Platform privacy notice

Working draft pending legal review (WP0.9).

This notice covers the information the platform operator processes as a responsible party for its own purposes. It does not cover patient information: for patient information the operator acts only for each practice, as its operator, and each practice publishes its own privacy notice.

1. What we collect. For practice accounts: names, e-mail addresses and phone numbers of practice owners and staff; HPCSA registration details and verification evidence for practitioners; practice details such as legal entity, VAT number, practice number and addresses; billing details for the subscription; sign-in, security and audit records; and support conversations.

2. Why. To set up and verify practices, run and secure the platform, bill the subscription, give support, and meet legal duties.

3. Patient information is never used for these purposes. We do not use patient information for our own analytics, marketing, product training or any purpose of our own.

4. Marketing. We do not name a practice, use its logo or tell its story without its written consent, and our marketing makes no promise about the National Health Insurance scheme.

5. Where it is kept. With our sub-processors listed on the sub-processor page, currently in the United Kingdom (London). The legal basis for that transfer is set out on the same page.

6. How long. For as long as the practice account exists, then for the periods the law requires.

7. Your rights. You may ask for access to, correction of, or deletion of your information, and you may object or complain to the Information Regulator. Contact the platform Information Officer through the help centre.