Patient Confidentiality Policy

1. Introduction & Data Controller

MCRx is built, maintained, and operated by AHM Labs Ltd, a private limited company registered in England and Wales. AHM Labs Ltd acts as the "Data Controller" for the personal data processed through our application. For any enquiries regarding your data, privacy, or this policy, you can contact our Data Protection Officer at [email protected].

2. Lawful Basis for Processing (UK GDPR)

We process your personal data under the following lawful bases set out in the UK General Data Protection Regulation (UK GDPR):

• Article 6(1)(b) Contract: To set up your account, process login sessions, and provide the patient directory services you register to use.
• Article 6(1)(f) Legitimate Interests: To verify your legal UK patient status, prevent portal abuse, secure our infrastructure, and comply with the UK MHRA Blue Guide guidelines prohibiting the public promotion of POMs.
• Article 9(2)(a) Explicit Consent (Special Category Data): Because medical cannabis is a controlled drug and prescription medicine, logs in your Therapeutic Dosage Journal, symptom severity ratings, and treatment notes constitute health data ("Special Category Data"). We process this data only after obtaining your explicit consent when you write or edit your journal. You can withdraw this consent at any time by deleting your journal entries or account.

3. Data Retention & Deletion Schedules

We enforce strict retention limits to ensure we do not store your data longer than necessary:

• Account Profile Data: Maintained until you request deletion. Upon a verified request, your profile is flagged and permanently deleted from our primary databases within 30 days.
• Verification Uploads (Prescriptions/Letters): Receipts or clinic documents uploaded to verify your patient status are temporarily held in an encrypted container. They are permanently purged from active storage immediately upon approval or denial. Backups of these transient files are fully overwritten and cleared within 14 days.
• Local-First Logs: Local journal records stored inside your browser's SQLite WASM storage exist solely on your client device and can be cleared instantly by clicking "Reset Local Database" in your dashboard or clearing browser storage.

4. Sub-processors & Infrastructure Partners

We keep patient data localized, but rely on secure infrastructure partners to run our application:

• IONOS Cloud Host: Our primary application servers, PM2 processes, and PostgreSQL database are hosted on secure, virtual private servers located in UK/EU datacenters managed by IONOS.
• Local MailServer Gateway: Transactional registration and verification emails are routed through our self-hosted mailServer container mapping to authorized relays.

5. Your Data Subject Rights

Under the UK GDPR and Data Protection Act 2018, you possess the following rights:

• Right of Access: Request a complete, structured copy of all personal data we store about you.
• Right to Rectification: Ask us to correct inaccurate or incomplete details.
• Right to Erasure (Right to be Forgotten): Request the permanent deletion of your account and verification history.
• Right to Restrict Processing: Request that we suspend processing your data while keeping it stored.
• Right to Data Portability: Obtain your data in a portable, machine-readable format.
• Right to Object: Object to our processing based on legitimate interests.

To exercise any of these rights, email us at [email protected].

6. Complaints to the ICO

If you believe we have processed your data unlawfully, please contact us first so we can resolve the concern. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK data protection supervisory authority: