- Medycheck Appointments (medycheck.com) is an online appointment booking service operated by AcornRX Technologies Ltd for pharmacies.
- We use your details only to book and manage your appointment.
- If a pharmacy connects its Google Calendar, we use that access only to add, update and remove appointments and to check when the pharmacy is busy. We never sell Google data, use it for advertising, or use it to train AI models.
- A pharmacy can disconnect Google at any time, and we then delete its Google access.
- Who we are
- Our role and the pharmacy's role
- Information we collect
- Google user data
- Google API Limited Use
- How we use information
- Lawful bases
- Who we share it with
- International transfers
- How we protect it
- How long we keep it
- Your rights
- Disconnecting Google and deleting data
- Cookies
- Children
- Changes to this policy
- Contact us and complaints
1. Who we are
Medycheck Appointments is a service provided at medycheck.com by AcornRX Technologies Ltd, a company registered in England and Wales (company number 16096500), with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Our website is acornrxtechnologies.co.uk.
In this policy, "we", "us" and "our" mean AcornRX Technologies Ltd. "Pharmacy" means a pharmacy that uses Medycheck Appointments to take appointment bookings. "You" means a person who books an appointment, or a pharmacy user who manages appointments.
2. Our role and the pharmacy's role
- Appointment bookings: the pharmacy you book with decides why and how your booking details are used, so the pharmacy is the controller of that information. We process it on the pharmacy's behalf as its processor, to run the booking service.
- Pharmacy accounts and Google connection: we are responsible for the information a pharmacy gives us to set up and run the service, including the Google Calendar connection described in section 4.
For questions about how a particular pharmacy uses your information, you can contact that pharmacy directly or contact us and we will pass your request on.
3. Information we collect
When you book an appointment
- Your forename and surname
- Your email address and mobile number
- The appointment you chose (type, date, time and duration) and a booking reference
- Any changes you make, such as rescheduling or cancelling
The type of appointment you book (for example, a blood pressure check) can say something about your health. We treat it as sensitive information and use it only to provide your appointment.
When a pharmacy uses the service
- Pharmacy details shown on the booking page, such as name, address, phone number and logo
- Appointment settings, such as opening times, durations and how many people can book each time
- If the pharmacy connects Google Calendar: the information described in section 4
Technical information
- Essential cookies that keep the booking page working securely (see section 14)
- Standard server logs, such as IP address, browser type and the time of a request, used to keep the service secure and fix problems
4. Google user data
A pharmacy can choose to connect its Google account, so that appointments appear in its Google Calendar and customers cannot book times when the pharmacy is busy. This is optional, and only happens when a pharmacy user signs in with Google and agrees on Google's consent screen.
What we access
| Google data | What we do with it |
|---|---|
| The Google account's email address | Shown to the pharmacy so it can see which Google account is connected. |
| Calendar events we create | For each booking we create an event in the pharmacy's calendar with the appointment type, date, time, the patient's name, email and mobile number, the booking reference and the pharmacy's address. We update the event if the booking is rescheduled and delete it if it is cancelled. The customer is added as a guest, so Google emails them the appointment and any changes. |
| The times of the pharmacy's other calendar events | We read the start and end times, and whether each event is marked busy or free, only to work out which appointment times are still available. We do not read, use or store the titles, descriptions, guests or other contents of the pharmacy's own events. |
How we store it
- The access tokens Google gives us are stored encrypted on our servers and used only by our booking service.
- We store the ID of each event we create, so we can update or remove it later.
- We do not keep copies of the pharmacy's other calendar events. Availability is checked when needed and the result is not stored.
What we never do with Google data
- We do not sell it or rent it.
- We do not use it for advertising, including personalised, retargeted or interest-based advertising.
- We do not use it to build profiles, or to determine credit-worthiness or for lending purposes.
- We do not use it to develop, improve or train generalised artificial intelligence or machine learning models.
- We do not transfer it to anyone else, except as needed to provide the booking feature, to comply with the law, for security, or as part of a merger or acquisition with appropriate protections.
- Our staff do not read it, unless the pharmacy asks us to for support, it is needed for security or to investigate abuse, or the law requires it.
5. Google API Limited Use
Medycheck Appointments' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. How we use information
- To show available times and take, change or cancel your booking
- To send your booking details to the pharmacy you booked with
- To send you a booking confirmation and, where the pharmacy has connected Google Calendar, to have Google send you the calendar invitation and any updates
- To stop times being double-booked
- To keep the service secure, prevent misuse and fix problems
- To meet our legal obligations
We do not use your information for marketing, and we do not sell it.
7. Lawful bases
Under UK data protection law (the UK GDPR and the Data Protection Act 2018), we and the pharmacy rely on:
- Contract / steps you ask for: to make and manage the booking you requested.
- Legitimate interests: to run a secure and reliable booking service and prevent double-booking.
- Consent: for the Google Calendar connection, which a pharmacy can withdraw at any time by disconnecting.
- Health information: where an appointment type reveals health information, it is processed for the provision of health care by the pharmacy, in line with Article 9(2)(h) of the UK GDPR, or with your explicit consent.
- Legal obligation: where the law requires us to keep or share information.
8. Who we share it with
- The pharmacy you booked with, so it can provide your appointment.
- Google, only where the pharmacy has connected Google Calendar, to create the calendar event and send you the invitation.
- Service providers who host our servers and send our emails, under contracts that require them to protect the information and use it only on our instructions.
- Authorities, if the law requires it.
We do not share your information with anyone for their own marketing.
9. International transfers
Some of our providers, including Google, may process information outside the UK. Where this happens, we rely on safeguards recognised under UK data protection law, such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
10. How we protect it
- All connections to the service use encryption (HTTPS).
- Google access tokens are encrypted when stored.
- Messages between pharmacy systems and our servers are signed, so they cannot be forged.
- Access to personal information is limited to people who need it to run and support the service.
No system is perfectly secure, but we work to protect your information and will act promptly if a problem occurs, including telling the ICO and affected people where the law requires.
11. How long we keep it
- Booking details: for as long as the pharmacy needs them to provide and record your appointment, and to meet its legal and professional obligations, then deleted.
- Google access tokens: only while the pharmacy stays connected. They are deleted as soon as the pharmacy disconnects, and we stop using them straight away if access is removed in the Google account.
- Calendar events: live in the pharmacy's own Google Calendar. We delete an event when its booking is cancelled; after disconnection the pharmacy controls any remaining events.
- Server logs: kept for a limited period for security, then deleted.
12. Your rights
Under UK data protection law you have the right to:
- be told how your information is used (this policy)
- get a copy of your information
- have inaccurate information corrected
- have your information deleted
- restrict or object to how it is used
- receive your information in a portable format
- withdraw consent where we rely on it, such as the Google connection
To use any of these rights, email info@acornrxtechnologies.co.uk. We will reply within one month. If the request is about a pharmacy's booking records, we will work with that pharmacy to respond.
13. Disconnecting Google and deleting data
- In the pharmacy system: go to Appointment Configuration and click Disconnect Google Account. We revoke the access with Google and delete the stored tokens immediately.
- In your Google account: you can remove Medycheck Appointments's access at any time at myaccount.google.com/permissions. We then stop using the connection.
- By email: to ask us to delete your information, including any Google data we hold, email info@acornrxtechnologies.co.uk. We will confirm once it is done, within one month.
14. Cookies
The booking pages use only two essential cookies, which are needed for the pages to work securely. They are deleted after two hours of inactivity:
| Cookie | Purpose |
|---|---|
| Session cookie | Keeps your booking steps together while you use the page. |
| XSRF-TOKEN | Protects the booking form against forged requests. |
We do not use advertising or tracking cookies on the booking pages.
15. Children
The service is not aimed at children. A parent or guardian may book an appointment for a child; in that case they provide the child's details and are responsible for doing so.
16. Changes to this policy
We may update this policy, for example if the service changes or the law changes. We will post the new version on this page and change the "Last updated" date. If a change materially affects how we use Google user data, we will tell connected pharmacies and ask for consent again where required.
17. Contact us and complaints
AcornRX Technologies Ltd
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: info@acornrxtechnologies.co.uk
If you are unhappy with how your information has been handled, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.