Privacy Notice

At a glance. We use personal information to operate the MYTRT website, administer accounts and orders, arrange testing and clinical care, support patients, meet legal and regulatory duties, protect our services, and—where permitted—communicate about relevant services. Health information receives additional protection. We use Semble as an electronic patient record system for relevant clinical records. You can contact us at help@mytrt.com or 0800 157 7521.

This Privacy Notice explains how personal information is handled when you visit www.mytrt.com, create an account, make an enquiry, order a product or service, undergo testing, receive clinical care, contact our team, or otherwise interact with MYTRT. It should be read with our Cookie Policy, Website Terms, Terms of Sale and Complaints Policy.

1. Who we are and who is responsible for your information

Elevate Healthcare Group Limited, trading as MYTRT, is registered in England and Wales under company number 16231959. Its registered office is 71–75 Shelton Street, London, England, WC2H 9JQ. Elevate Healthcare Group Limited is the controller for the personal information it uses to operate the MYTRT website, administer accounts, process commerce and payments, provide customer support, manage complaints, and perform its own business and regulatory functions.

Clinical care available through MYTRT is delivered in partnership with MessageGP Limited, company number 13294053. MessageGP Limited’s Head Office is registered with the Care Quality Commission as location 1-19168451673, under provider 1-17195141915, for the regulated activity of treatment of disease, disorder or injury. [1] Where MessageGP Limited determines how and why information is used to assess, advise, prescribe or otherwise deliver regulated clinical care, it acts as a controller for that clinical processing and must meet its own professional and regulatory duties.

Other regulated organisations—including the dispensing pharmacy, diagnostic laboratories and phlebotomy providers—may act as separate controllers for the information they need to perform their professional or statutory functions. Where an organisation acts only on a controller’s documented instructions, it is a processor. If you send a rights request or privacy concern to us that is more appropriately handled by another controller, we will explain this and, where lawful, route it to the appropriate organisation.

Organisation	Principal role	Contact or registration information
Elevate Healthcare Group Limited, trading as MYTRT	Website, account, commercial administration, customer support and its own business processing	help@mytrt.com; 0800 157 7521; company 16231959
MessageGP Limited	Regulated clinical care and associated clinical processing	Company 13294053; CQC provider 1-17195141915; location 1-19168451673
Smartway Pharma Limited	Dispensing and supplying prescribed medicines	10 Lyon Road, London, SW19 2RL; GPhC pharmacy 9010774
Semble Technology Limited	Electronic patient record and clinical practice-management processor	See section 5

2. The information we collect

The information we collect depends on the services you use and may include the following categories.

Category	Examples
Identity and eligibility	Name, title, date of birth, age, sex, identity-verification information and confirmation that you are eligible to use the service
Contact and account	Postal and delivery addresses, email address, telephone number, username, account identifiers, authentication records and communication preferences
Health and clinical	Symptoms, medical and family history, medicines, allergies, lifestyle information, photographs or documents you choose to provide, questionnaire answers, consultation notes, observations, diagnoses, care plans, prescriptions, adverse events and safeguarding information
Testing	Test orders, sample identifiers, collection information, laboratory results, clinician interpretations and reports
GP and healthcare contacts	GP details, regular prescriber, NHS or other healthcare identifiers, emergency contact, and information obtained from or shared with another healthcare professional where lawful
Orders and transactions	Products and services ordered, subscription status, fulfilment, delivery, cancellations, refunds, discounts and correspondence about an order
Payment	Payment status, payment method, transaction and fraud-prevention information. Full card details are ordinarily handled by our payment provider rather than stored by MYTRT
Communications	Emails, calls, contact forms, secure messages, complaints, reviews, support conversations and records of consent or instructions
Technical and usage	IP address, device and browser information, security events, log data, pages and features used, referral information and interaction data
Marketing	Marketing permissions, campaign engagement, source or attribution information, and suppression records used to respect an opt-out
Inferences and risk indicators	Information derived from other data where needed for clinical triage, fraud prevention, service security or patient safety

Information about health, sex life, sexual orientation, racial or ethnic origin, genetics, biometrics used for identification, and certain other sensitive matters is special-category information under UK data-protection law and receives additional protection. [2]

Please avoid sending information that is not relevant to your enquiry or care. If you provide personal information about another person, such as your GP or an emergency contact, you should tell them where appropriate that you have done so and direct them to this notice.

3. Where information comes from

We collect information directly from you when you browse the website, create an account, complete a questionnaire, order a service, provide a sample, attend a consultation, communicate with us, make a complaint, or change your preferences.

We may also receive information from MessageGP Limited and its clinicians; Smartway Pharma Limited; diagnostic laboratories and phlebotomy providers such as Bloods & Beyond, Inuvi Diagnostics, Goodbody Clinics and Clinilabs; payment, identity, fraud-prevention, delivery and communication providers; your GP or another healthcare professional where you have authorised this or another lawful basis applies; and publicly available or regulatory sources where necessary to verify professional, corporate or legal information.

Technical and usage information may be collected automatically through essential logs, cookies, local storage, pixels and similar technologies. Optional analytics and advertising technologies are controlled through our consent platform, as explained in our Cookie Policy.

4. Why we use information and our lawful bases

We must identify a lawful basis under Article 6 of the UK GDPR for every use of personal information. Where we use special-category information, we must also identify a condition under Article 9. [2] The basis depends on the purpose and circumstances; consent is not the only basis for clinical processing and withdrawing marketing consent does not require a clinician to delete a lawful medical record.

Purpose	Article 6 basis	Additional condition for health or other special-category information, where relevant
Create and administer an account; respond to a service request; process orders, payments, delivery, cancellations and refunds	Contract; legitimate interests in efficient administration	Usually not applicable unless health information is involved
Assess suitability, triage, consult, diagnose, prescribe, monitor treatment and coordinate care	Contract; legal obligation; vital interests where necessary	Health or social care under Article 9(2)(h) and applicable UK law; vital interests in a genuine emergency; legal claims where relevant
Arrange and interpret blood tests or other diagnostics	Contract; legal obligation	Health or social care under Article 9(2)(h)
Create, maintain and share an appropriate clinical record, including with a GP or care provider	Legal obligation; contract; legitimate interests in safe, coordinated care	Health or social care under Article 9(2)(h); explicit consent where that is the appropriate basis for an optional disclosure
Dispense and deliver prescribed medicines through the pharmacy	Contract; legal obligation	Health or social care under Article 9(2)(h)
Protect life, manage safeguarding concerns, respond to serious safety incidents or prevent serious harm	Vital interests; legal obligation; recognised or ordinary legitimate interests where applicable	Vital interests; health or social care; substantial public interest where the statutory conditions are met
Provide customer service, secure messaging, accessibility support and complaint handling	Contract; legal obligation; legitimate interests in resolving concerns and improving service	Health or social care; legal claims; explicit consent where appropriate
Meet tax, accounting, medicines, healthcare, data-protection, court, law-enforcement and regulatory duties	Legal obligation; legitimate interests in establishing or defending rights	Legal claims; health or social care; substantial public interest where applicable
Prevent fraud, misuse, cyberattack and unauthorised account access	Legal obligation; legitimate interests in protecting patients, staff, systems and transactions	Legal claims or substantial public interest where the relevant statutory condition applies
Conduct clinical governance, audit, quality assurance, incident review and service improvement	Legal obligation; legitimate interests in safe and effective services	Health or social care under Article 9(2)(h); anonymisation where identifiable data is not required
Send service messages, safety notices, recalls, appointment reminders and important account information	Contract; legal obligation; legitimate interests	Health or social care where the message contains clinical information
Send optional email, SMS or similar marketing	Consent, or the limited electronic-mail “soft opt-in” where the law permits	We do not intentionally use health information for direct marketing without an appropriate, specific basis
Measure website use and personalise or advertise through non-essential technologies	Consent through the cookie banner	We do not intentionally use clinical records for advertising audiences

We may use information for a compatible purpose where data-protection law permits it. If a proposed new purpose is materially different, we will identify a lawful basis and provide additional information before using the data where required.

5. Clinical records and Semble

Relevant clinical information is stored and managed through Semble, a clinical practice-management and electronic patient record system supplied by Semble Technology Limited. Depending on the care pathway, the record may include questionnaires, test results, consultation notes, clinician correspondence, prescriptions, monitoring data, consent records and documents needed for continuity, audit or patient safety.

Semble acts as a processor when it handles information on the instructions of the relevant clinic or clinical controller. Semble states that it hosts data in UK and EU data centres, encrypts data in transit and at rest, and provides role-based access controls, audit logs, two-factor authentication and encrypted backups. [3] These safeguards reduce risk but no electronic system can be guaranteed to be completely secure.

Access to clinical records is limited according to role and need. We may need to share relevant information with your GP, regular prescriber, pharmacy, laboratory or another healthcare professional to provide safe care, meet professional duties or protect life. Where consent is the appropriate basis, we will ask for it. A clinician may be unable to prescribe or continue treatment if essential information cannot lawfully be obtained or shared and the clinician concludes that proceeding would be unsafe.

6. Artificial intelligence and automated tools

We may use artificial-intelligence-assisted tools for limited customer-support, administrative, transcription, routing, fraud-prevention or knowledge-base functions. We design these workflows so that access is limited to information needed for the task, appropriate processor terms and security measures are used, and staff can intervene where necessary.

AI support is not a substitute for a clinician. An AI tool does not independently diagnose, prescribe or make a final decision about treatment eligibility. Clinical decisions are made by appropriately registered professionals. We do not make a decision based solely on automated processing that produces legal or similarly significant effects unless the law permits it and the required safeguards, information and challenge rights are in place.

Please do not submit clinical information to a general website-support tool unless the interface clearly asks for it. Information sent through the clinical pathway may form part of your patient record where appropriate. Further provider-specific information will be made available at the point of use where a tool requires it.

7. Who we share information with

We share only information reasonably needed for the relevant purpose and require an appropriate legal, professional or contractual basis. Recipients may include the following.

Recipient category	Why information may be shared
MessageGP Limited and clinicians	Clinical assessment, prescribing, monitoring, safeguarding, governance and clinical records
Smartway Pharma Limited and relevant pharmacy professionals	Prescription validation, dispensing, medicine supply, safety checks, recalls and pharmacy complaints
Laboratories and phlebotomy providers	Booking, identity and sample matching, analysis, reporting and test-related support
Semble Technology Limited	Hosting and operating the electronic patient record and clinical practice-management system
GP, regular prescriber, specialist, emergency service or other care provider	Safe and coordinated care, verification, continuity, safeguarding or emergency response
Electronic-prescription and clinical-communication providers	Secure transmission of prescriptions and clinical communications where used
Stripe and other payment or fraud-prevention providers	Payment processing, authentication, chargebacks, fraud prevention and financial reconciliation
Delivery, postal and logistics providers	Delivering kits, products or medicines and resolving delivery issues
Cookiebot/Usercentrics, Google, Meta, Amazon components, CAPTCHA providers, social-login providers, analytics and website-service providers	Consent management, website operation, security, optional analytics, social authentication and advertising where permitted
Email, telephony, support and secure-messaging providers	Communicating with users, delivering service messages and managing enquiries
Professional advisers, insurers, auditors and prospective transaction advisers	Advice, insurance, audit, due diligence and protection of legal rights, subject to confidentiality safeguards
CQC, GPhC, GMC, ICO, MHRA, courts, law enforcement, safeguarding bodies and other authorities	Legal or regulatory reporting, inspection, investigation, patient safety and enforcement where required or permitted

We do not sell clinical records. We do not allow advertisers to use your patient record to select advertisements. Some providers act as independent controllers and publish their own privacy notices; their use of information is governed by those notices as well as applicable law.

8. International transfers

Some technology, payment, communications, support, security and analytics providers operate internationally. This means personal information may be accessed from or transferred to a country outside the United Kingdom.

Where UK data-protection law restricts a transfer, the relevant controller will use an approved safeguard. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, another approved mechanism, or a statutory exception that applies to the specific transfer. We assess the transfer and apply supplementary technical or organisational measures where appropriate. You may contact help@mytrt.com for more information about the safeguard used for a relevant transfer.

9. Cookies, analytics and advertising

The website uses cookies and similar technologies, including local storage and pixels. Essential technologies support functions such as security, consent recording, shopping baskets, sessions and payments. Optional technologies may measure use, attribute campaigns or support advertising and are controlled through the Cookiebot consent banner.

Our current scan identifies technologies associated with MYTRT/WooCommerce, Cookiebot, Stripe, hCaptcha, Google, Meta, Amazon payment components, TWIPLA and related attribution tools. The exact list can change as services develop. The automatically updated declaration, purposes, providers and durations are available in our Cookie Policy, where you can also change or withdraw consent.

10. How long we keep information

We keep identifiable information only for as long as reasonably necessary for the purpose, including clinical safety, continuity of care, legal claims, accounting, regulation and evidence that preferences were respected. Retention may be extended where a complaint, investigation, safeguarding concern, litigation hold or public inquiry requires it.

Record type	Normal approach
Adult clinical records	Retained in line with the applicable health and care records code and professional duties. Many adult clinical records are retained for at least eight years after the conclusion of treatment, with longer periods where the record category, ongoing care, safety, law or inquiry requires it. [4]
Prescribing, pharmacy and diagnostic records	Retained by the responsible regulated organisation under the legal and professional schedule that applies to it
Orders, contracts, invoices and core transaction records	Normally six years after the end of the relevant contract or accounting period, unless a longer period is required
Customer-service and non-clinical communications	Normally up to three years after closure; material relevant to care, a complaint, safety or legal rights may be retained with the associated record for longer
Complaints and incidents	Retained for the period required by clinical-governance, insurance, regulatory and legal-claims needs; a care-related complaint may be retained with the clinical record
Marketing preferences	Until consent is withdrawn or the relationship ends, with a limited suppression record kept afterwards so we do not contact you against your wishes
Security and technical logs	Kept for a proportionate security and troubleshooting period, normally up to twelve months unless an incident requires longer preservation
Cookie consent	Kept for the period needed to operate the consent platform and demonstrate the choice recorded; see the Cookie Policy

At the end of the retention period, information is securely deleted, anonymised or put beyond operational use in accordance with the relevant system and record-management process. An erasure request does not override a lawful requirement to preserve a clinical, financial, regulatory or legal record.

11. Security

We use organisational and technical safeguards proportionate to the sensitivity and risk of the information. These include role-based access, authentication controls, encryption where appropriate, secure hosting, logging, backups, staff confidentiality, processor due diligence, incident management and access review.

You are responsible for keeping your account credentials confidential and using a secure device and email account. Contact us promptly at help@mytrt.com if you believe your account or communications have been compromised. Email and ordinary telephone messages may not be appropriate for urgent or highly sensitive clinical information; use the designated clinical channel where directed.

12. Your data-protection rights

Depending on the circumstances, you may have the right to access your personal information; correct inaccurate or incomplete information; request erasure; restrict use; object to processing based on legitimate interests; receive certain information in a portable format; withdraw consent; and ask for human intervention in relation to a qualifying automated decision.

These rights are not absolute. For example, we may need to preserve an accurate clinical record, retain information required by law, protect another person’s confidentiality, or continue processing needed to establish or defend legal claims. We will explain any restriction that applies.

To exercise a right, email help@mytrt.com with the subject “Data protection request” or write to our registered office. Please describe the information or service concerned. We may ask for reasonable evidence of identity and authority before disclosing information. We normally respond within one month, although the law permits an extension for a complex or numerous request; if so, we will tell you.

13. Marketing choices

We may send optional marketing by email, SMS or similar channels where you have consented or where the limited soft-opt-in rules permit it. You can opt out at any time through the unsubscribe control in a message, your available account settings, or by contacting help@mytrt.com.

Opting out of marketing does not stop essential service, safety, prescription, appointment, account or legal messages. Cookie-based advertising preferences are managed separately through the consent banner.

14. Children

MYTRT services are intended for adults aged 18 or over. We do not knowingly offer the service to children. If you believe a person under 18 has created an account or submitted information, contact us so that we can investigate and take appropriate action while preserving any information that must be retained for safeguarding or legal reasons.

15. Contacting us and making a complaint

Questions, rights requests and privacy concerns can be sent to:

Contact method	Details
Email	help@mytrt.com — use the subject “Data protection”
Telephone	0800 157 7521, Monday–Saturday, 8am–6pm
Post	Elevate Healthcare Group Limited, 71–75 Shelton Street, London, England, WC2H 9JQ

Please give us an opportunity to resolve a privacy concern first. Our Complaints Policy explains the process. You also have the right to complain to the Information Commissioner’s Office (ICO). The ICO recommends raising the concern with the organisation first and permits escalation if you remain dissatisfied. [5]

Information Commissioner’s Office: ico.org.uk/make-a-complaint · Telephone 0303 123 1113.

16. Changes to this notice

We review this notice when our services, providers, law or regulatory expectations change. The date and version at the top identify the current notice. If a change materially affects how we use information already collected, we will provide additional notice where required.

References

1. CQC — MessageGP Limited registration information
2. ICO — Special category data
3. Semble — Uncompromising Security
4. British Medical Association — Retention of health records
5. ICO — Data protection complaints