Privacy Policy

Last Updated: 27 February 2026

This privacy notice for GetScanned Ltd, trading as CoreVitals and GetScanned (“we”, “us”, or “our”), explains how and why we collect, store, use and share (“process”) personal information when you use our services (“Services”), including when you:

• Visit our websites at https://uk.getscanned.me/ or https://www.corevitals.me, or any website of ours that links to this privacy notice;
• Book scans or blood tests, attend consultations, or access results via our Platform; or
• Engage with us in other related ways, including sales, marketing, or events.

This privacy notice is intended to describe our processing under United Kingdom data protection laws, including the UK GDPR and the Data Protection Act 2018 (each as amended from time to time, including by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations 2003 (as amended), and other related legislation

Summary of Key Points

Questions or concerns?

If you do not agree with our policies and practices, please do not use our Services. If you have questions or concerns, please contact us at [email protected].

What personal information do we process?
We process personal information depending on how you interact with the Services and what you choose to book or use.

Do we process any sensitive personal information?
Yes. Where necessary to provide the Services, we process health information (special category personal data) and (where relevant) payment information.

Do we collect any information from third parties?
Yes. Depending on the Service you use, we may receive information from our clinical and operational partners (for example, scan centres, radiologists, diagnostic laboratories, and phlebotomy providers) to deliver Services and provide results.

How do we process your information?
We process personal information to provide and administer the Services, communicate with you, provide access to results and consultations, keep systems secure, prevent fraud, and comply with legal obligations.

Do you transfer or allow access to information internationally?
We are UK-based. Some members of our operations and development team are located in India and may access personal information strictly on a need-to-know basis with appropriate safeguards. Details are set out in Section 6.

How do we keep your information safe?
We apply appropriate technical and organisational measures. However, no system can be guaranteed to be 100% secure.

What are your rights?
Depending on your location (including the UK/EEA/Switzerland), you may have rights to access, correct, delete, restrict or object to processing, and other rights explained in Section 12.

TABLE OF CONTENTS

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
4. AUTOMATED PROCESSING
5. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
6. CROSS-BORDER TRANSFERS
7. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
8. HOW LONG DO WE KEEP YOUR INFORMATION?
9. HOW DO WE KEEP YOUR INFORMATION SAFE?
10. SERVICES USED BY CHILDREN / MINORS
11. ANONYMISED AND AGGREGATED DATA
12. WHAT ARE YOUR PRIVACY RIGHTS?
13. CONTROLS FOR DO-NOT-TRACK FEATURES
14. DO WE MAKE UPDATES TO THIS NOTICE?
15. HOW TO MAKE A PRIVACY COMPLAINT
16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

ANNEXURE A — Clinical and Operational Partners

ANNEXURE B — List of Sub-processors

1. WHAT INFORMATION DO WE COLLECT?

1. Personal information you disclose to us

We collect personal information you provide to us.

For example, we collect personal information you voluntarily provide when you create an account, book Services, attend consultations, request support, or otherwise contact us.

Personal information may include (depending on the Service):

• Names
• Phone number
• Email address
• Mailing address
• Contact preferences
• Account / authentication data
• Billing address and payment details (where applicable)
• Date of birth
• Insurance information (where applicable)
• Service details (e.g., scan type; appointment preferences)

Where a parent or legal guardian books Services for a child, we may also collect personal information about the child as necessary to deliver the Services.

2. Sensitive information (special category personal data)

Where necessary to provide the Services, and where permitted by applicable law, we process:

• Health information (e.g., biomarkers, results, reports, referrals, clinical notes, imaging and related metadata); and
  
• Financial information (e.g., payment details) where applicable.
  

1. Information automatically collected

Some information is collected automatically when you use our Services.

We automatically collect certain technical information when you visit, use, or navigate the Services (for example: IP address, device/browser characteristics, operating system, language preferences, referring URLs, country/location, and usage information). This information helps maintain security and operation of our Services, and supports analytics and reporting.

Automatic data may include:

• Log and Usage Data (e.g., timestamps, pages viewed, actions taken, error reports)
  
• Device Data (e.g., device identifiers, browser type, ISP/mobile carrier, OS)
  
• Location Data (precise or imprecise depending on your device/settings; you can disable location sharing, but some features may be affected)

2. HOW DO WE PROCESS YOUR INFORMATION?

We process personal information to provide and administer Services, communicate with you, keep systems secure, and comply with law.

We process personal information for purposes that include:

• To deliver and facilitate delivery of Services (including bookings, scheduling, results access, and consultations).
• To respond to enquiries and provide support.
• To send administrative information (service messages, changes to terms/policies, operational updates).
• To fulfil and manage orders and payments (where applicable).
• To maintain platform security, prevent fraud, and troubleshoot.
• To address urgent outcomes and protect vital interests where necessary (for example, urgent clinical results requiring immediate contact and follow-up).
• To comply with legal obligations and to establish, exercise or defend legal claims.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

We process personal information only where we have a lawful basis under UK Data Protection Laws. Where we process health information, we also rely on a special category condition.

Where we rely on legitimate interests as our lawful basis, we will carry out a Legitimate Interests Assessment (LIA) to ensure that our interests are not overridden by your rights and interests.

For certain processing activities, in particular, maintaining the security and integrity of our Platform and systems, and preventing fraud and misuse, we may additionally rely on 'recognised legitimate interests' under the Data (Use and Access) Act 2025. Processing for these purposes does not require a separate balancing test, but we continue to apply appropriate safeguards and to process only the minimum information necessary.

Activities where we may rely on recognised legitimate interests include:

• Keeping our systems and networks secure and detecting, preventing, and investigating misuse or fraud;
• Logging and monitoring access to systems that hold sensitive personal information; and
• Ensuring the integrity and availability of the Platform.

Where we process health information, including biomarker results, HL7 reports, scan images, scan reports, referrals, and clinical notes,  we do so primarily on the basis of Article 9(2)(h) UK GDPR, as processing necessary for the purposes of preventive medicine, medical diagnosis, the provision of health care or treatment, and the management of health care systems and services, carried out under the responsibility of GetReal Health Limited, a CQC-registered provider, and the health professionals it engages (Schedule 1, paragraph 2, Data Protection Act 2018). GetScanned Ltd operates under contractual obligations of confidentiality to GetReal Health Limited in respect of all health information processed in this context..

Depending on the context, we may additionally or alternatively rely on one or more of the following conditions, as set out in the table below.

Explicit consent (Article 9(2)(a))

Although GetScanned's primary Article 9 condition is Article 9(2)(h), we may in some circumstances additionally seek your explicit consent — for example, where a specific use of your health information falls outside the scope of the health care services you have booked, or where we consider it appropriate to do so as a matter of good practice. Where we rely on explicit consent, you can withdraw it at any time by contacting us. Withdrawal of consent does not affect the lawfulness of any processing already carried out on that basis, and does not affect our ability to continue processing under Article 9(2)(h) or any other applicable condition.

Professional confidentiality obligations

Article 9(2)(h) requires that processing be carried out subject to obligations of professional secrecy. The health professionals engaged in delivering the Services are subject to professional and regulatory confidentiality obligations under applicable law and their respective regulatory frameworks. GetScanned Ltd is contractually bound to equivalent obligations of confidentiality by virtue of its arrangements with GetReal Health Limited. Strictly need to know

We only process health information where necessary for the Services you have requested, and we restrict access to health information on a strict need-to-know basis, including within our own organisation and across our clinical and operational partners.

Processor note (business customers)

Where we act as a processor for a business customer, the customer is responsible for identifying and communicating the applicable Article 6 lawful basis and Article 9 condition(s) for their processing. We process personal information in accordance with the customer's documented instructions and the terms of the applicable Data Processing Agreement.

4. AUTOMATED PROCESSING

We do not make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects on you.

Our platform provides an interactive visual representation of your blood test results as uploaded by you or our laboratory partners. This display function, including any visual indicators such as out-of-range markers, is a presentation tool only. It does not constitute a clinical decision, medical advice, or a diagnosis, and is not intended to be relied upon as such. All clinical interpretation is carried out by qualified healthcare professionals as part of the Services you have booked with such healthcare professionals. For more information, read our General Terms and Conditions.

5. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We share personal information only as needed to deliver Services, operate our Platform, and meet legal and safety obligations. We may share personal information with:

Where you book a scan, we may share the necessary information with the scan centre (and their radiologists) to arrange appointments, complete safety checks, perform the scan, and generate scan reports. We may receive scan images and reports back from the scan centre (typically via secure clinical transfer tools used in healthcare settings).

Where you book a blood test, we may share the necessary information with relevant providers to arrange kits, appointments, nurse visits (if applicable), sample processing and results reporting. We may receive results back (including HL7 reports) for display in our systems and to enable clinical review.

We may make relevant information available to the clinician(s) involved in your consultation(s) so they can provide consultations, explain results, and make recommendations. Access is granted on a strict need-to-know basis.

We use vendors who support hosting, communications, customer support, security, analytics, collaboration tools and other operational functions. These providers process personal information only on our instructions and subject to contractual safeguards. A list of key providers is set out in Annexure “B”.

We may share personal information where required for a merger or acquisition, to comply with law, respond to lawful requests, or to protect rights, property and safety.

6. CROSS-BORDER TRANSFERS

We are based in the United Kingdom. However, some of our operations and development team are located in India and may access personal information on a controlled basis.

Personal information we process may be accessed from the United Kingdom and, where required for operational support or product development, from India.

Our India-based team members are employees of GetScanned Ltd (not third-party providers). They access personal information only where required for their role and only through controlled systems.

We apply appropriate technical and organisational measures to protect personal information accessed from India, including (as applicable):

• role-based access controls and least-privilege permissions;
• access approvals and need-to-know limitations;
• strong authentication and secure access methods;
• logging and monitoring of access; and
• secure development and change-management practices.

Some service providers listed in Annexure B may process personal information outside the UK.

When transferring personal information outside the United Kingdom, we comply with applicable UK data protection law, including the requirements introduced by the Data (Use and Access) Act 2025. In particular:

• Where the Secretary of State has made an adequacy regulation determining that a third country, territory, or international organisation ensures a level of protection for personal information that is not materially lower than that provided under UK data protection law, we may transfer personal information to that destination on that basis.
• Where no such adequacy regulation applies, we use appropriate safeguards, including the UK International Data Transfer Agreement (UK IDTA) or the UK Addendum to the EU Standard Contractual Clauses (UK Addendum to SCCs), as approved by the Information Commission, to ensure personal information transferred outside the UK receives an equivalent level of protection.

You may request more information about the applicable transfer mechanism by contacting us

Where we provide Services to a business customer and act as a processor, the customer’s principal agreement will address the relevant international access/transfers position. Where required for restricted transfer elements, we will enter an appropriate UK transfer mechanism with the customer (for example, the UK IDTA or the UK Addendum to the EU SCCs), together with appropriate technical and organisational controls.

7. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

We may use cookies and similar technologies.

We use analytics cookies (including Google Analytics) to understand how our Services are used, monitor performance, and improve user experience. Under the Data (Use and Access) Act 2025, analytics cookies that are low-risk and do not involve tracking across third-party sites may be used without your prior consent, provided we make it easy for you to opt out.

You can opt out of Google Analytics tracking at any time by visiting: https://tools.google.com/dlpage/gaoptout

For more information on the privacy practices of Google, please visit the Google Privacy & Terms.

8. HOW LONG DO WE KEEP YOUR INFORMATION?

We keep personal information for as long as necessary for the purposes described, unless a longer period is required or permitted by law.

We retain personal information only for as long as necessary to fulfil the purposes set out in this notice, unless a longer retention period is required or permitted by law (e.g., tax/accounting, regulatory, or legal requirements). Where deletion is not immediately possible (e.g., backups), we will securely store and isolate the data until deletion is possible.

9. HOW DO WE KEEP YOUR INFORMATION SAFE?

We apply organisational and technical measures to protect personal information.

We use appropriate and reasonable technical and organisational security measures designed to protect personal information. We may publish and update certain security-related  information available on our website from time to time.

However, no electronic transmission or storage can be guaranteed to be 100% secure. You use the Services at your own risk and should access them from a secure environment.

10. SERVICES USED BY CHILDREN / MINORS

Our Services are primarily designed for use by adults. However, a parent or legal guardian may book certain Services for a child.

We recognise that children merit specific protection when their personal information — including health information — is processed, given that they may be less aware of the risks involved and of their rights. In accordance with the Data (Use and Access) Act 2025 and UK GDPR, we take the following approach when designing and operating Services that may involve children:

• We apply privacy-by-design principles to limit data collection to what is strictly necessary to deliver the booked Service;
• Access to children's personal information (including health information) is restricted on a strict need-to-know basis;
• We do not use children's personal information for marketing or profiling purposes; and
• We apply additional safeguards when processing children's health information, including audit logging and access approvals.

Where a parent or legal guardian books Services for a child, we may collect and process:

• The parent/legal guardian's contact and account details; and
• The child's information necessary to deliver the Services (which may include health information such as scan results or biomarker data).

By booking Services for a child, the parent or legal guardian confirms that they:

• Are the child's parent or legal guardian (or otherwise have authority to make the booking); and
• Have authority to provide the child's personal information to us and to the relevant clinical and operational partners involved in delivering the Services.

If we become aware that a child's personal information has been provided to us without appropriate parental or legal guardian authority, we will take reasonable steps to investigate and, where appropriate, delete or restrict access to the information. To raise a concern, contact [email protected].

11. ANONYMISED AND AGGREGATED DATA

We may permanently transform health information into an anonymised form so it can no longer be used to identify you. We use anonymised and aggregated insights to improve our Services.

“Anonymised” means information has been processed so that it can no longer identify you, and we do not attempt to re-identify you. Where information remains capable of being linked back to you (for example, via a key), it is not anonymised and continues to be treated as personal information.

Once information has been genuinely anonymised in accordance with the standard described above, it is no longer personal information and falls outside the scope of UK data protection law, including the UK GDPR and the Data (Use and Access) Act 2025. We apply this standard consistently and do not treat pseudonymised data (where a key could link information back to you) as anonymised.

Where we use anonymised or aggregated information for research or analytical purposes, this may include commercial research and product development purposes. In all cases, we apply safeguards to minimise the risk of re-identification, including data minimisation, access controls, and restricting outputs to aggregated or statistical formats. We do not attempt to re-identify anonymised information.

12. WHAT ARE YOUR PRIVACY RIGHTS?

If you are located in the UK/EEA/Switzerland, you may have rights under applicable data protection laws, which may include:

• access to your personal information;
• rectification;
• erasure;
• restriction;
• objection;
• data portability (where applicable); and
• withdraw your consent (where applicable).

You can exercise your rights by contacting us using the details in Section 16. You also have the right to lodge a complaint with the Information Commission (formerly the Information Commissioner's Office / ICO) at www.ico.org.uk if you believe we are unlawfully processing your personal information.

Marketing opt-out: You can opt out of marketing emails at any time (unsubscribe link or contact us). We may still send service-related communications.

13. CONTROLS FOR DO-NOT-TRACK FEATURES

We currently do not respond to Do-Not-Track signals because no uniform standard has been adopted. If a standard is adopted that we must follow, we will update this notice.

14. DO WE MAKE UPDATES TO THIS NOTICE?

We may update this notice from time to time. The updated version will be indicated by an updated “Last Updated” date. If we make material changes, we may notify you via the Services, by email or by other appropriate means.

15. HOW TO MAKE A PRIVACY COMPLAINT (Internal Complaints Procedure)

We take privacy complaints seriously and are committed to resolving them promptly and fairly.

If you have a concern about how we have handled your personal information, please contact us in writing:

• Email: [email protected]
• Post: GetScanned Ltd

Jactin House

24 Hood Street

Ancoats M4 6WX

Please include your name, contact details, a description of your concern, and (if applicable) what outcome you are seeking.

We will acknowledge receipt of your complaint within 30 days of receiving it. We will then investigate your complaint and aim to provide a substantive response as quickly as reasonably practicable.

If you are not satisfied with our response, or if we fail to respond within a reasonable period, you have the right to escalate your complaint to the Information Commission (formerly the ICO) at any time:

• Website: www.ico.org.uk 
• Telephone: 0303 123 1113
• Post: Information Commission, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Making a complaint to us does not affect your right to complain directly to the Information Commission at any time.

If you are a resident in the United Kingdom, we are the 'data controller’ of your personal information. We have appointed Adil Mohammed to be our representative in the UK.

You can contact our representative directly regarding our processing of your information, by email or post, using the same contact details above.

16. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

Depending on applicable law and your location, you may have the right to:

• Request access to the personal information we hold about you (a 'Subject Access Request' or SAR);
• Request correction of inaccurate or incomplete personal information;
• Request deletion or restriction of your personal information; or
• Exercise any other right set out in Section 12.

How to make a request

To make a request, please contact us at:

• Email: [email protected]
• Post: GetScanned Ltd

Jactin House

24 Hood Street

Ancoats M4 6WX

Please include your full name, contact details, and a clear description of what you are requesting so we can locate the relevant information and respond effectively.

How we respond

We will respond to your request within one calendar month of receiving it. Where your request is complex or we receive a high volume of requests, we may extend this period by up to a further two months; if so, we will notify you within the first month.

Where we need clarification or additional information from you to process your request, we may pause the response period until we receive what we need. We will contact you promptly to explain what information is required.

We will search for your personal information in a reasonable and proportionate manner, having regard to the nature and scope of your request.

Verification

To protect your privacy, we may need to verify your identity before processing your request. We will ask for the minimum information necessary to do so.

No fee

We do not usually charge a fee for subject access requests. However, we reserve the right to charge a reasonable administrative fee, or to decline a request, where it is manifestly unfounded or excessive.

This table describes parties involved in delivering scans/bloods/consults. Many of these will be independent controllers for their own clinical services. Where they process personal information based on our instructions, they are our processors.

This Annexure details the list of Sub-processors material to GetScanned’s provision of the Services. Depending upon a Customer’s use of the Services e.g. geographical location of the Customer and the type of Services used, not all Sub-Processors will be needed to deliver the Services.