Privacy Policy

Live Med Ltd is a private medical services company registered in England and Wales. We provide event medical cover, welfare services, and clinical staffing for events, festivals, TV & film productions, sports fixtures, and corporate gatherings across the United Kingdom. Registered office: Live Med Ltd, United Kingdom Email: [email protected] Website: livemedservices.co.uk Live Med Ltd is the data controller for personal data collected through this website and our operational activities. We are registered with the Information Commissioner's Office (ICO). References to "Live Med Ltd", "we", "us" or "our" in this policy refer to Live Med Ltd.

We may collect and process the following categories of personal data: Enquiry and client data • Name, email address, telephone number, job title and organisation • Event details: type, date, location, expected attendance, risk category • Correspondence and communications sent through our website or by email Staff and contractor data • Name, email address, home address, date of birth, telephone number • Clinical grade, professional registration numbers (e.g. HCPC, NMC), qualifications and certificates • Compliance documents, DBS certificate references, training records • Bank account details, UTR number, IR35 status, invoices and payroll records • Emergency contact and next-of-kin details • Photographs (where provided for staff profiles) Special category data (staff only) • Health information relevant to fitness for clinical duties (processed only where necessary and with explicit consent or under a legal obligation) Technical data • IP address, browser type and version, pages visited, time and date of visit • Cookie identifiers (see Section 9) We do not knowingly collect personal data from children under 16 without verifiable parental consent.

We collect personal data: • Directly from you — when you complete our contact or event enquiry form, apply for a vacancy, register as a staff member, or correspond with us by email or telephone • Through our staff portal — when staff members log in, submit compliance documents, training certificates, or complete operational records • Automatically — through cookies and analytics tools when you browse our website (see Section 9) • From third parties — references provided by previous employers or professional bodies, where relevant to a staffing engagement

We process personal data only where we have a valid lawful basis under UK GDPR Article 6 (and Article 9 for special category data). Our purposes and corresponding lawful bases are: Purpose: Responding to event medical cover enquiries and providing quotations Lawful basis: Legitimate interests (Article 6(1)(f)) — to respond to prospective client enquiries Purpose: Entering into and performing contracts for medical cover services Lawful basis: Contract performance (Article 6(1)(b)) Purpose: Managing staff deployment, shift scheduling, and operational communications Lawful basis: Contract performance (Article 6(1)(b)) Purpose: Maintaining compliance records (DBS, qualifications, training, insurance) Lawful basis: Legal obligation (Article 6(1)(c)) — regulatory and insurance requirements; legitimate interests Purpose: Processing payroll, invoices, and financial records Lawful basis: Legal obligation (Article 6(1)(c)) — HMRC and Companies Act requirements Purpose: Safeguarding referral management Lawful basis: Legal obligation (Article 6(1)(c)) and substantial public interest (Article 9(2)(g)) where special category data is involved Purpose: Sending operational updates, shift reminders, and service communications to staff and clients Lawful basis: Contract performance (Article 6(1)(b)) and legitimate interests (Article 6(1)(f)) Purpose: Improving our website through anonymised analytics Lawful basis: Legitimate interests (Article 6(1)(f)) Purpose: Processing health data relevant to fitness for clinical duties Lawful basis: Explicit consent (Article 9(2)(a)) or employment/social security law (Article 9(2)(b)) We will not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

We do not sell, rent, or trade personal data. We may share data with the following categories of recipients, only to the extent necessary: • Technology and hosting providers — cloud hosting, email delivery, and staff portal infrastructure, under data processing agreements compliant with UK GDPR • Insurers and professional indemnity providers — for verification of staff credentials and incident reporting • Professional regulatory bodies (e.g. HCPC, NMC) — for registration verification where required • HMRC and other statutory authorities — where required by law • Event clients — limited operational data (staff names and clinical grades) necessary to fulfil the contracted service • Disclosure and Barring Service (DBS) — for criminal record checks where required All third-party processors are subject to written data processing agreements and are required to implement appropriate technical and organisational security measures. We do not transfer personal data outside the UK or European Economic Area unless adequate safeguards are in place.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law: • Website enquiry data: 12 months from last contact, unless a contract is entered into • Client contract records: 6 years from the end of the contract (Limitation Act 1980) • Staff employment and payroll records: 6 years from the end of engagement (HMRC requirement) • Compliance documents (DBS, qualifications, training): duration of engagement plus 3 years • Safeguarding referral records: 10 years from closure (in line with safeguarding best practice) • Accounting and financial records: 6 years (Companies Act 2006 / HMRC) • Website analytics data: 26 months (anonymised after 14 months) • Password reset tokens: 1 hour from generation At the end of the applicable retention period, data is securely deleted or anonymised. You may request earlier deletion subject to our legal obligations (see Section 7).

You have the following rights in relation to your personal data: • Right of access (Article 15) — to obtain a copy of the personal data we hold about you • Right to rectification (Article 16) — to have inaccurate or incomplete data corrected • Right to erasure (Article 17) — to request deletion of your data where there is no compelling reason for continued processing • Right to restriction of processing (Article 18) — to request that we limit how we use your data in certain circumstances • Right to data portability (Article 20) — to receive your data in a structured, machine-readable format where processing is based on consent or contract • Right to object (Article 21) — to object to processing based on legitimate interests or for direct marketing purposes • Rights related to automated decision-making (Article 22) — not to be subject to solely automated decisions that significantly affect you • Right to withdraw consent — at any time, where processing is based on consent, without affecting the lawfulness of prior processing To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month. We may need to verify your identity before processing your request. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): Website: ico.org.uk Telephone: 0303 123 1113 Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. These measures include: • Encrypted data transmission (TLS/HTTPS) across all web services • Password hashing using industry-standard algorithms (bcrypt) • Role-based access controls within the staff portal • Regular security reviews and access audits • Staff awareness of data protection obligations In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

Our website uses cookies to function correctly and to understand how visitors use the site. Essential cookies — required for the website and staff portal to operate (e.g. session authentication). These cannot be disabled. Analytics cookies — used to collect anonymised information about how visitors interact with the site (e.g. pages visited, time on site). These are only set with your consent. We do not use advertising, tracking, or third-party marketing cookies. You can control and delete cookies through your browser settings at any time. Disabling essential cookies may affect the functionality of the staff portal.

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policy of any website you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "last updated" date at the top of this page will be revised accordingly. Where changes are material, we will notify staff members via the staff portal.

For any data protection queries, subject access requests, or to exercise your rights, please contact us: Email: [email protected] Post: Live Med Ltd, United Kingdom We aim to respond to all data protection enquiries within 5 working days and to fulfil subject access requests within one calendar month.