Privacy Policy

Last updated: 27 September 2026

Medipay Limited ("Medipay", "we", "us") is a company registered in England and Wales under company number 16145072, with its registered office at 72 Charteris Road, London, NW6 7EX. We provide a payments platform for healthcare practices in the United Kingdom. This policy explains what personal data we handle, why, and the rights you have. It covers our merchant portal at portal.medipayuk.co.uk, our payment pages, the card machines and practice connector software we supply, and the messages we send on behalf of practices. Our Terms and Conditions set out the contractual data protection terms between Medipay and each practice.

Who is responsible for your data

For practice staff accounts and platform operations, Medipay is the data controller. For patient details that a practice stores or sends through Medipay (such as a name, email address, phone number, postal address or payment reference), the practice is the controller and Medipay processes that data on the practice's instructions, under the data processing terms in Clause 7 of our Terms and Conditions.

What we collect

• Practice account data: name, work email, sign-in records, two-factor authentication settings, role and workspace settings.
• Patient contact data: name and, where a practice provides them, email address, mobile number and postal address or postcode (the postcode is used for address verification with the card issuer), used to send payment links, receipts and reminders and to take the payment.
• Payment records: amount, reference, treatment description, payment status, and the card brand, expiry month and last four digits returned by the payment gateway. Where a patient agrees to save a card for instalments or repeat charges, the gateway holds the card and gives us a token; we never hold the card number.
• Card machine records: for practices with a card machine, the sale amount, time, terminal and the acquirer's reference, received from the terminal and from the acquirer's daily settlement reports so every machine payment appears in the portal.
• Technical data: security logs such as sign-in events, IP addresses and device information, kept to protect accounts.

We never see or store full card numbers or security codes. Card details are entered directly into secure fields hosted by our PCI DSS certified payment gateway, or read by the card machine, and do not pass through or rest on Medipay systems.

Why we use it

• To process payments a practice requests and record the outcome.
• To send transactional messages on a practice's behalf: payment links, receipts, reminders and refund confirmations, by email and SMS.
• To reconcile payments against the acquirer's settlement reports and, where a practice has connected them, to post payments to its accounting or practice management software.
• To keep accounts secure and prevent fraud and abuse.
• To meet legal duties, including financial record keeping.

Legal bases under UK GDPR: performance of a contract, legitimate interests in running a secure payments service, and legal obligation for financial records. We do not sell personal data and we do not use it for advertising. The portal and payment pages set only the cookies and browser storage needed to keep you signed in and secure; we do not use advertising or third-party analytics cookies.

Who we share it with

Only with providers needed to run the service, each processing data under a written contract and only for these purposes:

• Payment gateway and acquiring: Elavon Financial Services DAC (UK Branch), which provides the Elavon Payment Gateway (including the Opayo gateway) and, for practices Medipay has introduced to Elavon, the acquiring bank that settles their payments.
• Hosting: Vercel Inc., serving the portal from its London region.
• Database and sign-in: Supabase Inc., hosted in the EU (Ireland) region.
• Scheduled processing and backups: DigitalOcean LLC, for a server operated by Medipay that collects acquirer settlement reports and holds encrypted database backups.
• Email delivery: Resend (Plus Five Five, Inc.), for payment links, receipts and reminders sent by email.
• SMS delivery: Twilio Inc., for payment links and reminders sent by text message.
• Card machines: PAX Technology Limited (terminal software and transaction reporting through the PAX terminal management platform) and Service Logistics Limited (terminal supply, configuration and support), for practices with a card machine.
• Support assistant: Anthropic, PBC, which powers the optional support chat in the portal. Support conversations are processed only to answer your query and route it to our team; they are not used to train AI models, and the assistant has no access to card data or to any connected software.
• Business email: Microsoft Limited (Microsoft 365), used by our team to correspond with practices.
• On the practice's instruction only: where a practice connects its own software in the portal, we share payment data with that provider: Xero, Sage Accounting, QuickBooks Online (Intuit), Salesforce, Cliniko, Dentally, Semble and GoCardless.

If we add or replace a provider, we update this list and tell practices through the portal or by email before the change takes effect.

Where your data is held

Our application and database are hosted in the United Kingdom and the European Union. Some of the providers above process data outside the UK (for example to send an email or answer a support query); where they do, the transfer is covered by the UK International Data Transfer Agreement or Addendum, or an adequacy decision, and their contracts with us require an equivalent level of protection.

How long we keep it

Financial transaction records are kept for the retention period UK law requires (typically six to seven years). When a practice erases a patient, contact details are anonymised immediately and only the anonymised financial record remains. Security logs are kept for as long as they are needed to protect accounts and investigate incidents.

Your rights

You can ask for access to your data, correction, erasure, restriction or portability. Patients can ask their practice, which can export or erase patient data directly in Medipay; you can also contact us and we will help. You can complain to the Information Commissioner's Office (ico.org.uk) at any time. Medipay is registered with the Information Commissioner's Office.

Security

All connections are encrypted in transit. Access to data is limited by role and workspace, every table is protected by row level security, staff accounts support two-factor authentication and optional IP allowlisting, and administrative actions are recorded in an audit log. Database backups are encrypted.

Contact

Medipay Limited, 72 Charteris Road, London, NW6 7EX. Email: support@medipayuk.co.uk. If this policy changes, the date above changes with it.