Expert Live Chat Privacy Notice
Effective: 24 July 2026
This notice applies only to the Expert Live Chat service. No AI-generated or automated chat responses are provided through this service.
PRIVACY AT A GLANCE
Epical Global Ltd is responsible for personal information processed within Expert Live Chat. The service is delivered by regulated healthcare professionals through the Crisp chat platform. You can use the chat without giving us your name or email, although technical identifiers such as an IP address may still be personal information. Business Customers do not receive identifiable chat conversations; they receive only anonymous and aggregated reporting.
1. Who we are
Expert Live Chat is operated by Epical Global Ltd, company number 12065790, registered office: 82A James Carter Rd, Mildenhall, Suffolk, IP28 7DE.
Epical Global Ltd is registered with the Information Commissioner's Office under registration number ZA784751.
For personal information processed within Expert Live Chat - including the clinical conversation, professional advice, clinical governance and retention of the chat record - Epical Global Ltd acts as the data controller. This means we decide why and how that information is used.
Where Expert Live Chat is accessed through another organisation's website or platform (a "Business Customer"), that Business Customer is separately responsible for personal information it collects through its own website or services. It does not have access to identifiable Expert Live Chat conversations and cannot instruct Epical Global Ltd to alter, access, retain or delete an individual clinical conversation. Business Customers receive only anonymous and aggregated reports.
2. Who this notice applies to
This Privacy Notice applies to people who use Expert Live Chat ("End Users") and to representatives of organisations that purchase, integrate or administer the service ("Business Customers").
The service is intended for people aged 16 and over. It is not intended for use by children under 16. Adult End Users may provide information about their baby or child where relevant to their question; that information is also protected under this Privacy Notice.
3. Personal information we collect
Information from End Users
You may use the chat without providing your name or email address. If you choose to identify yourself, we may collect your name and email address. Even where you do not provide identifying details, technical information such as an IP address may still constitute personal information.
Depending on what you choose to tell us, we may process:
· chat messages, conversation history, timestamps and the subject of your question;
· pregnancy stage or estimated due date;
· a baby's date of birth or age;
· medical, pregnancy and birth history relevant to the conversation;
· photographs, documents or test results that you choose to upload;
· feedback, satisfaction scores and comments about the service;
· IP address, device and browser information, session information and approximate country or regional location; and
· the regulated healthcare professional's advice, any follow-up or correction, and the final resolution of the conversation.
We do not ask for telephone number, date of birth, NHS number, GP or maternity-team details, medication details, login credentials or payment information as standard End User fields. However, if you voluntarily include any of this information in a free-text message or upload, it will form part of the chat record.
Information from Business Customers
For Business Customers and their representatives, we may collect:
· organisation name, business contact details and authorised representative information;
· contract, service configuration and account-administration information;
· billing, transaction and accounting information; and
· correspondence, support requests and service-management records.
4. Special category health information
Information about pregnancy, maternal health, medical history, birth and infant health is health information and is treated as special category personal data under UK data protection law.
We process this information where it is necessary to provide healthcare advice and support, maintain an appropriate clinical record, and manage the quality and safety of the healthcare service. This processing is carried out by, or under the responsibility of, regulated healthcare professionals who are subject to professional confidentiality obligations.
Our principal special-category condition for this processing is Article 9(2)(h) UK GDPR (health or social care), together with Schedule 1 condition 2 of the Data Protection Act 2018. Other conditions may apply where necessary, for example for legal claims, vital interests or where disclosure is required by law.
5. How Expert Live Chat works
Expert Live Chat is a human-to-human text chat service. It does not provide AI-generated or automated responses.
Clinical information and advice are provided by appropriately regulated healthcare professionals, including NMC-registered midwives and, where appropriate, professionals regulated by the Health and Care Professions Council (HCPC).
The professional can see the conversation and uses the information you provide to respond within their professional competence and the scope of the service. The chat is retained as part of the clinical and audit record.
6. Why we use personal information and our lawful bases
We only use personal information where we have a lawful basis. The principal bases relevant to Expert Live Chat are set out below.
Where we rely on legitimate interests, we assess the purpose, necessity and impact on your rights and freedoms. You may contact our Data Protection Lead if you would like more information about this assessment.
We do not rely on consent as the principal UK GDPR lawful basis for providing direct healthcare support. This is separate from any clinical or professional consent that may be relevant to care itself.
7. How we use information to improve the service
We may use anonymised or aggregated information to understand recurring questions, evaluate service quality, identify themes and improve Expert Live Chat. Where information is processed in order to anonymise it, access is restricted and the minimum information necessary is used.
Business Customers may receive anonymous and aggregated maternal-health insights, trend information and service-usage analytics. They do not receive identifiable chat transcripts or information that is intended to identify an individual End User.
8. Who we share personal information with
Personal information is only shared where necessary for the purposes described in this notice. Recipients may include:
· NMC-registered midwives, HCPC-regulated professionals and authorised Epical Global Ltd personnel who need access to provide, govern or support the service;
· Crisp IM SAS, our chat-platform provider, which processes chat content and related technical information on our behalf. Crisp Enrich and Crisp's optional AI features are disabled;
· professional advisers, insurers, auditors and legal advisers where necessary for governance, complaints, incidents, claims or legal obligations; and
· regulators, courts, law-enforcement bodies, emergency services or other authorities where disclosure is required or permitted by law.
Crisp hosts and processes chat information on our instructions. Its personnel do not routinely access End User conversations; any access by Crisp personnel is contractually restricted to authorised access necessary to provide or support the platform and is subject to confidentiality and security controls.
Where you ask us to share information, or give consent to sharing with your healthcare team or another service, we will only share information that is reasonably necessary. In exceptional safeguarding or emergency circumstances, we may disclose information where we are legally permitted or required to do so. Our ability to take action may be limited if you have used the chat anonymously or we do not know your location.
9. International processing and transfers
Our core chat content is hosted and processed within Europe. Crisp IM SAS is based in France, with encrypted backup infrastructure described by Crisp as being located in Ireland.
Where personal information is transferred outside the UK to a country that is not covered by UK adequacy regulations, we use an appropriate lawful transfer mechanism, such as the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another safeguard permitted by UK data protection law.
10. How long we keep information
We keep personal information only for as long as necessary for the purpose for which it was collected and to meet clinical, professional, legal, insurance and regulatory requirements.
If information is fully anonymised so that it can no longer identify an individual, it is no longer personal information and may be retained for statistical, research, governance or service-improvement purposes.
11. Security
We use technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
Measures relevant to the service include:
· encryption of data in transit and at rest;
· role-based and need-to-know access controls;
· confidentiality requirements for personnel with access to health information;
· background checks for personnel with sensitive-data access where appropriate;
· formal incident-response and personal-data-breach procedures;
· security and contractual controls applying to Crisp and other authorised processors; and
· a maintained Data Protection Impact Assessment (DPIA) covering the Expert Live Chat service.
No online service can guarantee absolute security. We regularly review our safeguards and update them where necessary to reflect risk, technology and legal requirements.
12. Your data protection rights
Depending on the circumstances, you may have the right to ask us to:
· give you access to the personal information we hold about you;
· correct inaccurate or incomplete information;
· erase personal information where the right to erasure applies;
· restrict the way we use your information;
· provide certain information in a portable format where the right to data portability applies; and
· object to processing based on legitimate interests.
Some rights are not absolute. In particular, we may need to retain healthcare, complaint, legal or regulatory records even where you ask for deletion. We will explain any restriction that applies when we respond to your request.
If you used the chat without providing identifying information, we may need enough information to locate the relevant record, such as an email address you provided, a conversation reference or approximate date and time. We will not ask for more information than reasonably necessary to verify your identity and locate the record.
To exercise your rights, contact our Data Protection Lead at joanne.parkington@ericaai.co.uk. We normally respond within one month, subject to any lawful extension for complex or multiple requests.
13. Data protection complaints
If you are concerned about how we have used your personal information, you can make a data protection complaint directly to our Data Protection Lead at joanne.parkington@ericaai.co.uk.
We will acknowledge a data protection complaint within 30 days of receiving it. We will take appropriate steps to investigate and respond without undue delay, keep you informed where appropriate, and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection. Information about making a complaint is available at www.ico.org.uk.
14. Children
Expert Live Chat is intended for users aged 16 and over. We do not knowingly offer the service directly to children under 16.
An adult End User may discuss a baby or child and may provide information about that child where relevant. We will process that information only where necessary for the service and in accordance with this Privacy Notice.
If we become aware that a person under 16 has provided personal information through the service, we will assess the appropriate action in light of the circumstances, the individual's safety and any legal, clinical or record-keeping obligations.
15. Changes to this Privacy Notice
We may update this Privacy Notice where our service, technology, suppliers, legal obligations or data-processing practices change. The effective date at the beginning of the notice shows when this version took effect. Material changes will be brought to users' attention in an appropriate way.
16. Contact us
Data Protection Lead
Epical Global Ltd
82A James Carter Rd, Mildenhall, Suffolk, IP28 7DE
Email: joanne.parkington@ericaai.co.uk
ICO registration number: ZA784751
