HEXPRESS HEALTHCARE LTD PRIVACY POLICY & COOKIES

This website is owned and operated by Hexpress Healthcare Limited ("We", "Us", "Our", trading as HealthExpress CH providing products and services to users and visitors ("You", "Your"). We take your privacy very seriously and we aim to protect and respect your privacy, and to use technology to enhance your online security. We ask that you read this Privacy Policy carefully as it contains important information on who we are and how and why we are collect, retain, store, use, will use and share your personal information. This Privacy Policy also explains your rights in relation to your personal information and how you can contact us, regulators or supervisory authorities in the event you have a complaint.

When we collect and use your personal data, we are subject to the General Data Protection Regulation (GDPR) (EU) 2016/679 (the "Regulation") and for the purposes of the Regulation, Hexpress Healthcare Limited is the "Data Controller", that is, the company responsible for and controlling the processing of your personal data.

Key terms

Please see below definitions of some key terms used in this Privacy Policy:

What personal information we may collect about you

We may collect and use the following personal information about you:

1. Your name and contact details, including address, email address, telephone number and company details

2. Information to enable us to check and verify your identity, e.g. your date of birth, etc

3. Your opinions and medical/medical history details

4. Information about your gender

5. Your location data

6. Your billing information, transaction and payment card information

7. Your contact history, order and purchase history and saved items

8. Information to enable us to conduct credit and other financial checks

9. Information about your use of our website, IT, communication and other systems

10. Your responses to surveys, competitions and promotions

Before you can use certain areas of this website, you will be asked to register on it and to provide your personal information, including 'sensitive personal data' as defined by the Regulation. For example, we will obtain your personal data if you register to use this website, complete the medical questionnaire, send us feedback, send something, contact us for any reason, register for a service, and purchase products or services. We may also obtain sensitive personal information about you if you provide it by completing the online medical questionnaire. If you provide such information, you will be consenting to our processing it for the purpose of obtaining a medical opinion and purchasing the treatment. This personal information is required to provide products and services to you. If you do not provide the personal information we ask for, it may prevent us from providing products and services to you.

We may monitor your use of this website through the use of cookies and similar technical solutions. For example, we may monitor how often you visit the website, which pages you visit, traffic data, location data, and the originating domain name of a user's Internet service provider. This information helps us to build a profile of customers. Some of this information will be aggregated for statistical purposes, i.e. we will not be able to identify you individually. For more information about our use of cookies, please consult our Cookie Policy. Occasionally, we may receive information about you from other sources (such as credit reference agencies), which we will add to the information we already hold about you in order to help us personalise our service to you.

How your personal information is collected

We collect most of this personal information directly from you through our website and app or by telephone, SMS, email or video consultation. We may also collect information directly from third parties, e.g. sanctions screening providers, credit reference agencies and customer due diligence providers; and from third parties with your consent, e.g. your family doctor or GP; and from cookies on our website, and via our IT systems, e.g. automated monitoring of our websites and other technical systems such as our computer networks and connections, communication systems, e-mail and instant messaging systems.

How and why we use your personal information

Under data protection law, we can only use your personal information if we have a proper reason for doing so. Our reasons include but are not limited to:

• To comply with our legal and regulatory obligations;
• For the performance of our contract with you or to take steps at your request before entering into a contract;
• For the purposes of medical diagnosis and the provision of healthcare and treatment;
• For our legitimate interests or those of a third party; and
• Where you have given consent.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.

The table below explains what we use (process) your personal information for and our reasons for doing so:

Promotional communications and service updates

We may use your personal information to send you updates (by email, SMS, telephone or post) about our services, including exclusive offers, promotions or new services.

We have a legitimate interest in processing your personal information for promotional purposes (see above: "How and why we use your personal information"). This means we do not usually need your consent to send you promotional communications. However, if your consent is required, we will ask for your consent separately and clearly.

We will always treat your personal information with the utmost respect and we will never share it with other organisations for marketing or other purposes. If you have given us permission to process your personal information, we may share your personal information with group or partner companies, business partners including affiliates, and we or they may contact you (unless you have asked us or them not to do so) by post, email, telephone, SMS, text/picture/video message or fax, about our services, products, promotions, offers or charitable purposes that may be of interest to you.

You have the right to opt out of receiving promotional communications any time by:

• Contacting us.

• Using the link "unsubscribe" in our emails or "STOP" number in SMS.

• Update your marketing preferences via your customer account or secure members area.

We may ask you to confirm or update your marketing preferences if you instruct us to provide further products and services in the future, or if there are changes in the law, in regulations, or the structure of our business.

Who we share your personal information with

We routinely share your personal information with:

1. Group or partner companies and business partners.

2. Third parties we work with to carry out our services and deliver products and services to you such as payment service providers, warehouses, delivery companies and courier services such as Royal Mail, UPS and others, and third parties who act on your behalf to collect your order from us and deliver it to you such as Kwik Shipments Limited.

3. Other third parties who help us with business operations, e.g. marketing agencies or web/website host providers.

4. Third parties you have authorised, such as social media sites with which you have linked your account, or third party payment providers.

5. Law enforcement agencies in connection with any investigation into the prevention of unlawful activity.

6. Credit reference agencies.

7. Insurers and brokers.

8. Banks and merchant account providers.

9. Regulators.

We share your personal information with third parties who help us to deliver targeted marketing campaigns and to personalise your experience online. These providers include Ve Global UK Limited. Click here to see Ve's privacy policy (https://www.ve.com/legal/privacy-policy) to see how your personal data is being processed. To opt out click here (https://www.ve.com/legal/privacy-policy#opting-out). You can opt out by:

• Contacting Ve at [email protected] to inform Ve that you would like to opt-out of their use of your personal information

• Deleting cookies from your devices and browsers

• If you are using Safari browser version 11.2 or above, toggling the "Limit Ad Tracking" setting on your device orcomputer

• Visiting https://www.youronlinechoices.com/uk/your-ad-choices, finding VE in the list of online behavioural advertising companies and selecting 'off'

• If you have an Apple device, updating to iOS 6.0 or higher and setting Limit Ad Tracking to 'ON'

• If you have an Android device, selecting "Google on your main settings menu, choosing the "Ads" option and selecting "Opt out of Ads Personalization"

We only allow service providers to handle your personal information if we are satisfied that they will take appropriate measures to protect your personal information. We also impose contractual obligations on service providers requiring them to use your personal information only to provide services to us or to you. In specific circumstances, we may share your personal information with external auditors, e.g. with respect to ISO or our "Investors in People" accreditation and the audit of our accounts.

We may disclose and exchange information about you with law enforcement agencies and regulators to comply with our legal and regulatory obligations.

We may also share your personal information with other parties, such as potential buyers of some or all of our business or during a business re-structuring. All personal information is normally anonymised, but this may not always be possible. The recipient of any information will be bound by confidentiality obligations.

Where your personal information is stored

Information may be held at our offices, the offices of our group or partner companies, by third party persons, service providers, agencies and agents , as described above (see "Who we share your personal information with").

Some of these third parties may be located outside the European Economic Area. For more information on how we shall safeguard your personal information in such circumstances, please see below "Transferring your personal information out of the EEA".

Protecting your personal information

We use adequate security measures to prevent the unwanted loss, misuse or unlawful access to your personal information, and continually test our systems. We limit access to your personal information to those with legitimate business reasons. The processing of your personal information takes place only in an authorised manner and confidentially.

We also have procedures to deal with suspected or alleged data security breaches. We will notify you and the relevant regulatory authorities of any suspected or alleged data security breach where we are legally required to do so.

We use technical and organisational security measures to protect your personal information, for example:

1. Your data is stored on secure servers.

2. Payment details are encrypted using SSL technology.

3. Access to your account is controlled by individual username and password that are unique to you.

While we make every reasonable effort to protect your personal information, you acknowledge that the use of the Internet is not completely secure and therefore we cannot guarantee the security or integrity of any personal information provided by you or transmitted to you via the Internet.

If you would like detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online challenges, please visit www.getsafeonline.org. Get Safe Online is supported by the UK government and leading companies.

Monitoring

We may monitor and record communications with you, including telephone calls and emails, for training, quality assurance, fraud prevention, and compliance.

Credit checking

To enable us and other group or partner companies to make credit decisions about you and to prevent fraud and money laundering, we may search the files of credit reference and fraud prevention agencies (which will record such searches). We may share information about how you manage your customer account with these agencies, and your information may be linked to records of other people who live at the same address and/or with whom you are financially connected. Other lenders or credit agencies may use this information to help them make credit decisions about you and those with whom you are financially connected, as well as for fraud prevention, debt collection and money laundering prevention. If you provide false or inaccurate information and we suspect fraud, we will record this.

How long your personal information will be kept

The Ministry of Health provides for a minimum retention period for health data. The company follows these guidelines at all times. Under the 2016 Record Management Code of Practice for Health and Social Care, the statutory retention period for medical data is 8 years, after which the records are reviewed and, if no longer required, destroyed.

We will retain your personal information for as long as you have an account with us or we provide you products and services to:

• Fulfil our legal obligations about data retention.

• Respond to any questions, complaints or claims made by you or on your behalf.

• Show that we have treated you fairly.

We will not retain your personal information for longer than necessary for the purposes set out in this Privacy Policy. Different retention periods apply for different types of personal information. If the retention of your personal information is no longer necessary or required, we will delete or anonymise it.

Information about other individuals

If you provide us with information on behalf of someone else, you confirm that this person has designated you as their representative, has authorised you and appointed you to act on their behalf and to take the following actions on their behalf:

• Receive data protection notices.

• Consent to the transfer of their personal information abroad.

• Consent to the processing of their personal information.

• Consent to the processing of their sensitive personal information, such as health information.

Transferring your personal information out of the EEA

In order to provide our services and to meet all our obligations, it may be necessary for us to transfer your personal information outside the European Economic Area (EEA). We may share your personal information outside the EEA, e.g.:

1. With our business partners outside the EEA.

2. With your and our service providers located outside the EEA.

3. If you yourself are located outside the EEA.

4. If the services we provide have an international dimension.

By registering on this website, you agree that we may transfer your personal information outside the EEA. Please be assured that we always use all appropriate security measures to safeguard your personal information. These transfers are subject to special regulations under European and UK data protection laws.

We may transfer your personal information to countries that have been evaluated by the European Commission as providing an adequate level of protection for personal information. We may also transfer your personal information to non-EEA countries, which do not have the same data protection laws as the United Kingdom and the EEA; and in those circumstances, we will ensure that any transfer of personal information complies with our data protection laws and we will use standard data protection contract clauses, which have been approved by the European Commission, thus safeguarding your privacy rights and giving you access to remedies in the unlikely event of a security breach.

If you would like any further information, please contact us or our Data Protection Officer (see "How to contact us" below).

Your rights

You have the following rights, which you can exercise free of charge:

For more information on each of these rights and the circumstances in which they apply, please contact us or use the information Commissioner's Office (ICO) zu den individuellen Rechten.

If you want to exercise any of these rights, please:

1. Email, call or write, to us or our Data Protection Officer (see below: "How to contact us");

2. Give us enough information to identify you (e.g. your full name, address, username, registration details and customer account or order reference number);

3. Give us a proof of your identity and address (copy of driver's license, identity card or passport and a recent utility bill or credit card statement);

4. Indicate what information is incorrect and what it should be replaced with (if you are requesting that we correct any inaccuracies in your information);

5. Indicate the communication channel you are complaining about (if you are asking us not to use your personal data for direct marketing in a certain way, e.g. email or telephone); and

6. Confirm the right you want to exercise and the information to which your request relates.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. You should read this Privacy Policy to ensure that you are aware of the most recent version that is in effect every time you access our website.

How to contact us

We are happy to answer your questions and welcome your feedback. Please contact us or our Data Protection Officer by post, email or telephone if you have questions about our Privacy Policy or the personal information we hold about you.

Our contact details are as follows:

Our Data Protection Officer contact details are as follows:

How to complain

We hope that we or our Data Protection Officer can resolve any query or concern about our use of your information.

The General Data Protection Regulation also gives you the right to lodge a complaint with a regulatory authority, in particular in the EU (or EEA) country where you work, normally reside, or in which any alleged breach of data protection laws has occurred. The UK regulator is the Information Officer, which can be reached via https://ico.org.uk/make-a-complaint/ or by phone (0303 123 1113)

Need extra help?

If you require this Privacy Policy in another format (e.g. audio, large print, braille), please contact us (see above "How to contact us").

COOKIE POLICY

A cookie is a small text document that is stored on your computer (or other electronic device) while visiting our website.

We use cookies and other online tracking technologies, such as web beacons, action tags, local shared objects or one-pixel GIFs, on this website to:

• Keep track of which products you put in your shopping basket and to facilitate the check-out process.

• Recognise the user when visiting this website (this speeds up access to the website)

• Get information about your preferences, online movements and internet usage.

• Better understand the needs and interests of our visitors and customers, and subsequently conduct research and statistical analysis to improve our content, products and services.

• Personalise and tailor our marketing and advertising efforts, and those of our partners, to suit your interests.

• Make your visit to our website more efficient and enjoyable.

Information obtained through the use of cookies does not normally contain any of your personal information. However, we may receive information about your computer or other electronic devices, such as your IP address, browser information, and / or other Internet log information that you do not normally identify personally. We may collect your personal information, but only if it is voluntarily provided by you, for example by completing our online medical questionnaire or by purchasing our products or using our services.

In most cases, we need your consent to use cookies on this website. The exception to this is when a cookie is essential to perform certain services requested by you. This includes processes such as placing products in the shopping cart and the check-out process.

Approval

Browser settings

When you visit our website and allow your browser settings to be cookies, we interpret this as consent to the use of cookies and similar technologies as described in the policies.

If you change your mind about the use of cookies, you can modify your browser settings to automatically decline or disable cookies.

Note on the homepage

On our homepage is a note that describes how we use cookies and a reference link to this policy. If you use the website after the notice is displayed, we assume that you agree to the use of our cookies as described in the Cookie Policy and in the Privacy Policy.

Third-party cookies

We work with third parties who may also use cookies on our website. The third party providers are responsible for the cookies they use on our website. If you would like more information, please visit the website of the relevant third-party provider. Additional information can be found in the table below.

VE Global UK Limited — to help make the ads you see after browsing our website more relevant and interesting to you, VE Global UK Limited uses cookies. These cookies allow us to show you our advertisements on websites across the internet based on your past activity on our website and personalise what you see whilst browsing our website. Click here (https://www.ve.com/legal/cookie-policy) to see Ve's Cookie policy to see how your personal data is processed. To opt out click here (https://www.ve.com/legal/privacy-policy#opting-out). You can opt out by:

• Contacting Ve at [email protected] to inform Ve that you would like to opt-out of their use of your personal information.

• Deleting cookies from your devices and browsers.

• If you are using Safari browser version 11.2 or above, toggling the "Limit Ad Tracking" setting on your device or computer.

• Visiting https://www.youronlinechoices.com/uk/your-ad-choices, finding VE in the list of online behavioural advertising companies and selecting 'off'.

• If you have an Apple device, updating to iOS 6.0 or higher and setting Limit Ad Tracking to 'ON'.

• If you have an Android device, selecting "Google" on your main settings menu, choosing the "Ads" option and selecting "Opt out of Ads Personalization".

1. Absolutely necessary

"Absolutely necessary" cookies allow you to easily navigate through a page, to use the most important functions and to order products. These cookies do not collect information about you that could be used for promotional purposes or for tracking your browsing habits.

Consent to these cookies is a necessary condition for the secure use of the website. If you block these cookies, we cannot guarantee you the necessary security or anticipate the effects of using the website.

Here is a list of cookies that are considered "essential":

HealthExpress cookies PHPSESSID

Third-party cookies COOKIE HOST JSESSIONID secpay.com

2. Performance

"Performance" cookies collect information about how you use our website, such as which pages you visit and if you experience difficulties. These cookies do not collect any information that could identify you. All information collected is anonymous and only serves to improve the operation and usability of the website and to see what really interests visitors.

If you use our website, this indicates that you accept the performance cookies. Accepting these cookies is a condition for using the website. If you block these cookies, we cannot guarantee which services our website can provide for you.

Here is a list of cookies that we call performance cookies:

HealthExpress cookies __utma __utmb __utmc __utmc PAPVisitorId ysm_bbk1U257HHBN7MJQVE8CHUV3QAQMI0

Third-party cookies COOKIE HOST _utma _utmb _utmc _utmz secpay.com _utma _utmb _utmc _utmv _utmz S3-eu-west-1.amazonaws.com Pref VISITOR_INFO1_LIVE youtube.com PAPVisitorId hexpressaffiliates.com B yahoo.com BX overture.com yes_email_invite bizrate.com

3. Functionality

"Functionality" cookies serve to provide certain services or to remember already saved settings and thus make your visit to the website more comfortable.

You can decide if you want to use these cookies or not. If you do not allow these cookies, we cannot offer you some of our services and may have to reduce the service we can offer you. It is also possible that blocking these cookies will not allow us to remember that you had declined a specific service.

Here is a list of cookies we count as "functionality":

4. Additional services

Cookies for "additional services" are provided by third-party providers and used for these services, such as the 'Like' button or the 'Share' button. These third parties provide these services to see that you have visited our website.

You can decide for yourself whether you want to use these cookies or not. If you do not allow these cookies, you may be unable to use some services. All these cookies are provided and managed by third parties, and you can usually control and block these cookies yourself using third-party services.

Here is a list of cookies we count as "Additional Services":

Manage your cookies

If you would like more information on how we manage our cookies.

Disable cookies

If you do not accept our cookies, you may adjust your browser settings to refuse cookies. If you decide to take this step, we point out that you may not be able to use some features of our website.

Additional Information