1. Introduction
Welcome to the AMRADNET UK privacy policy. AMRADNET UK respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from), use our diagnostic and teleradiology services, or interact with us as a healthcare partner. It also tells you about your privacy rights and how the law protects you.
Controller Details
AMRADNET UK is made up of different legal entities, including AMRADNET UK LIMITED and AMRADNET UK DIAGNOSTIC SERVICES LTD. This privacy policy is issued on behalf of the AMRADNET UK Group, so when we mention "AMRADNET", "we", "us" or "our" in this privacy policy, we are referring to the relevant company in the Group responsible for processing your data.
AMRADNET UK Diagnostic Services Ltd is the primary data controller for our healthcare services and is registered with the Information Commissioner's Office (ICO) under registration number ZC090506.
Contact Details:
Email address: info@amradnet.co.uk
Phone number: 0203 917 8693
Postal address: Regus, Venture House, Downshire Way, Bracknell, England, RG12 1WA (Registered Office)
2. The Data We Collect About You
Personal data, or personal information, means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
- Identity Data: First name, last name, username, title, and professional credentials (for healthcare professionals).
- Contact Data: Billing address, operational address, email address, and telephone numbers.
- Technical Data: Internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, and platform.
- Usage Data: Information about how you use our website, IT portals, and services.
- Marketing and Communications Data: Your preferences in receiving marketing from us and your communication preferences.
Special Category Data (Health Data)
As a provider of teleradiology and diagnostic capacity services to the NHS and private hospitals, we process medical images, diagnostic reports, and associated patient health data. This data is primarily collected indirectly via our healthcare partners (NHS Trusts, hospitals, clinics) rather than directly through our public-facing website. We process this strictly under the provisions of the UK GDPR relating to the provision of healthcare, medical diagnosis, and treatment.
3. How Is Your Personal Data Collected?
We use different methods to collect data from and about you, including:
- Direct interactions: You may give us your Identity and Contact data by filling in forms on amradnet.co.uk or by corresponding with us by post, phone, email, or otherwise. This includes data provided when you enquire about our services, request a partnership, or seek customer support.
- Automated technologies or interactions: As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies.
- Third parties or publicly available sources: We may receive personal data about you from various third parties, such as analytics providers (e.g., Google), healthcare partners, or publicly available professional registries (such as the GMC).
4. How We Use Your Personal Data
We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
| Purpose / Activity | Type of Data | Lawful Basis for Processing |
|---|---|---|
| To respond to enquiries submitted via our website | Identity, Contact | Performance of a contract with you; Necessary for our legitimate interests |
| To deliver our diagnostic and teleradiology services | Identity, Contact, Health Data (Special Category) | Provision of health or social care (Art. 9(2)(h) UK GDPR); Performance of a contract |
| To manage our relationship with NHS Trusts and partners | Identity, Contact, Marketing | Performance of a contract; Necessary to comply with a legal obligation |
| To administer and protect our business and this website | Identity, Contact, Technical | Necessary for our legitimate interests (provision of IT services, network security) |
| To use data analytics to improve our website and services | Technical, Usage | Necessary for our legitimate interests (to keep our website updated and relevant) |
5. Disclosures of Your Personal Data
We may share your personal data with the parties set out below for the purposes outlined in the table above:
- Internal Third Parties: Other companies in the AMRADNET Group acting as joint controllers or processors, including our US-based parent entities where applicable for operational support.
- External Third Parties, including: service providers acting as processors based in the UK or US who provide IT, cloud hosting, and system administration services; professional advisers including lawyers, bankers, auditors, and insurers; HM Revenue & Customs, the Care Quality Commission (CQC), the ICO, and other regulatory authorities who require reporting of processing activities in certain circumstances; and referring NHS Trusts, hospitals, and clinical partners (strictly relating to patient diagnostic reports).
6. International Transfers
Because AMRADNET operates globally and utilises US-based board-certified radiologists and IT infrastructure, we may transfer, store, and process your personal data outside the UK.
Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
- We transfer data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Government (such as the UK-US Data Bridge).
- Where we use specific service providers, we use specific contracts approved for use in the UK (International Data Transfer Agreements or the UK Addendum to the EU SCCs) which give personal data the same protection it has in the UK.
7. Data Security
We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. This includes end-to-end encryption for all medical imaging transfers and restricted access controls. Furthermore, we limit access to your personal data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a strict duty of confidentiality.
8. Data Retention
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.
- Website interaction data: Typically retained for 12 to 24 months.
- Healthcare/Patient data: Retained in strict accordance with the NHS Records Management Code of Practice and our contractual obligations with referring Trusts.
- B2B Client records: Retained for the duration of the contract plus 6 years for legal and financial compliance.
9. Your Legal Rights
Under the UK GDPR, you have rights under data protection laws in relation to your personal data, including the right to:
- Request access to your personal data (a "data subject access request").
- Request correction of the personal data that we hold about you.
- Request erasure of your personal data.
- Object to processing of your personal data where we are relying on a legitimate interest.
- Request restriction of processing of your personal data.
- Request the transfer of your personal data to you or to a third party.
- Withdraw consent at any time where we are relying on consent to process your personal data.
If you wish to exercise any of the rights set out above, please contact us at info@amradnet.co.uk.
You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.