Privacy Policy Effective Date: 11 March 2026 Medical Leaf UK (trading as MedicalLeaf.co.uk)

1. Introduction Medical Leaf is an educational referral platform that helps UK adults (18+) explore whether private medical cannabis-based treatments may be appropriate for symptom management. We facilitate free eligibility assessments and bookings for consultations with independent, GMC-registered specialist clinicians. We do not provide medical advice, diagnose conditions, prescribe medicines, or dispense cannabis-based products.

We do not collect, store, or process any patient, client, or customer personal data relating to identity, contact details, or health/medical information. All such information is collected and processed directly by our independent clinical partners (who act as the data controllers for that data, in compliance with UK GDPR, Data Protection Act 2018, and their regulatory obligations).

This Privacy Policy explains how we handle the limited personal data we may collect when you visit https://www.medicalleaf.co.uk/ (the “Website”), contact us, or interact with our services.

Medical Leaf Limited is the data controller for the personal data we process (company number 17061030, registered office: St. John’s House, St. John’s Street, Chichester, PO19 1UU).

2. Information We Collect Medical Leaf operates as an educational and referral platform only. We do not collect, store, or process any patient, client, or customer personal data relating to identity, contact details, or health/medical information. All such information — including names, dates of birth, contact details, medical history, symptoms, conditions, treatments, medications, and reasons for seeking medical cannabis — is collected directly by our independent professional partners (licensed specialist clinicians and their practices) during the eligibility assessment, consultation booking, or clinical process.

We may collect only the following limited types of personal data directly through your use of the website:

• Technical & Usage Data: IP address, browser type and version, operating system, device information, pages visited, time and date of visits, time spent on pages, and referral source. This is collected automatically via cookies and similar technologies (see our separate Cookie Policy for details and controls).
• Communication Data: details of any messages, emails, or calls you send to us (e.g. via support@medicalleaf.co.uk or 01243 767049), but only to the extent necessary to respond to your enquiry or provide general support. We do not retain or use this for patient referral purposes.
• Marketing & Preferences Data: your preferences in relation to receiving marketing communications from us (e.g. if you opt in to newsletters or updates via a form on the site).

We do not collect payment card details or any financial information directly. If any payments are required (e.g. for consultations), these are handled securely and exclusively by our professional partners or their designated third-party payment processors.

Any eligibility questionnaire or initial form you complete on the website is used solely to determine potential suitability for referral. It does not result in us collecting or storing your personal or health data. Instead, qualifying responses are passed directly (with your explicit consent) to our partner clinicians, who then collect and process all required information under their own data protection responsibilities.

For full details on how your personal and health data is handled during consultations and treatment, please refer to the privacy notice(s) provided by our partner clinicians at the point of referral or booking.

3. How We Collect Your Data We collect limited data directly from you only in these ways:

• Automatically through cookies and similar technologies (technical/usage data — see Cookie Policy).
• When you contact us via email, phone, or forms for general enquiries/support (communication data only, not for patient records).
• If you opt in to marketing (preferences data).

We do not collect or retain any identity, contact, or health information you enter into eligibility forms or questionnaires. Such forms guide you on potential suitability and, where you explicitly consent to proceed, any necessary referral signals are passed directly to our partner clinicians (who act as the data controller for all subsequent personal and health data collection).

Referrals to Clinical Partner

When you choose to check your eligibility or book a consultation, you will be redirected to our clinical partner’s platform.

Any personal or medical information you provide is collected directly by the clinical partner and is processed in accordance with their own privacy policy.

Medical Leaf does not receive, collect, store, or have access to any personal or medical information submitted on the clinical partner’s platform.

Before submitting any information, you should review the clinical partner’s privacy policy.

We may receive anonymised, non-identifiable information regarding whether a referral results in a consultation or treatment. This does not include access to personal or medical data.

4. How & Why We Use Your Personal Data

We process your limited data on the following lawful bases:

We do not process special category health data. Any processing of health information is carried out solely by our partner clinicians under their own lawful bases (typically necessary for medical diagnosis/treatment under Art 9(2)(h)).

5. Sharing Your Personal Data We may share your limited data with:

• Service providers (e.g. IT/hosting, analytics, email platforms) acting as processors under UK GDPR-compliant agreements.
• Regulators, law enforcement, or courts, as required by law.
• Successors in case of business sale/transfer (with notice where feasible).

We do not sell your personal data. We do not share any identity, contact, or health data because we do not collect or hold it. When you consent to a referral, we may notify our partner clinician of your interest so they can contact you directly to collect and process your information in accordance with their privacy notice.

6. International Transfers Some processors (e.g. US-based analytics/email tools) may transfer data outside the UK. We ensure appropriate safeguards (UK International Data Transfer Agreement, standard contractual clauses, or adequacy decisions).
7. Data Retention We keep personal data only for as long as necessary:

• Technical/usage logs → up to 12–26 months (for analytics/security).
• Communication/support records → as long as needed to resolve enquiries (typically up to 12 months).
• Marketing data → until you unsubscribe/withdraw consent.

We do not retain health or patient referral records — retention is managed by our partner clinicians (typically 8–10 years per health record standards).

8. Your Rights (UK GDPR) You have the right to:

• Access, correct, erase, restrict, or port your data (as we process it).
• Object to processing (including marketing).
• Withdraw consent at any time (where applicable).

Contact us at support@medicalleaf.co.uk. We usually respond within one month. For any health or medical information collected during consultations or referrals, please contact our partner clinicians directly, as they are the data controller for that information. You can also complain to the Information Commissioner’s Office (ico.org.uk).

9. Security We use technical, organisational, and physical measures to protect your data (encryption where appropriate, access controls, regular reviews). No internet transmission is 100% secure.
10. Cookies & Tracking We use cookies and similar technologies. Please see our separate Cookie Policy for details and consent controls.
11. Children’s Privacy Our services are not directed at individuals under 18. We do not knowingly collect data from children.
12. Changes to This Policy We may update this policy. Changes will be posted here with an updated effective date. Significant changes may be notified via email or on the website.
13. Contact Us Data Protection enquiries: Email: support@medicalleaf.co.uk Post: Medical Leaf, St Johns House, St Johns Street, Chichester, PO19 1UU Telephone: 01243 767049

For health/medical data queries, contact our partner clinicians directly.

Thank you for visiting Medical Leaf.