1. Who we are
| Data controller | Ronald Carter, trading as RapidMed Services |
|---|---|
| Based in | Leiston, Suffolk, United Kingdom. Our full postal address is available on request by email. |
| Data protection contact | events@rapidmed.co.uk · 07704 805 511 |
| ICO registration | ZC225027 |
RapidMed Services provides professional event medical cover and pre-hospital care training. RapidMed Events delivers insured, clinically documented medical cover for public events. RapidMed Training runs an online CPD community and delivers training sessions.
2. What personal data we collect
2.1 Patients and event attendees — clinical records
If we treat you at an event, we record:
- Name, date of birth, age and gender
- Clinical history relevant to the presenting condition
- Observations, assessment findings and treatment provided on the day
- Details of any medication administered or recommended
- Details of escalation or handover to other healthcare providers or 999
- Contact information where you provide it voluntarily during treatment
2.2 Clients and event organisers
- Organisation name, contact name, address, email and phone number
- Event details provided while planning and delivering the service
- Invoice and payment records
2.3 Enquiries and quotes
When you contact us by email, phone, the enquiry form, or a QR code on our printed material, we collect the details you provide — typically your name, contact details, organisation and information about your event or training requirement. We use this to respond to you, prepare risk assessments and quotes, and enter into a contract with you.
2.4 Second responders and associates
- Full name, address and contact details
- Qualifications and certification documents (FREC 3/4, FAW, AED and similar)
- CPD records and evidence of ongoing competency
- National Insurance number and bank details, for payment
- Insurance policy details and certificate of cover
- Emergency contact details
2.5 RapidMed Training members
- Name and email address, required to create an account
- Payment information, processed by Skool and Stripe — we do not store card details
- CPD activity and progress records
2.6 Website technical data
This is a static website hosted by Netlify, Inc. Netlify's infrastructure automatically processes standard server logs — IP address, browser type, pages requested — to deliver and secure the site. We do not run analytics on this website and we do not set marketing or tracking cookies.
3. Legal basis for processing
| Data category | Lawful basis | Special category condition |
|---|---|---|
| Patient clinical records | Vital interests — Art 6(1)(d) | Health or social care — Art 9(2)(h) |
| Client and organiser data | Contract — Art 6(1)(b), and legitimate interests — Art 6(1)(f) | Not applicable |
| Enquiries | Steps to enter a contract — Art 6(1)(b), and legitimate interests — Art 6(1)(f) | Not applicable |
| Second responder data | Contract — Art 6(1)(b), and legal obligation — Art 6(1)(c) | Not applicable |
| Training member data | Contract — Art 6(1)(b), and consent where applicable | Not applicable |
| Event photography | Legitimate interests — Art 6(1)(f) | Not applicable — no patient or clinical images are taken |
4. How we use your data
- To provide clinical care and treatment at events, and to produce Patient Report Forms
- To hand over clinical information to the emergency services where required
- To produce post-event incident reports for event organisers — anonymised unless consent is given
- To respond to enquiries, prepare risk assessments and issue written quotes
- To manage working relationships with second responders and associates
- To issue invoices and process payments
- To deliver RapidMed Training and track member progress
- To comply with legal and regulatory obligations, including HSE, RIDDOR and the ICO
- To respond to complaints or legal claims
5. Who we share it with
We do not sell personal data to anyone, and we do not share it for marketing purposes. We share it only where it is necessary:
- Emergency services — East of England Ambulance Service, Police, Fire — where required for patient care or legal reporting
- NHS hospitals and other healthcare providers — for patient handover where treatment is escalated
- The Health and Safety Executive — for RIDDOR-reportable incidents
- Another medical provider — where an event is beyond the scope we can safely cover and, with the organiser's agreement, we refer it on. We pass only the event details needed to make the introduction. No patient data is ever shared this way
- Our insurer — Balens Ltd / Zurich Insurance — in the event of a claim
- ARAG Legal Expenses — in the event of a legal dispute
- Service providers — Netlify for website hosting, Skool Inc. for the training platform, and our email provider
- Where the law requires disclosure
6. How long we keep it
| Record type | Retention period | Basis |
|---|---|---|
| Patient Report Forms — adults | 8 years from date of treatment | NHS Records Management Code 2021 |
| Patient Report Forms — children | Until the patient's 25th birthday, or 26th if treated at age 17 | NHS Records Management Code 2021 |
| Deceased patient records | 10 years from date of death | NHS Records Management Code 2021 |
| Serious incident / RIDDOR records | 10 years | Legal obligation |
| Second responder personnel files | Engagement + 6 years | Limitation Act 1980 |
| Second responder qualifications and CPD | Engagement + 1 year | Governance |
| Client and event organiser records | 6 years from last transaction | HMRC, tax and contractual |
| Invoices and payment records | 6 years plus the current year | HMRC legal obligation |
| Enquiries that do not lead to a booking | 12 months | Legitimate interests |
| RapidMed Training member data | Membership + 1 year | Contract |
Our full schedule is set out in our Data Retention Policy, available on request.
7. Security and where your data is stored
- Patient Report Forms are held in a locked physical file and/or encrypted digital storage, with access restricted to Ronald Carter
- Digital records are held on password-protected, encrypted devices
- Second responder personnel files are held securely and are not shared without consent
- In the event of a data breach, affected individuals and the ICO will be notified within 72 hours where the law requires it
We do not transfer personal data outside the UK except where the receiving country provides adequate protection. Our website host (Netlify, Inc.) and the training platform (Skool Inc.) are US companies, and those transfers rely on the UK Extension to the EU–US Data Privacy Framework and/or standard contractual clauses.
8. Your rights
| Right | What it means | How to exercise it |
|---|---|---|
| Access | Request a copy of the personal data we hold about you | Email us — we respond within one month |
| Rectification | Ask us to correct inaccurate data | Email us with the correction required |
| Erasure | Ask us to delete your data in certain circumstances | Email us. We may be unable to erase records we are legally required to keep, such as clinical records |
| Restriction | Ask us to restrict processing | Email us stating the basis for your request |
| Portability | Receive your data in a machine-readable format | Email us — applies to data you gave us under consent or contract |
| Objection | Object to processing based on legitimate interests | Email us — we will assess whether our interests override yours |
| Withdraw consent | Where processing relies on consent, withdraw it at any time | Email us — withdrawal does not affect processing already carried out |
To exercise any of these rights, email events@rapidmed.co.uk. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. You can also raise it with us first through our Complaints Procedure.
9. Photography at events
We photograph our own set-up, equipment and vehicles at events to show the standard of service we provide. Our lawful basis is legitimate interests.
We do not photograph patients. No image showing a patient, a person receiving or awaiting treatment, or any clinical intervention is ever captured, retained or published — whether or not the person is identifiable.
We do not publish images in which a member of the public is individually identifiable without that person's consent. General wide-angle scene images may be used where no individual is the subject. Event organisers may withhold or withdraw permission for images of their event at any time. You may object to our use of an image of you by emailing us; where we agree, or where we are required to, we will remove it from our website and social media within 5 working days.
10. Children and young people
This website and our commercial services are directed at adults — event organisers, businesses, councils, charities, schools and healthcare professionals. We do not knowingly collect personal data from children through this website.
We may, however, treat a child as a patient at an event. Where that happens we record clinical information as set out in section 2.1, retain it as set out in section 6, and handle it in line with our Safeguarding Policy.
11. Cookies and online services
This website sets no cookies of its own and runs no analytics. The RapidMed Training platform is hosted by Skool Inc., whose own privacy and cookie policies apply to data processed through that platform. We do not control Skool's data processing — members should review Skool's privacy policy.
12. Changes to this notice
We review this notice at least annually and update it whenever our data processing changes materially. The version number and effective date at the top of this page always show the current version.