Privacy Policy

EveryClinic Ltd ("EveryClinic", "we", "our" or "us") is committed to protecting personal data and ensuring that personal data is processed lawfully, fairly, transparently and securely.

This Privacy Policy establishes the internal framework by which EveryClinic manages personal data throughout its lifecycle. It supports compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, applicable Information Commissioner's Office (ICO) requirements and other applicable data-protection obligations.

This Policy is intended to ensure that EveryClinic:

• processes personal data lawfully, fairly and transparently;
• collects and uses personal data only for specified and legitimate purposes;
• applies data minimisation and accuracy principles;
• protects personal data against unauthorised access, loss, alteration or disclosure;
• retains personal data only for as long as necessary;
• respects applicable data-subject rights;
• manages suppliers and data-sharing arrangements appropriately;
• assesses and manages privacy risks through appropriate governance; and
• responds appropriately to personal data incidents and breaches.

This Policy operates together with the EveryClinic Privacy Notice, ROPA, DPIA, Data Retention and Data Deletion Policy, Incident Response & Personal Data Breach Management Policy, International Data Transfer Policy, Clinic Data Protection & Platform Participation Agreement, and EveryClinic Master Security Controls Document.

This Policy applies to personal data processed by EveryClinic in connection with the operation and provision of the EveryClinic platform.

It applies to:

• employees;
• contractors;
• authorised users;
• management;
• IT and technical personnel;
• the Data Protection Officer (DPO); and
• relevant suppliers, processors and service providers.

EveryClinic Ltd acts as the Data Controller for personal data processed for its own platform purposes, including account administration, bookings, communications, support, payment-related administration, security, provider management, reviews, analytics and legal or regulatory purposes.

EveryClinic does not ordinarily store patients' full clinical records, consultation notes, diagnoses, treatment histories, medication records or other detailed clinical health information. However, booking, appointment, service or specialty information may in some circumstances reveal or allow an inference about an individual's health. Where such information constitutes Special Category Data, EveryClinic will identify and document the applicable Article 6 lawful basis and Article 9 condition.

Clinics and healthcare providers are therefore not automatically processors of EveryClinic merely because EveryClinic facilitates a booking. Their own healthcare processing may be subject to separate privacy notices, confidentiality obligations and information-governance requirements.

The DPO is responsible for overseeing privacy compliance, advising on data protection matters, supporting data-subject rights, maintaining or overseeing relevant privacy documentation, and monitoring compliance.

EveryClinic maintains appropriate technical and organisational measures to protect personal data processed through its platform. The detailed security requirements, responsibilities and assurance expectations applicable to the platform are maintained in the EveryClinic Master Security Controls Document. Clinics and healthcare providers remain responsible for the security and lawful processing of clinical information held within their own systems.

EveryClinic will process only personal data that is necessary and proportionate for its identified purposes.

Depending on the individual's interaction with the platform, EveryClinic may process:

• name;
• date of birth;
• gender;
• email address;
• telephone number;
• booking and appointment information;
• Clinic, healthcare provider and service selected;
• communications, enquiries, feedback and complaints;
• reviews and user-generated content;
• IP address;
• device and browser information;
• approximate location information;
• cookie and analytics information;
• security and access information;
• Clinic/provider business, registration, insurance and practitioner information; and
• information required for legal, regulatory, compliance, fraud-prevention or dispute purposes.

Some booking, appointment, service or specialty information may, depending on the circumstances, reveal or allow an inference about an individual's health. EveryClinic does not ordinarily collect or maintain clinical records, consultation notes, diagnoses, treatment histories, medication records or other detailed clinical health information.

The current ROPA identifies processing activities including account and booking management, communications and support, provider management, reviews and complaints, security and fraud prevention, legal/compliance activities and backup/disaster recovery.

EveryClinic applies technical and organisational controls appropriate to the nature and sensitivity of the personal data processed. These controls support data minimisation, restricted access, secure handling, monitoring and appropriate retention and deletion practices. Detailed internal control requirements are maintained in the EveryClinic Master Security Controls Document.

EveryClinic applies data minimisation and will not collect or retain information merely because it may be useful in the future. EveryClinic does not undertake cross-organisational data linkage for the purpose of identifying otherwise unidentified individuals. EveryClinic does not currently use patient profiling, AI or purely automated decision-making to make decisions about patients.

EveryClinic processes personal data only where there is a lawful basis under Article 6 of the UK GDPR. Depending on the purpose of processing, we may rely on one or more of the following lawful bases:

• Performance of a contract: Where processing is necessary to provide our services, manage your account, facilitate bookings, or process payments.
• Legitimate interests: Where processing is necessary for our legitimate business interests, such as maintaining and improving the Platform, ensuring security, preventing fraud, and managing our business, provided that these interests do not override your rights and freedoms.
• Legal obligation: Where processing is necessary for us to comply with a legal or regulatory obligation.
• Consent: Where we have obtained your consent to process your personal data for a specific purpose. You may withdraw your consent at any time where consent is the lawful basis relied upon.
• Vital interests: Where processing is necessary to protect the vital interests of an individual in circumstances permitted by applicable law. This basis is not expected to be routinely relied upon by EveryClinic.

Special Category Data

EveryClinic does not ordinarily collect or store patients' clinical records, consultation notes, diagnoses, treatment histories, medication records or other detailed clinical health information. However, booking, appointment, service or specialty information may in some circumstances reveal or allow an inference about an individual's health. Where information processed by EveryClinic constitutes Special Category Data under Article 9 of the UK GDPR, EveryClinic will ensure that an applicable Article 9 condition is identified in addition to an appropriate Article 6 lawful basis before such processing is undertaken.

EveryClinic will share personal data only where there is a legitimate and documented purpose for doing so.

Personal data may be shared with:

• the Clinic or healthcare provider selected by the patient, where necessary to administer the booking;
• authorised payment providers, including Stripe, where payment is required;
• cloud and infrastructure providers, including AWS;
• Resend is used to process information submitted through the EveryClinic contact form. Resend is not used for booking confirmations, patient notifications, account communications or general email delivery.
• AWS, which provides cloud infrastructure, database hosting and email delivery services for EveryClinic notifications, messages and emails to patients;
• analytics and service-improvement providers, including Google Analytics;
• professional, legal or regulatory advisers where necessary;
• regulatory authorities where required or permitted by law; and
• other recipients where disclosure is lawful and necessary for the relevant purpose.

EveryClinic does not store full payment card numbers. Payment card information is processed by the authorised payment provider, while EveryClinic retains relevant payment and transaction information where necessary.

Where a third party acts as a processor, EveryClinic will maintain appropriate contractual arrangements addressing applicable Article 28 requirements, confidentiality, security, sub-processors, data-subject rights, breach notification and deletion or return of personal data.

EveryClinic will maintain appropriate supplier and processor due diligence and a current sub-processor register.

Where personal data is subject to a restricted international transfer, EveryClinic will ensure that an appropriate UK lawful transfer mechanism and safeguards are in place, such as adequacy arrangements, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses or another legally recognised mechanism.

International processing locations and applicable transfer safeguards must be verified and documented before or when relevant supplier arrangements are introduced or materially changed. The current DPIA identifies verification of international-transfer arrangements for relevant suppliers as an ongoing compliance action.

Supplier and processor security requirements must be assessed and managed in accordance with EveryClinic's documented security and supplier-management controls. Relevant requirements, including access restrictions, confidentiality, security assurance, incident notification and evidence expectations, are maintained in the EveryClinic Master Security Controls Document.

International transfer assessments and safeguards must also be managed in accordance with the EveryClinic International Data Transfer Policy. Supplier processing locations, transfer mechanisms and relevant supplementary measures must be verified and recorded before or when a restricted international transfer is introduced or materially changed.

EveryClinic will implement appropriate technical and organisational measures proportionate to the risks associated with its processing of personal data.

Current security controls include, where applicable:

• encryption at rest;
• encryption in transit;
• AWS KMS encryption;
• TLS-secured communications;
• multi-factor authentication (MFA);
• role-based access controls;
• least-privilege access;
• restricted administrative access;
• access and security logging;
• monitoring;
• backup and recovery controls;
• vulnerability and security reviews;
• controlled supplier access; and
• staff confidentiality and data-protection requirements.

The Master Security Controls Document is an internal control framework and does not replace the responsibilities of individual staff members, suppliers, processors or Clinics under this Policy or applicable contractual arrangements.

EveryClinic recognises that staff and authorised personnel may encounter personal data relating to patients and healthcare bookings during the performance of their duties.

Although EveryClinic does not ordinarily store patients' full clinical or health records, staff must understand that information encountered in connection with the EveryClinic platform may be sensitive and may, in some circumstances, reveal information about an individual's healthcare needs.

EveryClinic will therefore provide appropriate data-protection and health-data awareness training to relevant staff and authorised personnel.

Training will cover, as appropriate:

• the principles of the UK GDPR and data protection;
• the difference between ordinary personal data and Special Category Data;
• the sensitivity of health and healthcare-related information;
• the fact that EveryClinic does not ordinarily store or maintain patients' clinical records;
• the distinction between EveryClinic's platform processing and clinical processing undertaken independently by Clinics and healthcare providers;
• confidentiality obligations when handling patient and booking information;
• data minimisation and purpose limitation;
• appropriate access to personal data and the principle of least privilege;
• secure handling and transmission of personal data;
• recognising inappropriate access, disclosure, loss or misuse of personal data;
• the requirement not to access clinical or health information unless specifically authorised and necessary for an approved function;
• recognising and reporting suspected personal data breaches;
• the internal incident-reporting and escalation process; and
• individual data-protection rights and the appropriate handling of data-subject requests.

Training will be provided as part of staff onboarding where relevant and refreshed periodically or when there is a material change to EveryClinic's processing, systems, legal requirements or identified privacy risks.

Training requirements will be aligned with the EveryClinic Master Security Controls Document and relevant privacy, incident-response and information-governance procedures. Records of completed training, refresher training and any identified training gaps will be maintained as appropriate for compliance and assurance purposes.

EveryClinic will maintain appropriate records demonstrating completion of required privacy and data-protection training.

Staff and authorised personnel must comply with confidentiality, access-control and data-protection requirements at all times. Failure to comply may result in appropriate corrective, disciplinary, contractual or access-control action.

EveryClinic will retain personal data only for as long as it is necessary for the relevant purpose or for another documented lawful purpose.

The standard retention controls include:

These periods are EveryClinic's documented retention controls and do not themselves represent retention periods mandated by the UK GDPR. Where information is no longer necessary, it will be securely deleted or irreversibly anonymised, subject to applicable lawful retention requirements.

Individuals may exercise applicable UK GDPR rights, including:

• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability; and
• the right to object.

The right to erasure is not absolute. EveryClinic may retain information where necessary to comply with a legal obligation, establish, exercise or defend legal claims, prevent fraud, resolve disputes, or satisfy another lawful exemption.

Where only part of a record must be retained, EveryClinic will delete or anonymise information that is no longer necessary and retain only the minimum information required.

Deleted information may temporarily remain in encrypted backups for the established rolling backup period. Backup copies will not be used for routine processing and will be permanently overwritten or securely deleted in accordance with the backup cycle.

EveryClinic maintains a formal Incident Response & Personal Data Breach Management Policy governing the identification, reporting, assessment, containment, investigation and management of personal data incidents.

The incident-management arrangements are supported by the EveryClinic Master Security Controls Document, which establishes relevant requirements for security monitoring, access logging, incident detection, escalation, containment, investigation, recovery, evidence preservation and post-incident review.

All employees, contractors and authorised personnel must report suspected security incidents or personal data breaches immediately through the designated internal reporting route. Personnel must not wait until they have confirmed that a breach has occurred before reporting it.

Where personal data may be involved:

• the incident will be triaged;
• the Security Lead will coordinate the response;
• the DPO will assess whether personal data is involved;
• appropriate containment and investigation will be undertaken;
• the risk to individuals will be assessed;
• the ICO notification requirement will be determined; and
• affected individuals will be notified where required by law.

Where a personal data breach is likely to result in a risk to individuals, EveryClinic will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, affected individuals will be notified without undue delay where required.

EveryClinic will maintain an Incident and Personal Data Breach Register recording personal data breaches regardless of whether they are reported to the ICO.

Where a supplier or processor experiences an incident affecting EveryClinic personal data, the supplier must notify EveryClinic without undue delay in accordance with the applicable contractual arrangements.

This Policy will be reviewed at least annually and sooner where required, including following:

• a significant personal data breach or security incident;
• a material change to EveryClinic's services or data flows;
• introduction of new categories of personal or Special Category Data;
• introduction of a new processor or sub-processor;
• changes to international transfer arrangements;
• material changes to retention periods or analytics configuration;
• introduction of AI, profiling or automated decision-making; or
• material changes to applicable data-protection legislation or regulatory guidance.

Related Documents

This Policy should be read together with the following documents, as applicable:

For privacy questions, data-protection requests or concerns, individuals may contact:

Data Protection OfficerEveryClinic LtdEmail: dataprotection@everyclinic.com

Individuals may also lodge a complaint with the Information Commissioner's Office (ICO) where they believe their data-protection rights have not been appropriately addressed.

Policy Owner: Data Protection OfficerApproved By: __________________Effective Date: __________________