Privacy Policy

Digi.me Limited operates to enable users of our applications to download, aggregate and store a wide variety of data about them or connected with them, view and review that data in novel ways and, if they so wish, privately share all or parts of that data for service, convenience or reward.

At digi.me, we understand that we have a responsibility to look after your data and to protect and respect your privacy. The digi.me app does not require a user to register in order to use the application and therefore, by default, a user’s personally identifiable information (name, email address etc.) are not known by the company.

Specific Policies Related To External Sources

Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS Digital. NHS Digital is the controller for any personal information you provided to NHS Digital to get an NHS login account and verify your identity and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS Digital (as the “controller”) when verifying your identity. To see NHS Digital’s Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.

Your NHS patient records are obtained by you making use of your right of access under Data Protection legislation. Once downloaded and held within your secure digi.me library, these are your records to own and control and, as such, are exempt from the General Data Protection Regulation (GDPR).

Should you choose to share your NHS information with another organisation, using the digi.me app, this is done at your sole discretion and under the terms of the agreement you enter in to with the 3rd party. The NHS has no role in this transaction.

Your Facebook Data – using Facebook Login you will be able to link your digi.me to your Facebook account and keep a copy of your Facebook Posts and Photos in your digi.me app, enabling you to search, view and share any of them, at any time. In common with all other sources you choose to connect to your digi.me app, digi.me Limited does not keep copies of this data, nor your name or email, nor any other personal data coming from your Facebook account. If you want to remove your Facebook data from your digi.me app, simply visit Settings in the app, tap on your account and then on ‘Remove Account’.

If you are a user of the digi.me application, you can be assured that not only is your data library securely stored, using a high level of encryption, but that we do not have access to it. If you are simply a user of the digi.me applications and you have not separately contacted us for some reason then we will not have collected any personal data about you and you can ignore the rest of this Privacy Notice.

There are however a number of legitimate reasons, outside the use of our applications, why we may have personal data about you and this notice describes how we collect and use that personal data, the reasons why we may need to disclose your personal data to others and how we store your personal data securely, compliant with the GDPR. Digi.me may be both a data controller and a data processor of your personal data.

About us

Digi.me Limited is registered in England and Wales as a limited company under registration number 13632195 and our registered office is at 7 Bower Road, Wrecclesham, Farnham, Surrey GU10 4ST.

Our Data Protection Officer (DPO) is the company’s Chief Financial Officer. If you have any questions regarding this notice or would like further information about the personal data we hold on you and the way in which we may process that data, please email DPO@digi.me.

How we may collect your personal data

We obtain personal data about you when for example you:

• Sign up for our user, business or partner newsletters;
• Sign up as a beta user, a tester, join our insider programme or use Apple Testflight;
• Submit a bug report to us via Instabug or other reporting system or submit a support ticket via Freshdesk or other support system;
• Complete forms on our website;
• Enter a competition, promotion or survey;
• Attend a hackathon or other event;
• Request further information from us on in respect of the services we provide;
• Contact us by email, post, telephone or social media;
• Have a commercial relationship with us as a customer, supplier, business advisor, consultant or other service provider;
• Make an employment application to us.

We may also obtain personal data about you for example from third parties and/or publicly available resources, e.g. Companies House.

The type of data about you we may collect and hold

The data we collect and hold you may include:

• Your personal details such as your name, address, email address, phone numbers, payment information, IP address etc.;
• Your career history or other data if you are making a job application;
• Information on your use of the digi.me application, session data etc.;
• Any communications that have taken place between us;
• Details of contact we have had with you in respect of the actual or proposed provision of services to you or from you;
• Details of any services you have received from us or provided to us;
• Information about any complaints & enquiries you have made to us or us to you;

How we use your data

We use information about you in the following ways:

• To process enquiries, non-disclosure or other agreements or orders you have submitted to us or us to you or for the performance of any contract we have with you or you with us;
• To comply with our legal obligations and any contractual obligations we have with you;
• To provide you with products and services;
• To enable us to review and improve our website, applications and services;
• To provide customer support, including responding to your support requests;
• To administer creditor or debtor accounts and process and track payments;
• To carry out marketing and statistical analysis or where we seek your thoughts and opinions on the services we provide;
• To notify you about changes to our website, terms & conditions, services or prices;
• To process job applications;
• To provide you with information about our products and services that you request from us or which we feel may be of interest to you, provided you have consented to be contacted for such purposes.

We may process your personal data for the purposes of our own legitimate interests provided that those interests do not override any of your own interests, rights and freedoms which require the protection of personal data. This includes processing for marketing, business development, statistical and management purposes.

We may process your personal data for certain additional purposes with your consent. In the limited circumstances where your consent is required for the processing of your personal data then you have the right to withdraw your consent to processing for such specific purposes.

Please note that we may process your personal data for more than one lawful basis depending on the specific purpose for which we are using your data.

In some circumstances we may anonymise or pseudonymise the personal data so that it can no longer be associated with you, in which case we may use it without further notice to you.

We may also process your personal data without your knowledge or consent, in accordance with this notice, where we are legally required or permitted to do so.

Retention of your data

We will only retain your personal data for as long as is necessary to fulfil the purposes for which it is collected. When assessing what retention period is appropriate for your personal data, we take into consideration:

• the requirements of our business and the services provided to you and the services you provide to us;
• any statutory or legal obligations;
• the purposes for which we originally collected the personal data;
• the lawful grounds on which we based our processing;
• the types of personal data we have collected;
• the amount and categories of your personal data; and
• whether the purpose of the processing could reasonably be fulfilled by other means.

We may need to keep your data for up to 7 years after any commercial arrangement has ended in order to satisfy our legal, taxation or accountancy obligations. We may also keep your data for research or statistical purposes. In all cases, your personal data will only be used for the purposes we collected it.

Change of purpose

Where we need to use your personal data for another reason, other than for the purposes for which we collected it, we will only use your personal data where that reason is compatible with the original purposes. Should it be necessary to use your personal data for a new purpose, we will notify you and communicate the legal basis which allows us to do so before starting any new processing.

Who has access to your personal data?

Access to your personal data within our organisation is limited to those who require access in order for us to fulfil the purposes for which we hold that data.

We will share your personal data with third parties where we are required by law, where it is necessary to administer the relationship between us or where we have another legitimate interest in doing so. For the avoidance of doubt, we do not and never shall sell your personal data to third parties for marketing, advertising or other purposes.

“Third parties” includes third-party service providers. The following activities may be carried out by third-party service providers: IT and cloud services, professional advisory services, administration services, marketing services and banking services. All of our third-party service providers are required to take commercially reasonable and appropriate security measures to protect your personal data. We only permit our third-party service providers to process your personal data for specified purposes and in accordance with our instructions.

We may share your personal data with other third parties, for example in the context of the possible sale or restructuring of the business. We may also need to share your personal data with a regulator or to otherwise comply with the law.

We may transfer the personal data we collect about you outside of the EEA where there are adequate measures in place to protect that data.