This Privacy Notice explains how MEDIO Consult collects and processes personal data in a lawful, fair, and transparent manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are committed to ensuring that personal data is handled lawfully, fairly, transparently, and securely.

1. Who are we?

Involve Visual Collaboration provides the MEDIO platform, a video appointment system enabling virtual meetings between service providers and service users.

• Controller/Processor Status:
  In most cases, the organisation using MEDIO Consult (the “Service Provider”) is the data controller, and Involve acts as a data processor on their behalf.
  Involve may act as a data controller for limited processing activities such as website analytics, marketing, and contract management.
• Registered Office:
  Martin Dawes House, Europa Boulevard, Westbrook, Warrington, WA5 7WH

2. Personal data we collect

We may collect and process the following categories of personal data:

• Identity Data: name, title, date of birth, gender, NHS number (where applicable)
• Contact Data: address, email, telephone number
• Financial Data: bank account and payment card details
• Transaction Data: details of services purchased
• Technical Data: IP address, browser type, device information, login data
• Profile Data: account details, preferences, feedback
• Usage Data: how you use our website and services
• Marketing & Communications Data: preferences for receiving marketing

3. How we collect your data

We collect personal data through:

• Direct interactions (e.g. contracts, enquiries, support requests)
• Use of our platform (including videoconferencing)
• Cookies and website tracking technologies, further Information is available in our Cookie Policy | Involve
• Third parties (e.g. your organisation/employer using Medio Consult)

4. How we use your personal data

We use personal data for the following purposes:

• To provide and manage access to the Medio platform
• To deliver contracted services
• To communicate with you (support, service updates, enquiries)
• To improve our services and monitor system performance
• To conduct market research and business development
• To comply with legal and regulatory obligations

5. Lawful bases for processing

We rely on the following lawful bases:

• Contract – processing necessary to perform a contract
• Legal obligation – compliance with legal requirements
• Legitimate interests – business improvement, service monitoring, and marketing (where appropriate and balanced against your rights)
• Consent – where required (e.g. marketing communications, call recordings where applicable)

You may withdraw consent at any time.

6. Videoconferencing and call recording

• All video calls are encrypted in transit
• Recording is optional and only carried out with prior consent
• Responsibility for lawful recording typically rests with the Service Provider (controller)
• Recordings are stored securely and access is restricted

7. Sharing your personal data

We may share your data with trusted third-party processors, including:

• Amazon Web Services (hosting and infrastructure)
• Whereby (video conferencing services)
• Brevo (notifications)
• Hedgehog Lab (technical support)

All third parties are contractually bound to process data securely and only on our instructions.

• see appendix A for safeguards that are in place to protect your personal data

8. Data retention

We retain personal data only for as long as necessary:

• Contract data: duration of contract plus applicable legal retention periods
• Support call recordings: up to 3 months
• Other data: retained based on business need and legal obligations

Data is securely deleted or anonymised when no longer required.

9. Security of your data

We implement appropriate technical and organisational measures to protect personal data, including:

• ISO 27001-certified information security management
• Encryption and access controls
• Secure data storage and transmission

10. Your data protection rights

Under UK GDPR, you have the right to:

• Be informed about how your data is used
• Access your personal data
• Request correction of inaccurate data
• Request erasure (“right to be forgotten”)
• Restrict processing
• Data portability
• Object to processing (including direct marketing)
• Not be subject to automated decision-making

11. Contact and complaints

If you would like to exercise any of your rights or you are not satisfied with how we handle your data, please contact our DPO using the following contact details:

Data Protection Officer
Involve Visual Collaboration Ltd
Martin Dawes House, Europa Boulevard, Warrington, WA5 7WH
Email: DPO@Involve.vc
Tel: 01925 918187

We may request proof of identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) directly (www.ico.org.uk).

However, we would appreciate if you could give us the chance to address your complaint and put it right first.

Appendix A    

MEDIO Consult sub processors

Organisation	Data Use	Where does the processing take place	What appropriate safeguards are in place
AWS Ltd  38 Avenue John F Kennedy, L-1855, Luxembourg	Platform hosting,   Email alerts/notifications, SMS alerts/notifications.	Hosted in London (UK)	There is a Data Processing   Agreement included in the Service Terms.
Whereby AS  Gate 1, no. 107, 6700 Maloy, Norway	Video Call functionality.	Hosted in Dublin	A Data Processing   Agreement is in place between  Whereby and Involve.   Data Adequacy Agreement .
Brevo  106 boulevard Haussmann, France	Bulk email delivery for  Service Notifications – email addresses only.	Hosted in France	There is a Data Processing Agreement included in the Service Terms.  Data Adequacy Agreement.
Hedgehog Lab  Generator Studios, Trafalgar Square, Newcastle upon Tyne	3rd Line support.	Hosted in London (UK)	Master Service Agreement and Data Protection Appendix in place.