Data Protection, Privacy, and Consent (UK GDPR)

Data Processing Role

LEO360 acts as a data processor.

LEO360 does not store or retain patient medical records.

Clinical Data

All clinical data is:

• Processed and stored by GPDQ Group
• Managed within Semble EHR
• Hosted in UK (AWS London region)

Technical Logs and Monitoring

The LEO360 platform generates limited technical logs and error events for system reliability and security purposes. These may be sent to monitoring services such as Sentry.

These logs:

• Do not contain clinical records
• Are used only for troubleshooting and system improvement

Website Analytics and Cookies

LEO360 uses self-hosted analytics tools (e.g. PostHog) and website cookies for:

• Basic usage analysis
• Service improvement

Analytics data retention is limited (up to 30 days) and governed by cookie consent.

Patient Consent

Patients are asked for consent:

1. During registration
2. Before each video consultation
3. For website cookies and analytics

Consent is required to ensure transparency, compliance, and patient protection.