We put privacy and security first and our priority is to ensure that patients and healthcare providers have full transparency and control over the use of their data.
uMed is a clinical research and health technology company that partners with healthcare professionals to deliver research opportunities.
To allow us to send communications to patients on behalf of Healthcare Providers, we process patient data to our secure uMed platform. This data includes coded medical records, names, contact details, and demographics, as well as any communication back from patients, such as answers to questionnaires or patient replies to text messages.
uMed keeps patient data secure by separating personally identifiable information (PII) from health data. These are stored in distinct databases, connected through a secure coded identifier managed within the uMed platform. Only authorised systems and personnel with a legitimate purpose can access linked data under strict governance controls. This structure ensures a very high standard of data privacy and protection.
The uMed platform fully integrates with EMIS and System One through the Message Exchange for Social Care and Health (MESH) NHS Digital-approved system.
Our software is approved and audited by NHS Digital Data Security, and Protection Toolkit assured (ODS8K677), ISO27001:2022 and ISO9001:2015 certified, UK Government’s Cyber Essentials Plus, Crown Commercial Service approved supplier, and UK GDPR compliant.
uMed has been developed to enable Healthcare Providers to participate in clinical research whilst removing the associated administrative burden.
Getting started – Our onboarding process takes on average 15 minutes and involves the review and signing of our Data Processing Agreement (DPA) and the provision of ODS codes. Our support team is available to help along the way and discuss any part of the process.
Participating in a study – Once set up, we will start presenting relevant study opportunities for patients in your practice in our web-based application. To participate in a study, we require you to review and approve study documents in our web app (~10 minutes).
uMed searches, identifies, and builds the list of research eligible patients from your practice based on de-identified health record data. Our web app allows a member of your practice staff to review and approve the list of patients identified as eligible for the study.
Patients are contacted via SMS (or email or letter if appropriate) and can complete the consent process remotely and electronically. We also provide a dedicated patient helpline designed to support patients throughout the process and reduce the pressure of incoming calls for your practice staff related to the study.
The agreement details how uMed will process data on behalf of the practice, both for research and direct care programmes. This includes processing to:
a)a Match potential subjects in the practice population with study opportunities for review by the practice.
b)b If approved by the practice, engagement of those patients on behalf of the practice to support recruitment and data capture.
c) If approved by the practice, linkage of outcomes from the clinical record to the study case report form (CRF).
It is important to note that this is not a data-sharing agreement. As a data processor, uMed cannot share or utilise practice data unless explicit permission is obtained from the practice (the data controller). In the same way, other NHS processors such EMIS, Apollo, Accurx, and other technology vendors cannot use practice data outside of that defined in their service agreement with practices.
The DPA is required to legally allow your practice to share patient data in order to provide patients with individual care and offer them research opportunities to take part in. This is also the legal basis for uMed to process patient data on behalf of their Healthcare Providers (the controller of the data).
Healthcare Providers sign a Data Processing Agreement (DPA) with uMed, which legally allows the sharing of data on a patient’s behalf in order to provide them with individualised care and offer research opportunities to take part in. This is also the legal basis for us to process patient data on behalf of their Healthcare Providers (the controller of the data).
Data is provided to uMed by Healthcare Providers, in order to provide a service under a Data Processing Agreement (DPA). uMed cannot use the data for research purposes itself, only under the direction of the data controller (GP practice), who may agree to participate in a specific study that may require CAG approval.
uMed, acting on behalf of GP practices (the data controllers), ensures that the common law duty of confidence owed to patients is respected at all times.
Patient-identifiable information is only accessed by a limited number of authorised uMed clinical support staff (qualified and trained nurses) for the specific purpose of contacting patients who may be eligible to participate in ethically approved research studies. All access is strictly controlled, role-based, and recorded in a full audit trail.
The primary legal basis for uMed to receive and process identifiable patient data without prior consent is provided by:
- A Data Processing Agreement (DPA) with each participating GP practice, and
- Approval from the Health Research Authority’s Confidentiality Advisory Group (CAG) under Section 251 of the NHS Act 2006.
This approval authorises the use of confidential patient information to identify and invite eligible patients to research studies where it is not practicable to seek consent before initial contact.
In addition to these legal gateways, uMed applies strong technical and organisational safeguards, including pseudonymisation of data at source, encryption in transit and at rest, segregation of personal identifiers from clinical data, and rigorous access controls. These measures ensure that patient confidentiality is protected to the highest NHS standards.
No. uMed simply provides a technology service to support an array of academic and commercial studies, which can be both observational and interventional. There is no exclusivity, and the practice is free to participate in other studies as usual.
uMed provides a dedicated patient helpline designed to support patients throughout the process and reduce the pressure of incoming calls for your practice staff related to the study.
Patients remain in charge of their data at all times and can opt out of contact, sharing data, or study participation at any time. We will not contact patients who have registered for the national data opt-out. Patients can contact the uMed support line and withdraw from the study or just opt out to be contacted for further research opportunities.
uMed, on some occasions, may send out feedback surveys about our services to ensure our systems and services can be improved. In these situations, we always ask permission to do this when you complete the survey. You also can look at our Privacy Policy for more detail on how we handle your data. Further information on this can also be found on the NHS link What is and isn’t direct marketing?
Changes to this notice
Last updated: 27 May, 2026
hello@umed.io
