pH7 Compliance: Legal and Regulatory Information (United Kingdom)

pH7 Regulatory Compliance Framework

United Kingdom

This document provides an overview of the regulatory framework within which pH7 operates in the United Kingdom. It describes the respective responsibilities of pH7, independent healthcare providers, prescribing clinicians and partner pharmacies.

1. Platform Role

pH7 is a digital healthcare technology platform.

pH7 is not:

  • a healthcare provider;

  • a prescribing entity;

  • a pharmacy;

  • a manufacturer or wholesaler of medicines; or

  • responsible for clinical decision-making.

The platform enables patients to access independent healthcare providers and facilitates secure communication between patients, clinicians and pharmacies.

Clinical responsibility remains solely with the treating clinician.

Responsibility for dispensing medicines remains solely with the dispensing pharmacy.

2. Clinical Governance

Independent Medical Practitioners

All prescribing clinicians using the platform:

  • are independently responsible for their own clinical practice;

  • are registered with the General Medical Council (GMC);

  • hold the qualifications required for the services they provide;

  • practise through appropriately regulated healthcare providers; and

  • remain solely responsible for diagnosis, prescribing decisions, treatment plans and patient follow-up.

pH7 does not influence or interfere with clinical decision-making, prescribing decisions or medicine selection.

Regulated Healthcare Providers

Where required by law, healthcare providers delivering regulated activities are registered with the Care Quality Commission (CQC).

Each healthcare provider remains responsible for:

  • clinical governance;

  • patient safety;

  • prescribing governance;

  • complaints handling;

  • safeguarding; and

  • compliance with all applicable healthcare legislation.

3. Pharmacy Compliance

All dispensing pharmacies using the platform are independently responsible for compliance with applicable pharmaceutical legislation.

Partner pharmacies are expected to:

  • maintain registration with the General Pharmaceutical Council (GPhC);

  • verify the validity of prescriptions before dispensing;

  • comply with controlled drug legislation;

  • maintain dispensing records;

  • comply with professional standards; and

  • operate appropriate medicines governance procedures.

Dispensing decisions remain entirely with the pharmacy.

4. Remote Consultations and Prescribing

The platform supports remote consultations conducted by independent clinicians.

pH7 provides secure technology to facilitate consultations but does not participate in clinical assessments or treatment decisions.

Where controlled medicines are prescribed, prescribing clinicians remain responsible for ensuring compliance with:

  • Human Medicines Regulations 2012;

  • Misuse of Drugs Regulations 2001;

  • GMC guidance on Good Medical Practice;

  • GMC guidance on remote prescribing; and

  • any applicable specialist clinical guidance.

Prescriptions are issued, transmitted and dispensed in accordance with applicable UK legislation and the operational requirements of the prescribing clinician and dispensing pharmacy.

5. Identity Verification

Prior to consultation, patients complete an identity verification and onboarding process.

The platform facilitates collection of information required by the treating clinician, including:

  • identity information;

  • contact information;

  • relevant medical history;

  • supporting documentation; and

  • patient declarations and consent.

This information is securely transmitted to the treating clinician.

Clinicians determine whether sufficient information exists to proceed with consultation or prescribing.

6. Information Governance

UK GDPR and Data Protection Act 2018

pH7 processes personal information in accordance with:

  • UK General Data Protection Regulation (UK GDPR);

  • Data Protection Act 2018; and

  • applicable Information Commissioner's Office (ICO) guidance.

Processing activities are based on appropriate lawful bases including:

  • performance of a contract;

  • compliance with legal obligations;

  • explicit consent where required; and

  • legitimate interests where applicable.

Data Minimisation

Only information necessary to provide platform services is collected.

This may include:

  • patient name;

  • contact details;

  • address;

  • date of birth;

  • identity verification;

  • appointment information;

  • prescription fulfilment information; and

  • information required by treating clinicians.

Special Category Data

Health information constitutes Special Category Personal Data.

Such information is processed only where permitted under UK GDPR and with appropriate safeguards.

Data Protection Impact Assessments (DPIAs) are undertaken where required.

Data Subject Rights

Patients may exercise their rights under UK GDPR including:

  • access;

  • rectification;

  • erasure (where applicable);

  • restriction;

  • objection; and

  • data portability.

7. Information Security

pH7 applies appropriate technical and organisational measures to protect information.

Security controls include:

  • encryption in transit;

  • encryption at rest;

  • role-based access controls;

  • audit logging;

  • authentication controls;

  • secure hosting environments;

  • vulnerability management; and

  • regular security reviews.

Access to information is limited according to operational need and least-privilege principles.

8. Financial Compliance

Payments processed through the platform utilise regulated payment service providers operating within applicable UK financial services legislation.

Appropriate controls are maintained relating to:

  • payment security;

  • fraud prevention;

  • customer verification where applicable; and

  • financial record keeping.

9. Product Information

The platform does not advertise or promote prescription-only medicines directly to patients.

Where a product catalogue is made available, access occurs only where permitted by the treating clinician and applicable law.

Treatment options remain entirely at the discretion of the independent prescribing clinician.

10. Consent Management

The platform maintains records of patient consent where required.

Consent records include, where applicable:

  • platform terms;

  • privacy notices;

  • communications preferences;

  • consultation consent; and

  • processing of Special Category Personal Data.

Consent records are retained in accordance with applicable legal and regulatory requirements.

11. Audit and Compliance

The platform maintains audit logs supporting:

  • patient onboarding;

  • clinician access;

  • appointment activity;

  • prescription workflows;

  • consent records;

  • pharmacy interactions; and

  • administrative actions.

Audit information assists participating healthcare providers in meeting their own governance obligations.

12. Continuous Regulatory Compliance

pH7 continuously reviews its governance framework to support compliance with evolving regulatory requirements.

Policies, procedures and technical controls are reviewed periodically to reflect developments in:

  • healthcare regulation;

  • data protection;

  • cybersecurity;

  • digital health standards; and

  • clinical best practice.