This policy explains how Onelivery Ltd collects, uses, shares and protects personal data when you visit our website, use our platform or applications, create an account, book or receive a delivery, communicate with us, or otherwise use our services. It also explains your rights and how to raise a concern.
Who We Are
Onelivery Ltd is a UK healthcare delivery platform and courier network. We provide delivery booking, dispatch, tracking, patient and recipient updates, proof of handover, account support and related services.
London, WC2H 9JQ
United Kingdom
Email: enquiry@onelivery.co.uk
Phone: +44 7710 424273
Scope of This Policy
This policy applies to website visitors, account holders, customer contacts, senders, patients, recipients and other people whose personal data is used in connection with Onelivery services. A customer organisation may also provide its own privacy notice, which will apply to its use of your data.
The policy does not form consent to data processing. We rely on the lawful bases described below. Where consent is required, we ask for it separately and allow it to be withdrawn.
Our Role Under Data Protection Law
When Onelivery Is a Controller
Onelivery is a controller when we decide why and how personal data is used for our own purposes. This includes managing accounts, customer relationships, payments, platform security, support, complaints, service improvement and lawful marketing.
When Onelivery Is a Processor
When a hospital, pharmacy, clinic or other customer provides patient or recipient data so that we can complete a delivery, that organisation will usually be the controller and Onelivery will act as its processor. We use that data only on documented instructions, under a data processing agreement, and only for the agreed service.
If your request relates to data supplied by a healthcare provider, you may contact that provider directly. You may also contact us. Where appropriate, we will forward the request to the relevant controller and assist it in responding.
Personal Data We Collect
- Identity and contact data, including name, email address, telephone number, billing address, collection address, delivery address and organisation.
- Account data, including login details, account permissions, saved addresses, booking history and communication preferences.
- Delivery data, including sender and recipient details, delivery instructions, collection and delivery times, assigned rider, route status, tracking events and exception records.
- Proof of collection and handover, including photographs, recipient name, signature, timestamp and any delivery note required to confirm completion.
- Transaction data, including order value, invoices, payment status, refunds and limited payment references. Payment card details are normally handled by our payment provider and are not stored in full by Onelivery.
- Technical and usage data, including IP address, device and browser information, log files, security events, pages used and cookie identifiers.
- Communications data, including enquiries, support requests, complaints, feedback, call or message records and marketing preferences.
- Rider and delivery personnel data where relevant, including identity, contact details, right to work or compliance records, vehicle information, availability, assigned work, location during active delivery and service records.
Healthcare and Special Category Data
A prescription delivery may reveal or imply information about a person's health. Delivery instructions may also contain accessibility or care information. This can be special category data under the UK GDPR.
We ask customers not to provide diagnosis, prescription content, medical records or other clinical information unless it is strictly necessary for the delivery. Where Onelivery acts as a processor, the healthcare provider determines the lawful basis and the relevant condition under Article 9 of the UK GDPR. We process the information only on its instructions and apply the safeguards agreed in our contract.
Where Onelivery acts as controller and special category data is necessary, we identify and document both an Article 6 lawful basis and an Article 9 condition before processing. We do not use patient or recipient health data for advertising.
Where Personal Data Comes From
- You, when you create an account, make a booking, receive a delivery, contact us or use our website or platform.
- Hospitals, pharmacies, clinics, retailers and other organisations that arrange a delivery or manage an account.
- Senders, recipients and authorised representatives who provide delivery details or instructions.
- Riders and operational staff who record delivery events, exceptions and proof of handover.
- Payment, identity, address, mapping, communications, fraud prevention and technology suppliers.
- Cookies, server logs and other technologies used when you access our website or platform.
How We Use Personal Data and Our Lawful Bases
The following table applies when Onelivery acts as controller. When we act as processor, the customer organisation determines the lawful basis and we act on its documented instructions.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Provide accounts and delivery services | Account, contact, booking, delivery, tracking and proof of handover data | Contract where you are our customer. Legitimate interests where a business customer asks us to deliver to another person. |
| Manage customer and supplier relationships | Business contact, account, service and communications data | Legitimate interests in managing services and business relationships. |
| Process payments and maintain financial records | Transaction, billing, invoice and payment reference data | Contract and legal obligation. |
| Provide support and manage complaints | Account, delivery and communications data | Contract, legitimate interests, legal obligation and legal claims. |
| Protect the platform and prevent fraud | Account, technical, security, payment and delivery data | Legitimate interests in security, fraud prevention and service integrity. Legal obligation where applicable. |
| Maintain delivery evidence and resolve disputes | Tracking, photographs, signatures, timestamps, communications and exception records | Legitimate interests in accountability, service quality and the establishment, exercise or defence of legal claims. |
| Improve services and produce operational reporting | Usage, service performance and de-identified or aggregated delivery data | Legitimate interests in improving services. Consent where required for non-essential cookies or tracking. |
| Send service messages | Contact, account and delivery data | Contract and legitimate interests. These messages are operational, not marketing. |
| Send marketing communications | Contact details, organisation and marketing preferences | Consent or legitimate interests where permitted, subject to the Privacy and Electronic Communications Regulations. |
| Meet legal and regulatory duties | Relevant account, transaction, delivery, complaint and security data | Legal obligation, public authority requests where lawful, and legal claims. |
If You Do Not Provide Required Data
Some information is needed to create an account, process payment, identify the collection and delivery points, contact the recipient, manage exceptions and confirm handover. If this information is not provided or is inaccurate, we may be unable to accept or complete the delivery safely.
Who We Share Personal Data With
We share personal data only where necessary for the service, where the law permits it, or where we have a legal duty. Recipients may include:
- The hospital, pharmacy, clinic, retailer or other organisation that booked or manages the delivery.
- Assigned riders and authorised operational staff, who receive only the information needed to collect, deliver and record the outcome.
- Payment providers, banks and financial service providers.
- Cloud hosting, database, platform, email, SMS, customer support, mapping, address verification, analytics and security suppliers.
- Professional advisers, auditors, insurers and legal representatives.
- Police, courts, regulators, government bodies or other authorities where disclosure is required or permitted by law.
- A buyer, investor or successor organisation in connection with a genuine corporate transaction, subject to confidentiality and data protection requirements.
Suppliers that process personal data for us must follow written instructions, protect the data and use it only for the agreed service. We do not sell personal data.
International Transfers
Some technology suppliers may store or access personal data outside the United Kingdom. Where a restricted transfer takes place, we use a lawful transfer mechanism. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another permitted safeguard. Where required, we complete a transfer risk assessment and apply additional protections.
You may contact us for further information about the transfer safeguards relevant to your data. Some contractual or security information may be redacted where disclosure would affect another party's rights or system security.
How Long We Keep Personal Data
We keep personal data only for as long as necessary for the purpose collected, customer instructions, legal duties, security, accounting and the establishment or defence of claims. The usual periods below may be shortened or extended where a customer contract, legal hold, investigation or statutory requirement applies.
| Data category | Usual retention period |
|---|---|
| Account and profile data | While the account is active and usually up to 24 months after closure. |
| Delivery, tracking and operational communications | Usually up to 24 months after completion. A shorter customer instruction may apply where we act as processor. |
| Proof of collection or handover and dispute records | Usually up to 24 months, or longer where required for a complaint, audit, contract or legal claim. Relevant records may be kept for up to six years. |
| Invoices, tax and accounting records | Usually six years from the end of the relevant financial year, or longer where law requires. |
| Support, rights requests and complaints | Usually three years after closure, or longer where a legal or regulatory matter remains active. |
| Security and access logs | Usually up to 12 months, unless needed to investigate an incident or prevent fraud. |
| Marketing records | Until you opt out or the data is no longer needed. We may keep a minimal suppression record to respect an opt-out. |
| Cookie consent and preference records | As described in our Cookie Policy. Consent preferences are normally refreshed after 13 months. |
When a retention period ends, we securely delete or anonymise the data unless further retention is lawful and necessary. Anonymised information that can no longer identify a person may be kept for statistical and service planning purposes.
Security
We use technical and organisational measures proportionate to the nature and risk of the data. These may include access controls, encryption in transit, secure hosting, logging, backups, supplier checks, staff confidentiality requirements, training and incident response procedures. Access to patient and recipient data is limited to authorised people who need it for their work.
No system can be guaranteed completely secure. If a personal data breach creates a risk to people, we assess it promptly and notify the Information Commission and affected individuals where the law requires.
Cookies and Similar Technologies
We use essential cookies to operate and protect our website and platform. We use non-essential analytics, functional or advertising technologies only where permitted and, where required, after obtaining consent. You can change your choices through our cookie controls. Further details are available in the Cookie Policy on our website.
Marketing
We may send information about Onelivery services where you have consented or where the law allows us to contact existing customers about similar services. Each electronic marketing message provides a way to opt out. You can also contact enquiry@onelivery.co.uk. Opting out of marketing does not stop operational messages about an account or delivery.
Children and Vulnerable Recipients
Our customer accounts are intended for people aged 18 or over. Healthcare providers may arrange deliveries for children or vulnerable people. In those cases, we process the minimum information needed to complete the delivery and follow the healthcare provider's instructions. A parent, guardian or authorised representative may contact the relevant provider or Onelivery about the use of that data.
We do not knowingly use children's personal data for behavioural advertising or unrelated profiling.
Automated Decisions and Route Technology
We may use software to allocate work, calculate routes, estimate arrival times, show delivery status and identify unusual activity. These tools support operational decisions. We do not use solely automated decision-making that produces legal or similarly significant effects on patients, recipients or customers.
Your Data Protection Rights
Your rights depend on the circumstances, our role and the lawful basis used. You may have the right to:
- Ask for access to your personal data and information about how it is used.
- Ask us to correct inaccurate or incomplete data.
- Ask us to erase data where there is no lawful reason to keep it.
- Ask us to restrict the use of data in certain circumstances.
- Object to processing based on legitimate interests and object at any time to direct marketing.
- Receive data you provided in a structured, commonly used and machine-readable format where portability applies.
- Withdraw consent at any time where processing relies on consent. Withdrawal does not affect processing already carried out lawfully.
- Ask for human review where a decision with legal or similarly significant effects is made solely by automated means.
To exercise a right, email enquiry@onelivery.co.uk. We may ask for information to confirm your identity and locate the relevant records. We normally respond within one month, although the law allows extra time in some cases. If Onelivery acts only as processor, we may refer the request to the organisation responsible for the data.
Complaints
You can make a data protection complaint by emailing enquiry@onelivery.co.uk with the subject Data Protection Complaint. We will provide reasonable assistance, acknowledge the complaint within 30 days, investigate it, keep you informed where appropriate, and respond without undue delay.
You also have the right to complain to the Information Commission. We would welcome the opportunity to address your concern first, but this does not affect your right to contact the regulator.
Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Third Party Websites
Our website or messages may contain links to other organisations. Their privacy practices are outside our control. You should read their privacy information before providing personal data.
Changes to This Policy
We review this policy when our services, suppliers or legal obligations change. The effective date at the top shows when it was last updated. If a change materially affects how we use personal data, we will provide an appropriate notice before the change takes effect where the law requires.
Contact Us
Questions, rights requests and complaints should be sent to the Data Protection Lead at Onelivery Ltd using the contact details below.
London, WC2H 9JQ
United Kingdom
Email: enquiry@onelivery.co.uk
Phone: +44 7710 424273