Privacy policy

Who we are

Good Egg Medical Ltd ("Good Egg Medical", "we", "us") is the controller of the personal information described in this policy. We are registered in England and Wales under company number 11200575. Our registered office is Banbury House, 121 Stonegrove, Edgware HA8 7TJ. We are registered with the Information Commissioner's Office under registration number ZB175297.

For any question about this policy or your information, email hello@goodeggmedical.co.uk or call 020 8125 7003.

What this policy covers

This policy explains how we handle personal information when you use our website, contact us or book a call, attend one of our training courses, or use our event medical cover or health check services.

Information we collect

• Enquiries and call bookings: your name, email address, phone number, organisation, team size, the course or service you're interested in, your message, the page you came from and any campaign tags in the link you followed.
• Training courses: learners' names and contact details, attendance and assessment results, the information our awarding bodies need to register learners and issue certificates, and certificate dates so we can remind you before they expire.
• Access and health needs on courses: if you tell us about a health condition, pregnancy or access need so we can adjust the course or assessment, we use that information only for that purpose.
• Health checks: your contact details, date of birth, medical history, measurements, samples and test results.
• Event medical cover: details of anyone we assess or treat at an event, including their clinical record.
• Billing: contact and invoicing details for the person or organisation paying.
• Website use: if you accept analytics and advertising cookies, information about how you use our website (see our cookie policy). Our hosting providers also keep short-term technical logs, such as IP addresses, for security.

How we use it, and our lawful basis

• To reply to enquiries and hold the calls you book: taking steps at your request before entering into a contract, or our legitimate interests in responding to business enquiries.
• To deliver training, register learners with the awarding body and issue certificates: performing our contract with you or your employer, and complying with awarding body requirements.
• To remind you or your organisation when certificates are due for renewal: our legitimate interests. You can opt out at any time.
• To provide health checks and event medical care: performing our contract, and for health information, the provision of health care under the supervision of health professionals bound by confidentiality (UK GDPR Article 9(2)(h)). In an emergency we may act to protect someone's vital interests.
• To make adjustments on courses for health or access needs: your explicit consent, which you can withdraw.
• To keep accounts and meet tax, regulatory and legal obligations: legal obligation.
• To understand how our website is used and measure our advertising: your consent, given through our cookie banner.
• To send news by email: only where you've agreed, or where you're an existing customer and we're telling you about similar services. Every email has an unsubscribe link.

Who we share it with

• Awarding bodies: Qualsafe Awards for first aid qualifications and MHFA England for mental health courses, to register learners and issue certificates.
• Your employer, where they booked your training: attendance, results and certificates.
• Other health professionals, such as your GP or the ambulance service, where it's clinically necessary or you've agreed.
• Service providers who act on our instructions and only use information to provide their service to us: website hosting and database providers; network and security providers; email and office software providers; email delivery providers for booking confirmations; accredited laboratories that analyse health check samples; our training records and certification system; accounting and invoicing software; email newsletter software; and, only with your consent, website analytics and advertising measurement providers.
• Regulators, such as the Care Quality Commission, and law enforcement, where the law requires it.

We never sell personal information.

International transfers

Our website database is hosted in the European Union, which the UK recognises as providing adequate protection for personal information.

Some of our other service providers may process information elsewhere, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK–US data bridge for certified organisations) or the UK International Data Transfer Agreement or Addendum to protect your information.

How long we keep it

• Enquiries and call bookings that don't lead to work: 2 years.
• Training records and certificates: 6 years after the course, to meet awarding body requirements and in case of claims.
• Health check and event clinical records: 8 years for adults; for children, until their 25th birthday (or 26th if they were 17 when treated), in line with the NHS Records Management Code of Practice.
• Financial records: 6 years, as required by HMRC.
• Website analytics: up to 14 months.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent you can withdraw it at any time. Some rights have exceptions, for example where we must keep clinical or financial records.

To make a request, email hello@goodeggmedical.co.uk. We'll respond within one month.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

Keeping it secure

We limit access to personal information to the people who need it, use providers with strong security, and encrypt information in transit. Clinical records are handled by registered health professionals under a duty of confidentiality.

Changes to this policy

We'll update this policy when our services or the law change. The date at the top shows when it was last updated.