We put privacy and security first and our priority is to ensure that patients and healthcare providers have full transparency and control over the use of their data.
uMed is a clinical research and health technology company that partners with healthcare professionals to deliver research opportunities.
To allow us to send communications to patients on your behalf, we process patient data to our secure uMed platform. This data includes names, contact details, and demographics, as well as any communication back from patients, such as answers to questionnaires or patient replies to text messages.
uMed keeps patient data secure by separating personally identifiable information (PII) from health data. These are stored in distinct databases, connected through a secure coded identifier managed within the uMed platform. Only authorised systems and personnel with a legitimate purpose can access linked data under strict governance controls. This structure ensures a very high standard of data privacy and protection.
The uMed platform fully integrates with EMIS and System One through the Message Exchange for Social Care and Health (MESH) NHS Digital-approved system.
Our software is approved and audited by NHS Digital Data Security, and Protection Toolkit assured (ODS8K677), ISO27001:2022 and ISO9001:2015 certified, UK Government’s Cyber Essentials Plus, Crown Commercial Service approved supplier, and UK GDPR compliant.
uMed has been developed to enable you and your practice to participate in clinical research whilst removing the associated administrative burden.
Getting started – Our onboarding process takes on average 15 minutes and involves the review and signing of our data processing agreement and the provision of ODS codes. Our support team is available to help along the way and discuss any part of the process.
Participating in a study – Once set up, we will start presenting relevant study opportunities for patients in your practice in our web-based application. To participate in a study, we require you to review and approve study documents in our web app (~10 minutes).
uMed searches, identifies, and builds the list of research eligible patients from your practice based on de-identified health record data. When the practice has provided details to their EHR system, our GCP-trained nurses then review the patient lists on your behalf to ensure that no patients are contacted who are not eligible. Alternatively, our web app allows a member of your practice staff to review and approve the list of patients identified as eligible for the study.
Patients are contacted via SMS (or email or letter if appropriate) and can complete the consent process remotely and electronically. We also provide a dedicated patient helpline designed to support patients throughout the process and reduce the pressure of incoming calls for your practice staff related to the study.
The agreement details how uMed will process data on behalf of the practice, both for research and direct care programmes. This includes processing to:
a) Match potential subjects in the practice population with study opportunities for review by the practice.
b) If approved by the practice, engagement of those patients on behalf of the practice to support recruitment and data capture.
c) If approved by the practice, linkage of outcomes from the clinical record to the study case report form (CRF).
It is important to note that this is not a data-sharing agreement. As a data processor, uMed cannot share or utilise practice data unless explicit permission is obtained from the practice (the data controller). In the same way, other NHS processors such EMIS, Apollo, Accurx, and other technology vendors cannot use practice data outside of that defined in their service agreement with practices.
The DPA is required to legally allow your practice to share patient data in order to provide patients with individual care and offer them research opportunities to take part in. This is also the legal basis for uMed to process patient data on behalf of their Healthcare Providers (the controller of the data).
Healthcare Providers sign a data processing agreement with uMed, which legally allows the sharing of data on a patient’s behalf in order to provide them with individualised care and offer research opportunities to take part in. This is also the legal basis for us to process patient data on behalf of their Healthcare Providers (the controller of the data).
Data is provided to uMed by GPs, in order to provide a service under a Data Process Agreement. uMed cannot use the data for research purposes itself, only under the direction of the data controller (GP practice), who may agree to participate in a specific study that may require CAG approval.
uMed, acting on behalf of the Healthcare Providers, ensures that the duty of confidence owed to the patient is respected. uMed has achieved this by creating a system that ensures no patient information is visible to any uMed employees or any subscribers to the uMed Platform unless patient consent has been obtained. The only exception to this, is when the uMed clinical support team contacts patients as a subcontracted member of the direct care team for which there is extensive precedent.
In addition to these controls, there is a well-established precedent and an exception to the duty of confidentiality for data disclosed to processors when the data is used to support direct care (implied consent).
No. uMed simply provides a technology service to support an array of academic and commercial studies, which can be both observational and interventional. There is no exclusivity, and the practice is free to participate in other studies as usual.
uMed provides a dedicated patient helpline designed to support patients throughout the process and reduce the pressure of incoming calls for your practice staff related to the study.
Patients remain in charge of their data at all times and can opt out of contact, sharing data, or study participation at any time. We will not contact patients who have registered for the national data opt-out. Patients can contact the uMed support line and withdraw from the study or just opt out to be contacted for further research opportunities.
uMed, on some occasions, may send out feedback surveys about our services to ensure our systems and services can be improved. In these situations, we always ask permission to do this when you complete the survey. You also can look at our Privacy Policy for more detail on how we handle your data. Further information on this can also be found on the NHS link What is and isn’t direct marketing?
hello@umed.io
