Privacy policy

In short: we collect the information a clinician needs to assess your skin safely, we keep it secure and within the UK/EU, only the clinicians caring for you can see your medical information, and we never sell it or use your photos in marketing.

1. Who we are

Trinsic Innovations Limited ("Trinsic Rx", "we", "us") provides the online prescription skincare service at trinsic-rx.com and the patient portal. We are the controller of your personal information.

Registered office: 7a Ballymullan Road, Crawfordsburn, Co Down, BT19 1JG. Company number NI718996. ICO registration number 00010800389. Contact: hello@trinsic-rx.com.

2. What we collect

Your details

• Name, date of birth, sex at birth
• Email address, phone number and delivery address
• Confirmation that you are 18 or over and live in the UK

Your health information

• Your answers to our medical questionnaire, including medical history, medicines, allergies, and pregnancy or breastfeeding status
• Photos of your skin (we remove location and device information from photos when you upload them)
• Your progress reviews, medical updates and progress photos
• Messages with your clinician, video consultation bookings, and your clinician's notes (video calls are not recorded)
• Prescriptions, your treatment plan and delivery history

Payment information

If you start treatment, you set up a Direct Debit on our payment provider's secure page. We never see or store your bank details – we only keep a reference number for your Direct Debit.

Technical information

• Sign-in records, IP address, browser and device type
• A record of who has viewed or changed your record, and when (an audit log)

If you join our newsletter

Your email address only. Our newsletter never contains or asks about health information.

3. How we use it, and our legal basis

Why	Legal basis (UK GDPR)
To assess your consultation, prescribe treatment if suitable, arrange dispensing and delivery, and look after you during treatment	Contract with you (Article 6(1)(b)); health information processed for health care by health professionals (Article 9(2)(h))
To keep medical records as required by law and professional guidance	Legal obligation (Article 6(1)(c)); health care (Article 9(2)(h))
To take Direct Debit payments and send receipts	Contract with you
To keep the service safe and secure, for example sign-in checks and audit logs	Legitimate interests (Article 6(1)(f)); legal obligation
To check and improve the quality of our service, using de-identified information	Legitimate interests; health care purposes – you can object
To create fully anonymised information for research or future technology, including artificial intelligence	Legitimate interests – you can opt out at any time (see section 7)
To send our newsletter	Your consent – unsubscribe at any time

Every treatment decision is made by a clinician. Our system highlights answers for the clinician to check, but no decision about you is made by a computer, and we do not use artificial intelligence to assess you.

4. Who can see it and who we share it with

• The clinicians caring for you – UK-registered health professionals bound by professional confidentiality. Our administrators cannot see your medical information or photos.
• Our e-prescribing provider and our partner pharmacy (registered with the General Pharmaceutical Council), to dispense and deliver your treatment. They receive what is needed for your prescription: your name, date of birth, address and the medicine prescribed.
• Our payment provider (UK), to set up and collect your Direct Debit. You enter your bank details on their own secure page; they receive your name, email and bank details – never your health information.
• Our technology suppliers, under contracts that only let them use your information to provide their service to us:
  • Our secure database, photo storage and sign-in provider (hosted in the UK, London)
  • Our website hosting provider, which delivers the patient portal to your browser; it does not store your health information
  • Our video consultation provider (EU); calls are not recorded
  • Our email provider, which sends your sign-in codes and "You have a new message" emails – these never contain health details
  • Our website platform, which runs this website and our newsletter; it never receives your health information
• Your GP, if you agree, or if there is a serious clinical safety reason.
• Regulators or authorities, where the law requires it.

We never sell your information, and we never use your photos in marketing.

5. Where it is stored

Your health information and photos are stored in the UK (London). Some of our technology suppliers are based outside the UK, for example in the United States. Where they handle your information – such as technical logs or your email address – it is protected by approved safeguards, such as the UK–US data bridge or UK standard contract clauses.

6. How we keep it secure

• Your information is encrypted when it is sent and when it is stored.
• Two-step sign-in: you sign in with a code sent to your email and a code from an authenticator app. Our staff must do the same.
• Your photos are kept private. They can only be opened through links that expire after 10 minutes.
• Access is limited by role: you see only your own record, and clinicians see only the patients they care for.
• Every change to your record, and every time a clinician opens it, is recorded in an audit log that cannot be changed.
• If you are inactive, you are signed out automatically, and your session ends when you close your browser tab.

No online service can be completely secure. If something goes wrong that could affect you, we will tell you and the ICO where required.

7. Research, AI and your choice

We may use de-identified information (with your name and contact details removed) to check the quality of our service, and fully anonymised information – from which no one can be identified – for research or to develop future technology. Before anonymised information is used, we remove identifying details, remove or exclude photos that could identify you, and check that no one could reasonably be re-identified.

You can opt out at any time by messaging us in your account or emailing hello@trinsic-rx.com. Opting out does not affect your care.

8. How long we keep it

• Medical records (answers, photos, messages, notes and prescriptions): 8 years after your last contact with us, in line with UK guidance for adult health records.
• A consultation you start but never send: deleted after 12 months.
• Payment records: 6 years, for tax and accounting.
• Audit logs: kept for as long as the medical record they relate to.
• Newsletter: until you unsubscribe.

9. Your rights

You have the right to:

• see a copy of your information
• correct information that is wrong – you can update your contact details yourself in your account
• ask us to delete information we are not required to keep as a medical record
• restrict or object to some uses, including research use (see section 7)
• receive your information in a portable format
• withdraw consent (for example to the newsletter) at any time

To use any of these rights, message us in your account or email hello@trinsic-rx.com. We will reply within one month.

10. Emails and notifications

Our emails only tell you that you have a new message or that something needs your attention – we never include health details in emails or texts. Please sign in to your account to read them, and keep your email and phone secure.

11. Children

Our service is only for adults aged 18 and over. If we learn that someone under 18 has created an account, we will close it and delete their information, unless we must keep it as a medical record.

12. Cookies

See our cookie policy. The patient portal does not use cookies.

13. Changes to this policy

We will update this page and the date at the top when this policy changes. If a change is significant, we will also tell you in your account or by email.

14. Contact us, or complain

Trinsic Innovations Limited, 7a Ballymullan Road, Crawfordsburn, Co Down, BT19 1JG · hello@trinsic-rx.com

If you are unhappy with how we have used your information, please tell us first. You can also complain to the Information Commissioner's Office (ICO): Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · ico.org.uk · 0303 123 1113.