Privacy Policy

1. General

The Migraine Clinic Ltd (TMC), a company registered in England and Wales under company number 17343112, with its registered office at 65 London Wall, London EC2M 5TU, is the controller of your personal data within the meaning of the UK General Data Protection Regulation (UK GDPR).

We attach great importance to protecting your personal data. We process it carefully and in accordance with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and other applicable law and regulations.

TMC provides its care fully online. Clinical care is provided under the Care Quality Commission (CQC) registration of Until (until.co.uk). TMC, not Until, is the controller of your medical record.

This privacy policy applies to all personal data that TMC processes about patients, website visitors, contacts and other individuals. Our services are for adults aged 18 and over.

2. What personal data do we process?

Patient data

• Name, address, date of birth, telephone number and email address
• Delivery address for any medication
• Proof of identity, where we ask you to verify it
• Health data: diagnosis, treatment history, medication, referral letters, test results and any other information needed for your treatment
• The details of your GP and of any referring specialist
• Payment and transaction data
• Your messages to us and a record of your contact with us

Health data is special category data under the UK GDPR and is given extra protection. If you do not give us the information we ask for, we may not be able to treat you safely, or at all.

Website visitors

• IP address (never stored, see section 10)
• Browser type, operating system and pages visited
• Information you enter in contact forms

3. Where does your data come from?

• From you, when you fill in forms, book, pay or write to us online
• From your GP or another care provider, with your permission, for example a referral letter or your medication history
• From the pharmacy that dispenses and delivers your medication, about the status of your order
• From your device, when you use our website (see section 10)

4. What do we use your data for, and on what basis?

The UK GDPR only allows us to use your personal data when we have a lawful basis. For each purpose, the basis we rely on is:

• Providing care: specialist online migraine care, including assessment, diagnosis, treatment and follow-up. Basis: performance of our agreement with you.
• Medication: passing your prescription and delivery details to the pharmacy that dispenses, packs and delivers your medication, and taking payment for it. Basis: performance of our agreement with you.
• Payment: taking payment, issuing refunds and keeping financial records. Basis: performance of our agreement with you, and legal obligation for our accounting records.
• Legal and regulatory obligations: keeping medical records, verifying your identity where needed, and answering questions from regulators. Basis: legal obligation.
• Communication: answering questions and sending appointment information. Basis: performance of our agreement with you.
• Newsletters and marketing: only if you have signed up. Basis: consent, in line with PECR. You can withdraw it at any time.
• Quality improvement: improving our care and services. Basis: legitimate interests.
• Website analysis: understanding how our website is used so we can improve it. Basis: legitimate interests (see section 10).

For health data we also need a condition under Article 9 of the UK GDPR. We rely on Article 9(2)(h), processing necessary for medical diagnosis and the provision of health care, together with the condition for health or social care purposes in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Your health data is only handled by or under the responsibility of a health professional, or by staff bound by a duty of confidentiality.

Decisions about your treatment are always made by a clinician, never solely by automated means.

5. How long do we keep your data?

• Medical record: 20 years after your last treatment, so that we can answer questions and claims about your care
• Financial records: 7 years after the end of the financial year they relate to, longer than the 6 years UK company law requires
• Website data: a maximum of 26 months
• Newsletter data: until you withdraw your consent

6. Sharing data with third parties

We only share your personal data with third parties when this is necessary for the purposes described above, or when the law requires us to. This includes:

• Until, under whose CQC registration clinical care is provided
• The pharmacy we choose to prescribe, pack and deliver your medication
• Your GP and/or referring specialist (feedback about your treatment)
• Our payment provider
• IT service providers that manage our systems (processors, under a data processing agreement)
• Regulators, such as the ICO and the CQC, and other public authorities where the law requires it

We never sell your data. When we use processors, we always sign a data processing agreement to ensure your data is protected.

7. Transfers outside the UK

Our systems are hosted on our own infrastructure in Amsterdam, the Netherlands. When personal data leaves the UK, we only transfer it to a country covered by UK adequacy regulations, or with an appropriate safeguard in place: the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU standard contractual clauses, both issued by the ICO. You can ask us for more information about these safeguards.

8. Social media integrations

To publish educational content about migraine on our own social media channels, TMC Services B.V., a company in our group, uses the following APIs on behalf of the group:

• Meta (Facebook and Instagram): publishing to our Facebook Pages and Instagram Business accounts, and retrieving aggregated engagement statistics
• TikTok Content Posting API: publishing to our TikTok Business account
• YouTube Data API: uploading videos to our YouTube channel
• LinkedIn (Community Management and Share API): publishing to our Company Page and to the personal profiles of our clinicians
• Google Business Profile API: local posts, managing reviews and retrieving location statistics

What data do we store?

• Authentication tokens for these platforms, stored encrypted on our infrastructure in Amsterdam
• Aggregated post statistics (reach, engagement), with no data about individual users
• Our own published content

What do we not do?

• We do not share data obtained through these APIs with third parties
• We do not process personal data of social media users beyond aggregated statistics
• We do not use this data for advertising targeting

Use of the YouTube API is subject to the YouTube Terms of Service and the Google Privacy Policy.

9. Security

TMC takes appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These include:

• Encrypted connections (SSL/TLS) for all data traffic
• Access control based on role and need
• A secure App for communication between patient and clinician
• Regular backups of systems and data
• Confidentiality obligations for all staff

If a personal data breach occurs, we will report it to the ICO and inform you where the law requires us to.

10. Cookies and website analysis

Our website uses cookies and similar technologies, in line with PECR. We use:

• Strictly necessary cookies: needed for the website to work properly
• One first-party analytics cookie (tmc_vid): a random, meaningless number that lets us recognise that two visits come from the same device. It shows us which channel (search engine, newsletter, advertisement, social media) brings visitors to us. The cookie contains no name, no email address and no information about your health, and lasts a maximum of 400 days (browsers shorten a longer period themselves). We use it only to collect statistics about how our website is used, so we can improve it, which PECR allows as long as we tell you about it and you can object
• No third-party cookies at all: we do not use Google Analytics or advertising pixels, and we do not load external analytics scripts. Nothing is sent to another company when you visit our website

All visit data is processed on our own servers and shared with no one. We never store your IP address: it is read once to determine the country, region and approximate town, and then discarded immediately. We do not store your full browser fingerprint either.

What we do record per visit, linked to the visitor number above: which pages you view and in what order, which website or search engine referred you to us, which links and buttons you click, how long you stay on a page, and your device type (phone, tablet or computer), browser, operating system, language setting and screen size in steps of 100 pixels. Location based on IP address is approximate: on mobile internet it often points to the provider's network hub rather than where you are, so we only ever report locations in groups, never per visitor.

We do not track you across other websites: the visitor number only works on our own website.

You can object at any time, free of charge, by blocking or deleting cookies in your browser settings, or by emailing us. Our website keeps working as normal; we simply no longer count your visit as a returning visit.

11. Your rights

Under the UK GDPR you have the following rights regarding your personal data:

• Right to be informed: about how we use your data, which is what this policy is for
• Right of access: you can ask which personal data we process about you, and for a copy
• Right to rectification: you can ask us to correct inaccurate data
• Right to erasure: you can ask us to erase your data, insofar as this does not conflict with our legal duty to keep medical records
• Right to restrict processing: you can ask us to limit how we use your data
• Right to data portability: you can ask to receive your data in a structured, commonly used and machine-readable format
• Right to object: you can object to the processing of your data
• Rights related to automated decision-making: you have the right not to be subject to a decision based solely on automated processing that significantly affects you
• Right to withdraw consent: you can withdraw consent you have given (for example for the newsletter) at any time

You can submit a request by emailing info@migraine.org. Please include your name, date of birth and the email address of your account, and tell us which right you want to exercise. We will respond within one month of receiving your request.

12. Complaints

Do you have a complaint about how we process your personal data? Please contact us first at info@migraine.org. We will gladly work with you to find a solution.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. You can do so via ico.org.uk/make-a-complaint or by calling 0303 123 1113.

13. Contact details

For questions about this privacy policy or about how we process your personal data, please contact our privacy lead at:

14. Changes

TMC may change this privacy policy. The most recent version is always on this page. If we make a significant change to how we use your personal data, we will tell you by email.