Privacy notice.

Who we are

Welcome to Card Medic Limited’s Privacy and Data Protection Policy (“Privacy Policy”).

The following terminology applies: “You” and “Your” refers to you, the person using this website, web application and mobile application, and “CardMedic”, “We”, “Our” and “Us” refers to Card Medic Limited (UK) and Card Medic, Inc. (USA) and their respective websites, web applications and mobile applications.

At Card Medic Limited we are committed to protecting and respecting your privacy and Personal Data in compliance with the United Kingdom General Data Protection Regulation (“GDPR”), the Data Protection Act 2018 and all other mandatory laws and regulations of the United Kingdom.

This Privacy Policy explains how we collect, process and keep your data safe. It will tell you about your privacy rights, how the law protects you, and inform our employees and staff members of all their obligations and protocols when processing data.

Whose data we gather and use

The individuals from which we may gather and use data can include:

• •Customers
• •Suppliers
• •Business contacts
• •Employees and staff
• •Members
• •Patients
• •Third parties connected to your customers

And any other people that the organisation has a relationship with or may need to contact. This Privacy Policy applies to all our employees and staff members and all Personal Data processed at any time by us.

Your data controller and our Data Protection Officer

Card Medic Limited is your Data Controller and responsible for your Personal Data.

CardMedic has appointed a Data Protection Officer (DPO) in accordance with UK GDPR requirements for organisations that process health data. The DPO is responsible for overseeing our data protection strategy and compliance, advising on obligations, and acting as a point of contact for data subjects and the ICO.

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Patient data processing

CardMedic processes patient personal data and health (special category) data solely on behalf of healthcare providers and under their documented instructions. We do not collect patient data directly from patients. All processing is carried out in compliance with UK GDPR and the Data Protection Act 2018, using appropriate technical and organisational measures to protect confidentiality and security.

Healthcare providers remain responsible for informing patients about how their data is used and for providing the necessary privacy information. CardMedic acts as a data processor and does not determine the purposes or means of processing patient data.

Where CardMedic processes special category data under conditions set out in Schedule 1 of the Data Protection Act 2018, we maintain an Appropriate Policy Document (APD) as required by law. This document explains how we comply with data protection principles, our retention and erasure policies, and the safeguards we apply to protect sensitive data.

Processing data on behalf of a controller, and processors’ responsibility to you

In discharging our responsibilities as a Data Controller we have employees who will deal with your data on our behalf (known as “Processors”). The responsibilities described below may be assigned to an individual, or may be taken to apply to the organisation as a whole. The Data Controller and our Processors have the following responsibilities:

• •Ensure that all processing of Personal Data is governed by one of the legal bases laid out in the GDPR policy;
• •Ensure that Processors authorised to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• •Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk associated with the processing of Personal Data;
• •Obtain the prior specific or general authorisation of the Controller before engaging another Processor;
• •Assist the Controller in the fulfilment of the Controller’s obligation to respond to requests for exercising the data subject’s rights;
• •Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in the GDPR policy, and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller;
• •Maintain a record of all categories of processing activities carried out on behalf of a Controller;
• •Cooperate, on request, with the supervisory authority in the performance of its tasks;
• •Ensure that any person acting under the authority of the Processor who has access to Personal Data does not process Personal Data except on instructions from the Controller; and
• •Notify the Controller without undue delay after becoming aware of a Personal Data Breach.

Types of data we collect

“Personal Data” means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of Personal Data about you, grouped below. Not all of the following will necessarily be collected from you, but this is the full scope of data that we collect:

• •Profile / Identity Data: your first name, last name, occupation and your image or photograph.
• •Contact Data: your place of work addresses and email addresses.
• •Marketing and Communications Data: your preferences in receiving marketing information and other information from us.
• •Billing Data: information relating to your place of work payment details and related billing addresses.
• •Financial Data: your place of work banking details, for example account number and sort code.
• •Transactional Data: details and records of all payments you have made for our services or products.
• •Technical Data: your IP address, browser type and version, time zone setting and location, operating system and platform, and other technology on the devices you use to engage with us.
• •Customer Support Data: feedback and survey responses.
• •Usage Data: information about how you use our website, products and services.

We also collect, use and share Aggregated Data such as flashcard usage, content usage, content preferences and user types. Aggregated Data could be derived from your Personal Data but is not considered Personal Data in law, as it will not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data.

We may also aggregate data to enable research or analysis so that we can better understand and serve you and others. For example, we may conduct research on your demographics and usage. Although this aggregated data may be based in part on Personal Data, it does not identify you personally. We may share this type of anonymous data with others, including service providers, our affiliates, agents and current and prospective business partners.

The legal basis for collecting that data

There are a number of justifiable reasons under GDPR that allow collection and processing of Personal Data. The main avenues we rely on are:

• •Consent: certain situations allow us to collect your Personal Data, such as when you tick a box confirming you are happy to receive email newsletters from us, or opt in to a service.
• •Contractual obligations: we may require certain information from you in order to fulfil our contractual obligations and provide you with the promised service.
• •Legal compliance: we are required by law to collect and process certain types of data, such as fraudulent activity or other illegal actions.
• •Legitimate interest: we might need to collect certain information from you to be able to meet our legitimate interests. This covers aspects that can be reasonably expected as part of running our business, that will not have a material impact on your rights, freedom or interests.

How we use your personal data

Service communications, notifications and emails

We use your email address and other contact details to send essential communications that are necessary for the operation, support, and improvement of your account and the CardMedic platform. These include, but are not limited to:

• •Account registration confirmations
• •Security alerts, for example password changes or suspicious login attempts
• •Important information regarding your use of the CardMedic platform
• •Legal, policy, or terms of service updates that impact your account
• •Requests for feedback through surveys to help us improve platform functionality and user experience

In addition, we may notify you about updates or changes to the platform that affect functionality or how you interact with the service. These messages are intended to support usability, prevent confusion, and ensure a smooth user experience.

These communications are not promotional. They are sent either as part of our contractual obligation to you or under our legitimate interest to maintain and improve the security, accessibility, and effectiveness of the CardMedic service. As such, you cannot opt out of these emails unless you choose to close your account.

Lawful basis by activity

We will only use your Personal Data when the law allows us to. The table below sets out the different types of Personal Data we collect and the lawful basis for processing that data.

Examples in the table are indicative. The purposes for which we use your data may be broader than described, but we will never process your data without a legal basis for doing so and for a related purpose. For further enquiries please contact us.

Change of purpose

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Your rights and how you are protected by us

What control do I have over CardMedic’s use of my personal data?

Your account information will be protected by a password for your privacy and security. You need to prevent unauthorised access to your account and personal information by selecting and protecting your password appropriately, limiting access to your computer or device, and signing off after you have finished accessing your account.

You can access information associated with your account by logging into the account you created with us.

We do not guarantee the ability to delete all stored data. If you would like us to delete or correct personally identifiable data, let us know and we will action your request as soon as practicable.

California privacy rights

Under California Civil Code sections 1798.83–1798.84, California residents are entitled to ask us for a notice identifying the categories of personal customer information which we share with our affiliates and/or third parties for marketing purposes, and providing contact information for such affiliates and/or third parties. If you are a California resident and would like a copy of this notice, please submit a written request to info@cardmedic.com.

How does CardMedic protect customers’ personal data?

Data protection impact assessments. Where processing is likely to result in a high risk to individuals – including processing of health data at scale – we carry out a Data Protection Impact Assessment (DPIA) in accordance with Article 35 of the UK GDPR, and we support healthcare organisations completing their own DPIA by providing the information they need about our processing, sub-processors, security controls and international transfers.

Personal data breaches. We maintain an incident response process. Where we act as processor, we notify the controller without undue delay after becoming aware of a personal data breach. Where we act as controller, we notify the Information Commissioner’s Office within 72 hours where the breach is likely to result in a risk to the rights and freedoms of individuals, and we notify affected individuals without undue delay where the risk is high.

Security certification. Our technical and organisational measures are assessed against recognised standards, including Cyber Essentials, the NHS Data Security and Protection Toolkit, and the security requirements of the NHS Digital Technology Assessment Criteria (DTAC). Current certification status and supporting evidence are available on request and are set out on our Trust and assurance page.

Sub-processors. We maintain a list of sub-processors used in the delivery of the service. Licensed organisations are notified of material changes to that list in accordance with their agreement with us, and may obtain the current list on request.

We are concerned with keeping your data secure and protecting it from inappropriate disclosure. We implement a variety of security measures to ensure the security of your Personal Data on our systems, including adopting a secure protocol and encrypting our databases using AWS Cognito identity services.

Any Personal Data collected by us is only accessible by a limited number of employees who have special access rights to such systems and are bound by obligations of confidentiality. If and when we use subcontractors to store your data, we will not relinquish control of your Personal Data or expose it to security risks that would not have arisen had the data remained in our possession.

However, unfortunately no transmission of data over the internet is guaranteed to be completely secure. It may be possible for third parties not under the control of Card Medic Limited to intercept or access transmissions or private communications unlawfully. While we strive to protect your Personal Data, we cannot ensure or warrant the security of any Personal Data you transmit to us. Any such transmission is done at your own risk. If you believe that your interaction with us is no longer secure, please contact us.

Opting out of marketing promotions

You can ask us to stop sending you marketing messages at any time by contacting us or unsubscribing.

Where you opt out of receiving these marketing messages, we will continue to retain other Personal Data provided to us as a result of interactions with us not related to your marketing preferences.

How to request your data and the process for obtaining it

You will not have to pay a fee to access your Personal Data, or to exercise any of your other rights. However, if your request is clearly unfounded, we could refuse to comply with it.

We may need to request specific information from you to help us confirm your identity and ensure you have the right to access your Personal Data, or to exercise any of your other rights. This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request, to speed up our response.

Your data and third parties

Will we share your data with third parties?

We may share non-Personal Data with third parties. We may share your Personal Data with subcontractors (only when necessary and with your consent) or affiliates (subject to confidentiality obligations to use it only for the purposes for which we disclose it to them and pursuant to our instructions).

We may share your Personal Data at any time if required for legal reasons or in order to enforce our terms or this Privacy Policy.

Third-party links

The CardMedic website, web application or mobile application may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, web application or mobile application, we encourage you to read the privacy policy of every website you visit.

How long will we retain your data for?

We will only retain your Personal Data for as long as reasonably necessary to fulfil the purposes we collected it for. We may retain your Personal Data for a longer period than usual in the event of a complaint, or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

Age limit for our users

You must not use CardMedic unless you are aged 16 or older. If you are under 16 and you access CardMedic by lying about your age, you must immediately stop using CardMedic.

This website is not intended for children and we do not knowingly collect data relating to children.

International transfer of data

Your information may be stored and processed in the US or other countries or jurisdictions outside the US where Card Medic Limited has facilities. We are currently storing data in the EU and so, by using CardMedic, you are permitting and consenting to the transfer of information, including Personal Data, outside of the US.

CardMedic complies with the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018. UK GDPR is substantively equivalent to the EU General Data Protection Regulation (EU GDPR), as it was incorporated from the EU GDPR framework and maintains the same core principles and obligations for the protection of personal data. Transfers of personal data from the European Union to the United Kingdom are permitted under the European Commission’s adequacy decision for the UK.

Cookies and this website

This website does not use advertising cookies or third-party marketing pixels. We do not build advertising profiles of visitors, and we do not sell or share browsing data.

We do measure how the site is used, so we can improve it, using Google Analytics 4. Under the Privacy and Electronic Communications Regulations that requires your consent, so you will see a short banner the first time you visit, with declining exactly as easy as accepting.

If you decline, or simply ignore the banner, Google Analytics does not load. We do not load it with tracking switched off – we do not load it at all. No Google Analytics request leaves your browser and no analytics cookie is set. Your choice is remembered in your browser's own local storage rather than in a cookie, so declining leaves us with nothing on your device.

You can change your mind at any time using Cookie settings, which also appears at the foot of every page.

What is set, and when

• Analytics, only with your consent. If you accept, Google Analytics 4 sets cookies to recognise a repeat visit and to count pages, referrers, approximate location and rough engagement. We have IP anonymisation enabled, we have not switched on Google Signals or advertising personalisation, and we do not use this data for advertising. Google acts as our processor for this. Data may be processed outside the UK under the transfer safeguards described in international transfer of data above.
• Strictly necessary, regardless of choice. Our hosting provider, Cloudflare, may set a security cookie to protect the site from attack and to keep it available. This is exempt from consent because the site cannot be delivered safely without it.
• Aggregate page counts, with no cookie and no consent required. We use Cloudflare Web Analytics to count page views so we know which pages are read. It sets no cookie, stores nothing on your device, and does not attempt to recognise you or build a record of your visits over time. Because it places nothing on your device it does not require your consent, and because it stores nothing it cannot be used to identify you. It runs whatever you choose about Google Analytics.
• Your own device, not us. Your browser may remember your preferred colour scheme or text size. That stays on your device and is never sent to us.
• How your visit began, for the length of your visit. When you arrive, your browser notes the first page you landed on, any campaign link you followed and the website that referred you. It is held in your browser’s session storage and your browser discards it when you close the tab. It contains no identifier for you, is never used to build a profile or to follow you across other websites, and is never shared. It is only sent to us if you choose to submit an enquiry form – so that we can see which campaign or page led you to get in touch, and reply usefully. If you never submit a form, it never leaves your browser.
• Nothing stored from forms until you submit. When you complete an enquiry form, the information is sent to us and to our CRM at the point you press send. Nothing is captured as you type, and an abandoned form leaves nothing behind.

What we will not do with it

We will not use site analytics to identify you, to follow you across other websites, to build an advertising audience, or to enrich a record about you in our CRM. If we ever want to do something beyond measuring how the site is used, we will update this section before it starts, not after.

You can block or delete cookies in your browser settings at any time. Doing so will not stop this website working.

The CardMedic platform used inside healthcare organisations is a separate matter, governed by the agreement with that organisation and described in patient data processing above.

Notification of changes and acceptance

We keep our Terms and Conditions and Privacy Policy under review and will place any updates on this page. This version is dated 10 September 2026. By using CardMedic, you consent to the collection and use of data by us as set out in these Terms and Conditions and Privacy Policy. Continued access or use of CardMedic will constitute your express acceptance of any modifications.