Privacy Policy

Effective Date: 1 January 2026
Review Schedule: This Privacy Policy is reviewed every three to 9 months months.

Approved by: Pauletta Stanton, Chief Executive Officer.

Bymyselfmeds Privacy Policy

At Bymyselfmeds, we are committed to protecting your privacy and handling your personal information with the highest standards of confidentiality, security, and professionalism. As an independent provider of abortion and women’s healthcare services in the United Kingdom, we recognise the sensitive nature of the information you entrust to us and are committed to processing it lawfully, fairly, and transparently.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you access our website, communicate with our team, or receive clinical services from Bymyselfmeds.

Our processing of personal information complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, applicable healthcare legislation, and our professional obligations as a regulated healthcare provider.

Data Controller

The Data Controller responsible for your personal information is:

Company: Bymyselfmeds

Registered Address:
[Registered Office Address]
London
United Kingdom

Email: info@bymyselfmeds.co.uk

Our Commitment to Confidentiality

Your privacy is fundamental to the care we provide.

All information you share with Bymyselfmeds is treated as confidential and is only accessed by authorised members of our clinical, pharmacy, and administrative teams where necessary to provide your care, comply with legal obligations, or ensure the safe operation of our services.

We understand that abortion care is highly personal. Every member of our team is trained in confidentiality, data protection, safeguarding, and professional standards to ensure your information remains secure throughout your care journey.

Information We Collect

Depending on the services you receive, we may collect and process the following categories of personal information.

Personal Identification Information

This may include:

Full name
Date of birth
Postal address
Email address
Emergency or next of kin details (where appropriate)
Identification documents where required to verify eligibility for treatment

Clinical Information

To provide safe and effective healthcare we may collect:

Medical history
Sexual and reproductive health information
Pregnancy-related information
Previous pregnancies and treatments
Medication history
Allergies
Existing medical conditions
Mental and physical health information relevant to your care
Laboratory results
Ultrasound or diagnostic imaging reports
Clinical consultation notes
Prescriptions and treatment records

Communication Records

We may retain records of:

Telephone conversations where appropriate
Emails
Secure online consultations
Messages exchanged through our patient systems
Appointment history
Clinical correspondence
Consent records

Payment Information

Where private healthcare services require payment, we may process information necessary to administer payments securely. Payment card information is handled through secure payment providers and is not stored unless required by law or regulation.

Website Information

When you visit our website, we may automatically collect technical information including:

IP address
Browser type
Device information
Operating system
Website usage statistics
Cookie preferences
Pages visited
Time spent on our website

This information helps us improve our website, maintain security, and enhance the patient experience.

Special Category Personal Data

As a healthcare provider, Bymyselfmeds processes Special Category Personal Data under Article 9 of the UK GDPR.

This may include:

Physical health information
Mental health information
Sexual health information
Reproductive healthcare information
Pregnancy information
Ethnic origin where clinically relevant or required for statutory reporting
Religious or cultural information where relevant to your care
Accessibility requirements

We only collect this information where it is necessary to provide safe clinical care, fulfil our legal obligations, or protect your vital interests.

How We Collect Your Information

We collect personal information directly from you whenever possible. This may occur when you:

Complete an online consultation
Book an appointment
Speak with one of our clinicians or patient care advisors
Contact us by email
Submit medical questionnaires
Provide consent for treatment
Make payment for services
Complete patient satisfaction surveys or feedback forms

Where appropriate and with your knowledge or legal authority, we may also receive information from:

Healthcare professionals involved in your care
Hospitals
Diagnostic laboratories
Pharmacies
NHS services
Other healthcare providers involved in your treatment

How We Use Your Personal Information

Bymyselfmeds processes personal information solely for legitimate healthcare, legal, administrative, and operational purposes. We only collect information that is necessary to provide safe, effective, and compassionate care while complying with our regulatory obligations as a UK healthcare provider.

Your personal information enables our clinicians to assess your medical history, determine your suitability for treatment, prescribe medication where clinically appropriate, monitor your care, and provide follow-up support throughout your treatment journey. It also allows us to communicate with you regarding appointments, consultations, prescriptions, clinical advice, and any additional care you may require.

We may also use your information to maintain accurate medical records, improve the quality and safety of our services, respond to enquiries or complaints, conduct clinical audits, fulfil safeguarding responsibilities, detect and prevent fraud, and comply with applicable legal and regulatory requirements.

Where appropriate, anonymised or aggregated information may be used for service evaluation, quality improvement, clinical governance, statistical reporting, and healthcare planning. This information does not identify you personally and cannot reasonably be used to do so.

Our Duty of Confidentiality

Confidentiality is one of the fundamental principles of healthcare and is central to the services provided by Bymyselfmeds.

All members of our clinical, pharmacy, and administrative teams are subject to strict confidentiality obligations and receive regular training in data protection, information governance, and patient privacy. Access to patient information is restricted to authorised personnel who require it to perform their professional duties.

We recognise that abortion care is highly personal and sensitive. Your information will always be treated with respect, dignity, and discretion. We will never disclose information about your treatment unless we have a lawful basis to do so or you have provided your explicit consent.

Medical Records

Bymyselfmeds is legally required to create and maintain accurate medical records for every patient receiving treatment.

These records form part of your confidential healthcare record and include information relating to consultations, clinical assessments, prescriptions, investigations, laboratory results, treatment decisions, consent, follow-up care, and communications relevant to your healthcare.

Maintaining accurate medical records helps ensure continuity of care, supports clinical decision-making, protects patient safety, and enables us to meet our professional and legal responsibilities.

All medical records are stored securely using appropriate technical and organisational safeguards designed to protect against unauthorised access, accidental loss, misuse, alteration, or disclosure.

Legal Reporting Requirements

Abortion services provided within England, Scotland, and Wales are governed by the Abortion Act 1967 and associated regulations.

As required by law, Bymyselfmeds must submit statutory notifications to the Chief Medical Officer through the Department of Health and Social Care (DHSC) following every abortion carried out under the provisions of the legislation.

This notification is completed using the HSA4 statutory reporting process. The purpose of this reporting is to support national public health statistics, clinical oversight, and compliance with legal requirements.

The statutory notification does not include your name.

However, the information submitted may include your date of birth, postcode, ethnicity, marital status where applicable, gestational age at treatment, treatment information, previous pregnancy history where required, and the legal grounds under which treatment was provided.

This information is processed strictly in accordance with applicable legislation and is used solely for statutory reporting purposes.

Sharing Your Information

Bymyselfmeds will only share your personal information where it is lawful, necessary, proportionate, and consistent with our professional obligations.

Whenever possible, information shared for administrative, statistical, audit, research, or service improvement purposes will be anonymised or pseudonymised so that you cannot be identified.

There are circumstances where identifiable information may need to be shared. These include situations where you have given your explicit consent, where disclosure is required by law, where disclosure is necessary to protect your vital interests or those of another person, where safeguarding obligations apply, or where disclosure is required in the wider public interest.

Information may also be shared where necessary with healthcare professionals involved in your treatment to ensure safe and effective continuity of care.

Who We May Share Information With

Where appropriate, your information may be shared with organisations or professionals involved in providing or supporting your healthcare.

These organisations may include registered pharmacies responsible for dispensing medication, accredited laboratories performing diagnostic testing, hospitals or emergency healthcare providers involved in your care, NHS organisations where continuity of treatment requires communication, regulatory authorities where disclosure is legally required, safeguarding authorities, insurers where applicable, professional advisers, external auditors, legal representatives, and carefully selected technology providers who support the secure operation of our clinical systems.

All organisations processing information on our behalf are required to maintain appropriate security measures and comply with applicable data protection legislation.

Your General Practitioner (GP)

We understand that many patients choose Bymyselfmeds because they value privacy and confidentiality.

We will not routinely inform your GP about your treatment without your knowledge or consent.

However, there are limited circumstances where communication with your GP may be necessary. These include situations where emergency medical treatment is required, where there are serious safeguarding concerns, where disclosure is required by law, or where there is a significant risk to your health or the health of another individual.

Where possible and appropriate, we will discuss this with you before any information is shared.

Lawful Basis for Processing

Bymyselfmeds processes personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable healthcare legislation.

Depending on the circumstances, we rely on one or more lawful bases for processing your information.

These include your consent where this is required, the performance of a contract for healthcare services, compliance with legal obligations, the protection of vital interests, the performance of tasks carried out in the public interest, and our legitimate interests in operating a safe, secure, and effective healthcare service.

Where Special Category Personal Data relating to your health is processed, we rely upon the additional conditions set out within Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018, including the provision of healthcare, public health obligations, safeguarding, and compliance with legal and regulatory requirements.

International Transfers

Bymyselfmeds is committed to ensuring that your personal information remains protected regardless of where it is processed.

As a general principle, we store and process personal information within the United Kingdom. Where personal data is transferred outside the UK or the European Economic Area (EEA), we will only do so where appropriate legal safeguards are in place and the transfer complies with the requirements of the UK General Data Protection Regulation (UK GDPR).

Where international transfers are necessary, we will implement appropriate contractual, technical, and organisational safeguards, including the use of UK International Data Transfer Agreements (IDTAs), recognised adequacy regulations, or other lawful transfer mechanisms approved by the UK Government.

Data Retention

Bymyselfmeds retains personal information only for as long as it is necessary to fulfil the purposes for which it was collected, including providing healthcare services, complying with legal obligations, meeting regulatory requirements, resolving disputes, and protecting our legal interests.

Healthcare records are retained in accordance with NHS Records Management guidance, the Data Protection Act 2018, UK GDPR, Care Quality Commission (CQC) requirements, and any other applicable legislation governing healthcare providers.

The length of time we retain information depends on several factors, including:

The nature and sensitivity of the personal information.
The purpose for which it was collected.
Clinical and patient safety requirements.
Legal and regulatory obligations.
Accounting and taxation requirements where applicable.
Whether there is an ongoing complaint, investigation, legal claim, or safeguarding matter.

Once information is no longer required, it will be securely deleted, anonymised, or destroyed using appropriate methods designed to prevent unauthorised recovery.

Data Security

Protecting patient confidentiality is fundamental to the way Bymyselfmeds operates.

We maintain robust technical and organisational security measures designed to safeguard personal information against accidental loss, unauthorised access, misuse, disclosure, alteration, or destruction.

Our security measures include:

Secure encrypted systems and databases.
Role-based access controls.
Multi-factor authentication where appropriate.
Regular security monitoring and auditing.
Staff confidentiality agreements.
Information governance training.
Secure electronic communication systems.
Physical security measures for any paper records.
Regular review of security policies and procedures.

Only authorised employees, clinicians, pharmacists, contractors, or approved service providers who require access to personal information to perform their professional responsibilities are permitted to access patient records.

All individuals handling patient information are subject to strict contractual and professional duties of confidentiality.

Should a personal data breach occur, Bymyselfmeds has established procedures to investigate, manage, and report incidents where required by law. Where appropriate, we will notify the Information Commissioner’s Office (ICO) and affected individuals in accordance with UK GDPR requirements.

Your Rights Under UK GDPR

Bymyselfmeds respects your rights regarding your personal information.

Under the UK General Data Protection Regulation, you may have several important rights depending on the circumstances of the processing.

Right to be Informed

You have the right to receive clear, transparent, and easily understandable information about how we collect, use, store, and protect your personal information.

This Privacy Policy forms part of our commitment to providing that information.

Right of Access

You have the right to request a copy of the personal information we hold about you.

This includes information relating to your medical records, consultations, correspondence, and the purposes for which your information is being processed.

Right to Rectification

If you believe any information we hold about you is inaccurate, incomplete, or out of date, you may request that we correct or update it.

Maintaining accurate healthcare records is important for your safety and the quality of care we provide.

Right to Erasure

In certain circumstances, you may request that we erase your personal information.

Please note that healthcare providers are often legally required to retain medical records for specified periods. This means we may not always be able to delete information immediately, even where a request is made.

Right to Restrict Processing

You may ask us to restrict how your personal information is processed in certain situations, such as where you believe the information is inaccurate or where you have objected to processing while we consider your request.

Right to Data Portability

Where applicable, you may request a copy of certain personal information in a structured, commonly used, and machine-readable format.

Where technically feasible and legally appropriate, we can also transfer this information directly to another healthcare provider or organisation at your request.

Right to Object

You have the right to object to certain types of processing carried out by Bymyselfmeds, particularly where processing is based upon legitimate interests or is undertaken for direct marketing purposes.

Where an objection is received, we will carefully consider whether we have compelling legitimate grounds to continue processing.

Rights Relating to Automated Decision-Making

Bymyselfmeds does not make clinical decisions based solely on automated processing.

Where any automated technologies assist administrative or operational processes, you retain the right to request human review where applicable.

Subject Access Requests (SAR)

You have the right to obtain confirmation that Bymyselfmeds processes your personal information and to request access to that information.

How to make a request

Subject Access Requests should be submitted in writing by emailing:

info@bymyselfmeds.co.uk

To protect patient confidentiality, we may ask you to provide proof of identity before releasing any information.

We aim to respond to all valid requests within one calendar month.

Where requests are particularly complex or numerous, we may extend this period by up to two additional months where permitted by law. If this occurs, we will explain the reasons for the extension.

In exceptional circumstances, where requests are manifestly unfounded or excessive, we reserve the right to refuse the request or charge a reasonable administrative fee in accordance with UK GDPR.

Cookies and Website Technologies

Cookies

Our website uses cookies and similar technologies to improve functionality, enhance user experience, analyse website performance, and help us understand how visitors use our services.

Cookies may collect information including:

Device type.
Browser information.
IP address.
Website preferences.
Session information.
Anonymous analytics data.

Where legally required, we will request your consent before placing non-essential cookies on your device.

For more detailed information about the cookies we use and how to manage your preferences, please refer to our Cookie Policy.

Third-Party Websites

Our website may contain links to external websites, healthcare resources, payment providers, or third-party platforms for your convenience.

Please note that Bymyselfmeds does not control the privacy practices or content of external websites.

We encourage you to review the privacy policies of any third-party website before providing personal information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legislation, healthcare regulation, technology, or our clinical services.

Policy Review Schedule

This Privacy Policy is formally reviewed every three months, commencing on 1 January each calendar year.

Where significant changes are made, the revised version will be published on our website with an updated effective date.

We encourage patients to review this Privacy Policy periodically to remain informed about how we protect their personal information.

Contact Us

If you have any questions regarding this Privacy Policy or wish to exercise any of your data protection rights, please contact:

Bymyselfmeds

Email: info@bymyselfmeds.co.uk

Right to Lodge a Complaint

If you believe that Bymyselfmeds has not handled your personal information in accordance with applicable data protection laws, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

You may contact the ICO directly if you are dissatisfied with how your personal information has been processed or if you believe your data protection rights have been infringed.

Information Commissioner’s Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

We would, however, appreciate the opportunity to address your concerns before you contact the ICO and encourage you to contact us in the first instance.

Policy Governance

Policy Owner
Chief Executive Officer

Approved By
Pauletta Stanton
Chief Executive Officer
Bymyselfmeds

Policy Status
Approved

Review Frequency
Every three (3) to nine (9) months

Effective Date
1 January 2026

Next Scheduled Review
1st January 2027

This Privacy Policy has been developed to support Bymyselfmeds’ commitment to patient confidentiality, transparency, and compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, Care Quality Commission (CQC) standards, and other applicable UK healthcare legislation.