Privacy Notices

Teladoc Health UK Limited

Privacy Notice – Patients

Effective date: 1 April 2026

Introduction

This is the Privacy Notice for the utilisation of a range of THUK services (“Services”) including:

1.  THUK “Telemedicine” services – access to a range of health services via phone, video, and internet; including GP 24/7, Expert Medical Opinion, Nutrition & Fitness, Mental Health, and Physiotherapy
2.  THUK “MH wellbeing app” services – AI powered chatbot and mental health support app that provides a safe, anonymous space to talk about worries, stress, and feelings of anxiety or depression.

The Services are provided by Teladoc Health UK Ltd, a private limited company registered in England and Wales with registered offices at Floor 5, Aspect House, 84-87 Queens Rd, Brighton and Hove, Brighton BN1 3XE (“THUK”, “We” or “Us”).

When being provided with the Telemedicine and MyStrength services, you (the “Data Subject”, “the Patient”, “You” and “Your”) will be required to provide information about you, including information about your health status which is considered as sensitive information (all together your “Personal Data”).

This Privacy notice describes the kinds of Personal Data we collect about you, why we collect it, how it is collected and how we use it, how we protect it and under what circumstances we share it with third parties. This Notice also describes how you may access the Personal Data and the rights you have concerning your Personal Data. Please review it carefully.

At THUK we are committed to protecting and respecting your privacy. THUK operates globally and iscommitted to full compliance with all applicable laws and regulations of any jurisdiction, and especially the UK General Data Protection Regulation (“UK GDPR”). The Data Controller is THUK.

Fundamental Principles

THUK’s privacy practices comply with UK GDPR which includes the following protections:
• Processing your Personal Data lawfully, transparently, and fairly
• Limiting your Personal Data use to legitimate purposes
• Limiting the processing and storage of your Personal Data to the minimum necessary
• Making sure that the privacy notice is accurate and sufficient
• Maintaining open and transparent privacy policies
• Being accountable to you for processing your Personal Data
• Making sure your consent is informed and easy to withdraw
• Defining and protecting your sensitive/special categories of data
• Ensuring third parties (external doctors) apply similar or equivalent standards of privacy controls where they process your Personal Data on our behalf
• Not transferring your Personal Data outside of the EU unless the recipient has provided appropriate safeguards approved by UK GDPR.
• Giving you the right to concise, timely, comprehensive information regarding our processing of your Personal Data
• Giving you the right to rectify incomplete, inaccurate, unnecessary, or excessive personal data
• Giving you the right to object (where applicable)
• Making sure we have procedures to support your exercising of any data subject rights,
• Applying security measures, including technical and procedural support for integrity, confidentiality and availability must be provided
• Maintaining the confidentiality of your Personal Data even after our relationship with you has terminated.

What Personal Data is Collected and How We Obtain Your Personal Data?

“Personal Data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, contact details or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In addition to these identifiers, Personal Data also includes “Data concerning health” or “Health Data” which means Personal Data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.

THUK collects only Personal Data which is relevant and necessary for the provision of the Services including the operation of relevant software.

It is not mandatory for you to provide your Personal Data. However, should you not provide this information, THUK may not be able to provide you with our Services.

Personal Data You Provide to THUK

During the course of you using the Services, you will provide and THUK will collect your Personal Data. In addition to information regarding personal identification, demographics and contact details Personal Data will be include:

1.  Telemedicine – Where telephone calls, videos, emails, and other communications take place between you and THUK and/or THUK’s service providers these will be recorded and logged. As such, we will collect and maintain all information discussed during such communications including the date and time of the communications, and the contents of the communications.
2. MH wellbeing app – Where you access the MH App or you may decide to participate in certain interactive activities which require assessment of how you are feeling. The app is anonymous.
3. Virtual Faster Pathways (n/a to some clients) – Following your GP consultation and a referral to secondary care is needed, we work with your insurer to ensure eligibility under your policy to speed up diagnostics. Your consent is gained during the process.

Personal Information THUK Collects About You From Other Sources

In connection with the Services, and always upon your prior authorisation, we may collect medical records from your past or current health care providers.

We may also gather Personal Data from local or national authorities for specific purposes or from third party organisations in those cases where you may have accessed our Platforms through a third-party online service.

Purposes for which your personal data is processed and legal basis

THUK collects, processes, and potentially discloses your Personal Data on a lawful basis, as below.

Contractual Obligations

We will use personal data firstly to fulfil any contractual obligations that exist between us and yourself; where we request Personal Data be provided to meet the terms of any such contract you will be required to provide the relevant Personal Data, or we will not be able to deliver the Services you want. In such cases the lawful basis of us processing the Personal Data is that it is necessary for the performance of a contract.

Legitimate Interest

We may also process your Personal Data in accordance with Our legitimate business interests; this is on the considered measure that we need the Personal Data to achieve various reasonable purposes.

Our data processing activities conducted on the lawful basis of legitimate interests are:

(i) To provide you with the Services
(ii) To send notifications on subjects you have subscribed to, or otherwise asked us to keep you informed of
(iii) To improve the quality of the Services, and to better understand our customers’ needs by requesting feedback/testimonials, or we may send survey forms that we ask you to complete
(iv) To allow us to understand the scale and range of our customer base; for statistical analysis and market research
(v) To recognise when customers re-engage with our Services
(vi) To improve our website so content is delivered more efficiently

Legal Obligations

We may also process your Personal Data in order for THUK to comply with our various legal obligations; this might include:

(i) Providing for financial commitments to relevant financial authorities

(ii) Complying with industry regulatory requirements and any self-regulatory schemes

(iii) Carrying out required business operations and due diligence (e.g. administration, security, reorganisations, investment, or corporate/asset sales)

(iv) Cooperating with relevant authorities for reporting criminal activity, or to detect and prevent fraud

(v) To investigate, claim for or defend ourselves against any claims we may receive/interpose inrelation with the provision of the Services

Consent

We may process your Personal Data for the purposes of providing you with the Services subject to your informed consent.

Where we process your Health Data, other than where we have your consent to do so we shall be processing this Health Data on one or more of the following lawful bases:

• It is necessary for the purposes of preventive or occupational medicine, for the assessment of  the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems or pursuant to contract with a health professional
• It is necessary for reasons of public interest in the area of public health such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices
• It is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

THUK may create de-identified information defined as data that does not include your name, address, birth date, or other information that could be used to identify you (the “Anonymised data”) for the purposes of, among others, reviewing or evaluating the performance of our systems in providing the Services, improving the quality or timeliness of our Services, medical research, or demonstration of the reliability of our information management.

Data Retention

THUK will retain your Personal Data as long as it is needed for the provision of the Services to you and after that, for the statutory periods for the only purpose of attending eventual responsibilities that might arise from the provisions of the Services and to comply with applicable laws.

At the end of that retention period, your Personal Data is securely destroyed or permanently deidentified in accordance with Data Protection Laws and Regulations. Such permanently anonymised data is no longer Personal Data and is retained by THUK indefinitely for the purposes as above.

Access to Your Personal Data

We will never share your Personal Data for any purpose other than those strictly necessary for rendering the Services for your benefit (i.e. communication to medical professionals and IT-related partners). In any such cases, we insist that those third parties retained to provide support services to THUK adhere to our Privacy Policy and Principles as well as all applicable Data Protection Laws and Regulations.

Notwithstanding the above, you should be aware that THUK may be called upon to disclose your Personal Data, including your Health Data, by a duly empowered branch of Government or Court in any country in which our patients are citizen.

International Transfers of Your Personal Data

In order to better protect your Personal Data, THUK uses data centres based only in the UK, EU, and the USA. For that reason, your Personal Data may be transferred to the EU and the USA. These international transfers of your Personal Data comply with all the privacy, security and contingency measures and regulations provided by Data Protection Laws and Regulations and take place following either: contractual obligations, temporary adequacy agreement, Standard Contractual Clauses, or other derogation to allow the international transfer of your Personal Data.

Where you travel overseas it may be necessary for us to transfer your Personal Data to clinicians located in the country or the region where you are temporarily located for provision of the Services required.

You should note that in these instances the local data protection regulation applicable to the processing of your Personal Data in that country may differ in the level of protection from that granted by UK regulation, including UK GDPR. We do however confirm that the clinicians we retain to provide our services are required to adhere to our Privacy Policy and Principles as well as all applicable local Data Protection Laws and Regulations.

Security Enforcement

We safeguard your Personal Data with tested and certified technical and organisational security controls. We educate our staff and external doctors on our Privacy Policy and Principles as well as all globally applicable data privacy laws.

Your Data Subject Rights

We strive to keep your Personal Data accurate and current; and we will update or disclose it to you whenever you request us to do so. You are responsible for communicating modifications, rectifications, or additions to your Personal Data in order that THUK may change it accordingly and keep it current.

You are able to access Personal Data held about you and can request corrections or deletions in accordance with relevant regulation and legislation.

When UK GDPR is applicable, you have rights including:
• Right of access
• Right to rectification
• Right to withdraw your consent to the processing of your Health Data
• Right to erasure
• Right to restriction of processing
• Right to object to processing
• Right to data portability

Note that data subject rights would not be applicable to Anonymised data as defined above.

You may exercise your data subject rights by emailing us, indicating your name, what service was used and your telephone number, and attaching your ID (two from: passport, driving licence and utility bill.

AI Transcribing

Teladoc Health uses a medical scribe tool to help clinicians record accurate clinical notes during patient consultations. The scribing tool listens in the background, capturing only the relevant details relating to clinical documentation requirements. These details are then transcribed into text to be sent to your clinician’s Electronic Medical Record system.

Here’s what you need to know:
• Audio file is immediately destroyed post-transcription
• Transcription is redacted of sensitive, personal identifying information received
• The transcript is encrypted – it is not stored in its original form
• Only your clinician can access this content
• If you have any questions or concerns, please ask your clinician during the consultation.

Changes to our Privacy Notices

Please note that our Privacy Notices may be changed by us from time to time to reflect, amongst other things, changing legislation and regulation.

Our contact details