communications.
To share relevant information with healthcare providers
We may use and share relevant Health Data, Identity Data and Contact Data with your GP practice, chosen pharmacy or another healthcare provider where this is necessary for safe care, continuity of care, prescribing, safeguarding, emergency care or legal/professional obligations.
To manage safeguarding, urgent risks or emergencies
We may use and share relevant personal data where necessary to protect you or another person from serious harm, including where there are safeguarding concerns, risk to life, risk of serious injury, risk to others, or where required by law.
To administer and secure our website, CRM and systems
We use Technical Data, Usage Data, Identity Data and audit logs to keep our systems secure, prevent unauthorised access, monitor activity, investigate incidents, test and maintain our systems, and protect clinical records.
To comply with legal, regulatory and professional obligations
We may use Identity Data, Contact Data, Health Data, Transaction Data, Communication Data and audit records to comply with obligations relating to healthcare, prescribing, pharmacy regulation, accounting, tax, complaints, professional standards, insurance, data protection, security and legal claims.
To improve our services
We may use Usage Data, Technical Data, feedback and anonymised or aggregated data to improve our website, services, patient experience, security and clinical workflows.
To send marketing communications
We may use Identity Data, Contact Data and Marketing Data to send marketing communications where we are permitted to do so. You can opt out of marketing at any time.
To manage complaints, disputes and legal claims
We may use relevant personal data to investigate complaints, respond to requests, manage disputes, protect our legal rights and comply with regulatory or professional requirements.
5. IDENTITY VERIFICATION AND STRIPE
We use Stripe Identity and Stripe payment services where applicable.
We may use Stripe Identity to verify that patients are genuine and to support fraud prevention, patient safety and regulatory compliance. This may involve checking identity documents, matching identity information and, where applicable, facial verification.
Where applicable, the information you provide at registration, checkout or identity verification may be validated by Stripe Payments Europe, Ltd. Stripe may process your personal data in accordance with its own privacy notice where it acts independently, and in accordance with our instructions where it processes data on our behalf.
Stripe can be contacted at:
Stripe Payments Europe, Ltd.
1 Grand Canal Street Lower
Grand Canal Dock
Dublin
D02 H210
Ireland
Please read Stripe’s privacy notice for further information on how Stripe processes personal data.
6. MARKETING
Service messages are not marketing
We may send you service-related messages where these are necessary for your account, consultations, prescriptions, orders, payments, safety notices, legal obligations or clinical care. You cannot opt out of essential service-related communications while you continue to use our services.
Direct marketing
We will only send direct marketing where we are permitted to do so under data protection and electronic marketing rules. This may include information about Prosper Healthcare services that may be relevant to you.
Third-party marketing
We will not sell your personal data. We will not share your personal data with third parties for their own direct marketing unless you have given express consent.
Opting out
You can ask us to stop sending marketing messages at any time by:
– using the unsubscribe or opt-out link in a marketing message;
– updating your marketing preferences where available;
– contacting us at info@prosperhealthcare.co.uk.
Where you opt out of marketing, we may keep a suppression record so that we know not to send you marketing in future.
7. COOKIES
Our website may use cookies and similar technologies to operate the website, improve functionality, understand usage and support security.
Some cookies are essential for the website and online patient record to work. Other cookies may be used for analytics or optional features.
For more information about the cookies we use, please see our Cookies Policy:
www.prosperhealthcare.co.uk/cookies-notice
8. WHO WE SHARE YOUR PERSONAL DATA WITH
We may share personal data where necessary with:
– pharmacies;
– GP practices;
– other healthcare providers involved in your care;
– laboratories or diagnostic providers where applicable;
– identity verification providers, including Stripe Identity;
– payment providers, including Stripe;
– IT, hosting, cloud infrastructure and security providers;
– email, SMS, telephone and communications providers;
– professional advisers, including accountants, auditors, insurers and lawyers;
– regulators and professional bodies;
– law enforcement or public authorities where required or permitted by law;
– fraud prevention and security organisations;
– third parties involved in a business sale, transfer, merger, restructuring or acquisition.
We use trusted IT infrastructure and hosting providers to operate our website, CRM, databases, backups, security monitoring and related services. These may include Amazon Web Services for cloud hosting, database, storage, backup and security infrastructure, and 20i for public website/front-end hosting where applicable.
Where 20i provides website or application hosting for any part of the service, it may process limited technical, hosting, log or service data necessary to provide that hosting.
Where third parties process personal data on our behalf, we require them to process it only on our documented instructions, keep it secure, and not use it for their own purposes.
Before engaging third-party service providers, we carry out appropriate due diligence and put in place contractual, technical and organisational controls where required.
We may also disclose personal data where necessary to comply with a legal obligation, enforce our Terms and Conditions, protect patients, protect our rights, investigate misuse, prevent fraud, respond to security incidents or protect the rights, property or safety of Asclepius Wellbeing Ltd, our patients, staff or others.
9. INTERNATIONAL TRANSFERS
Our primary patient data hosting is configured to use UK-based AWS infrastructure where practical, including the AWS Europe London Region where selected for database and storage services.
Some support, security, analytics, supplier or sub-processor activity may involve access from, or transfer to, locations outside the UK.
Where personal data is transferred outside the UK, we use appropriate safeguards required under UK data protection law. These may include UK adequacy regulations, UK GDPR-compliant data processing terms, contractual protections, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or other approved transfer mechanisms as applicable.
10. DATA SECURITY
We use technical and organisational measures designed to protect personal data, including:
– HTTPS/TLS encryption for data transmitted through the website;
– role-based access controls;
– secure sessions;
– CSRF protection;
– security headers;
– audit logging;
– restricted access to clinical records;
– supplier security controls;
– backups;
– encryption where appropriate;
– monitoring and investigation of suspected security incidents.
Public website/front-end services may be hosted through 20i, while CRM application data, databases, backups and related cloud infrastructure may be hosted through Amazon Web Services.
Where 20i provides website or application hosting for any part of the service, it may process limited technical, hosting, log or service data necessary to provide that hosting.
Access to personal and clinical data is restricted to authorised users who have a business, clinical, legal or operational need to access it.
We maintain audit logs to help monitor access to sensitive records, investigate security events and support clinical governance.
We have procedures to deal with suspected personal data breaches. Where legally required, we will notify affected individuals and the Information Commissioner’s Office or other relevant regulator.
Where you have chosen a password that enables you to access parts of our website or online patient record, you are responsible for keeping that password confidential. Please do not share your password with anyone.
Although we take steps to protect personal data, transmission of information over the internet cannot be guaranteed to be completely secure. You should ensure that any device you use to access our website or online patient record is appropriately protected.
11. DATA RETENTION
We will only keep personal data for as long as necessary for the purposes for which it was collected, including for legal, regulatory, professional, clinical safety, accounting, reporting, audit and security purposes.
To decide how long to keep personal data, we consider:
– the nature and sensitivity of the data;
– the purposes for which we process it;
– the risk of harm from unauthorised use or disclosure;
– legal, regulatory and professional requirements;
– clinical safety and continuity of care;
– complaints, disputes and legal claims;
– whether the data can be anonymised instead of retained.
Clinical and patient records
We retain clinical records, consultation records, prescribing records, communications and treatment information in accordance with legal, regulatory, professional and clinical safety requirements. In general, patient records are retained for at least 10 years unless a longer period is required or justified, or a different period applies to a specific type of record.
Financial and transaction records
We keep financial and transaction records for as long as necessary for accounting, tax, audit, fraud prevention and legal purposes.
Marketing records
We keep marketing preferences and suppression records for as long as necessary to respect your choices and avoid sending unwanted marketing.
Technical and security logs
We keep technical, audit and security logs for periods appropriate to security monitoring, incident investigation, compliance and system integrity.
Backups
Personal data may remain in encrypted or protected backups for a limited period until those backups are overwritten or deleted in accordance with our backup procedures.
Anonymised data
In some circumstances, we may anonymise personal data so that it can no longer identify you. We may use anonymised data indefinitely for research, statistics, analytics, service improvement and reporting.
12. YOUR LEGAL RIGHTS
Subject to exemptions and limits under data protection law, you may have the following rights:
Right of access
You can request a copy of the personal data we hold about you.
Right to rectification
You can ask us to correct personal data that is inaccurate or incomplete.
Right to erasure
You can ask us to erase personal data where it is no longer necessary for us to retain it. This right is not absolute. We may need to keep clinical, transaction, security or legal records for legal, regulatory, professional, clinical safety, audit or record-keeping reasons.
Right to restriction
You can ask us to restrict processing of your personal data in certain circumstances.
Right to object
You can object to processing where we rely on legitimate interests, direct marketing, or certain public interest grounds.
Right to data portability
Where applicable, you can request that we provide certain personal data in a structured, commonly used and machine-readable format.
Right to withdraw consent
Where we rely on consent, you can withdraw that consent at any time. This will not affect processing that took place before consent was withdrawn.
Right to stop marketing
You can ask us to stop sending marketing communications at any time.
Account closure or suspension
You may ask us to close or suspend your account. If your account is closed or suspended, you may no longer be able to access the online patient record. We may still retain clinical, transaction, audit and legal records where required or justified.
How to exercise your rights
To exercise your rights, please contact:
Prosper Healthcare
77 Avondale Road
Kettering
NN16 8PL
Email: info@prosperhealthcare.co.uk
No fee usually required
You will not usually have to pay a fee to exercise your data protection rights. However, where a request is manifestly unfounded or excessive, or where you request further copies of information already provided, we may charge a reasonable fee based on administrative costs or refuse to comply with the request where permitted by law.
What we may need from you
We may need to request information from you to confirm your identity and ensure that personal data is not disclosed to someone who is not entitled to receive it.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take longer if your request is complex or you have made several requests. In that case, we will notify you and explain the reason for the delay.
13. COMPLAINTS
Please contact us first if you have any concerns about how we use your personal data. We will review and investigate your concern.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection matters.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk
14. CHANGES TO THIS PRIVACY NOTICE
We may update this privacy notice from time to time.
Any changes will be posted on our website and, where appropriate, notified to you by email or through your account.
Historic versions can be obtained by contacting us at:
info@prosperhealthcare.co.uk
15. YOUR DUTY TO KEEP INFORMATION UP TO DATE
Please keep us informed if your personal data changes during your relationship with us.
It is important that the personal data we hold about you is accurate and current, especially information relevant to your identity, contact details, GP details, medical history, allergies, medication, prescriptions and treatment.