Back to signup
Arete Medical · Privacy Policy

Privacy Policy

Draft — not reviewed legal content. This is a comprehensive working draft of the Privacy Policy, written to structure and substantially cover what the final document needs to say. It is not legal advice and has not been reviewed by a solicitor or Data Protection Officer. Bracketed items such as [Sole trader's full legal name pending] mark facts only Mitch can supply. This draft must be reviewed before this product is promoted publicly or used to process real patient data. See docs/features/ideas/terms-privacy-policy-legal-content.md.

Last updated: [date]. This Privacy Policy explains how [Sole trader's full legal name pending], trading as Arete Medical ("we", "us", "our"), collects, uses, and protects personal data in connection with Arete Medical Practice Management Software ("the Service"). Arete Medical is operated as a sole trader, of [business address pending] — there is no registered company; the individual proprietor is personally the data controller/processor described below. As a business that processes personal data, we are required to register with the Information Commissioner's Office (ICO) and pay the data protection fee; our ICO registration reference is [pending — required before go-live].

This policy covers two distinct relationships, because the Service is used both by the people who run a practice and, via them, to hold data about their own patients:

  • Section 1 — where we are the controller (your own account information as a practice admin/user).
  • Section 2 — where your practice is the controller and we act only as a processor (your patients' clinical data).

1. Arete Medical as Data Controller

Arete Medical acts as the data controller for the practice administrator's and Authorised Users' account information — such as name, work email address, phone number, and billing details — collected when you sign up and use the Service. We also collect basic technical/ usage data (e.g. login timestamps, IP address, browser type) for security and to diagnose issues.

We use this information to: create and administer your account; provide, maintain, and secure the Service; process subscription payments; respond to support requests; and send you service-related communications (e.g. security notices, changes to these policies). Our legal basis is performance of our contract with you (Article 6(1)(b) UK GDPR) for core account operation, and our legitimate interest in keeping the Service secure and functioning (Article 6(1)(f)) for technical/security data. We do not use your account data for third-party advertising, and we do not sell personal data.

2. Arete Medical as Data Processor

For patient data entered into the Service by a clinical user — including medical history, consent records, treatment notes, and clinical photographs, much of which is Special Category data under Article 9 UK GDPR — the practice is the data controller, and Arete Medical acts strictly as a data processor. We process that data solely on the practice's documented instructions and in accordance with the Data Processing Agreement in our Terms of Service. We do not access, use, or disclose patient data for our own purposes (e.g. we do not use it for our own marketing or analytics), except as strictly necessary to provide technical support at the practice's request.

If you are a patient of one of our customer practices and have questions about how your data is used, please contact your practice directly — they are the data controller and the right point of contact for exercising your rights under Section 6 below.

3. What we collect, in one place

  • Account data (we are controller): name, work email, phone, billing/payment details, login credentials (hashed), role/permissions.
  • Technical & usage data (we are controller): IP address, browser/device information, timestamps, and in-app action logs used for security, audit trails, and troubleshooting.
  • Patient data (your practice is controller, we are processor): whatever the practice enters — which may include contact details, medical/treatment history, consent records, and clinical photographs.

4. Sharing & sub-processors

We use a small number of infrastructure providers to deliver the Service, each acting as a sub-processor bound by their own data protection terms:

  • Hosting/application infrastructure — currently operated by us on our own infrastructure in the United Kingdom, so no third-party hosting provider has access to the data. Production will run on Scaleway (EU-based); we will update this list before that migration takes effect.
  • Database — PostgreSQL, operated within the hosting infrastructure above.
  • File storage (consent documents, treatment photographs) — S3-compatible object storage, currently self-hosted on the same infrastructure; moving to Scaleway Object Storage alongside the hosting migration above.
  • Email delivery (account and transactional emails) — Postmark, used for account and transactional email delivery.
  • Payment processing (practice subscriptions) — Stripe. Stripe receives your practice's billing and payment details; it does not receive Patient Data.

We do not sell personal data to third parties, and we do not share Patient Data with any third party except sub-processors engaged to help deliver the Service, or where required by law.

5. International transfers

Where any sub-processor above stores or processes data outside the UK, we will ensure an appropriate transfer mechanism is in place (such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses). Patient Data is held on infrastructure in the United Kingdom today, and will remain within the UK or EU after the Scaleway migration described in Section 4. Our email and payment providers may process limited account and billing data (not Patient Data) outside the UK under such a mechanism. [Remaining to confirm — the specific processing locations used by Postmark and Stripe, and the transfer mechanism named in each of their data processing agreements.]

6. Your rights

If you're a practice admin or Authorised User (your own account data, Section 1): you can ask us to access, correct, or delete your account data, restrict or object to its processing, or provide it to you in a portable format, by contacting us using the details in Section 12. You can also complain to the ICO (ico.org.uk) if you believe we've mishandled your data.

If you're a patient of a practice using the Service (patient data, Section 2): your practice is the data controller and the correct party to contact to exercise your rights of access, rectification, erasure, restriction, portability, and objection. We will assist the practice in responding to your request, as required by the DPA, but cannot action it directly ourselves. Note that a full right to erasure may not always apply to clinical records where retention is required for legal or clinical-safety reasons (Article 17(3)(e) UK GDPR).

7. Data retention

Account data is retained for as long as your account is active, and for a limited period after closure for legitimate business/legal purposes (e.g. billing records). Patient data retention is set by the practice as controller, in line with UK clinical record-keeping requirements (commonly 7–10 years, but practice- and treatment-specific); the practice can instruct us to delete or export patient data as set out in the DPA. [Placeholder — confirm exact default retention/deletion behaviour once implemented.]

8. Data security

We apply technical and organisational measures appropriate to the sensitivity of the data involved, including: encryption of personal data in transit and at rest; role-based access control restricting clinical data to authorised clinical staff; audit logging of access to Special Category data; and secure authentication for all accounts. [Placeholder — expand with the specific measures actually implemented once confirmed against the codebase, so this section stays accurate rather than aspirational.]

9. Cookies

The Service uses a single strictly-necessary session cookie (JSESSIONID) to keep you logged in and to enforce one active session per account. It is deleted when you log out or your session expires. We do not use analytics, advertising, or other tracking cookies, so no cookie-consent banner is required for this cookie under UK PECR — it's exempt as strictly necessary to provide a service you've requested.

10. Children's data

The Service is intended for use by adult practice staff. We recognise that patient data entered by a practice may relate to a minor if the practice treats minors; that data remains the practice's responsibility as controller, subject to whatever additional safeguards their own professional obligations require. [Placeholder — confirm whether the product intends to support under-18 patient records at all.]

11. Changes to this policy

We may update this Privacy Policy from time to time; where changes are material, we'll give reasonable notice (e.g. by email to your account address) before they take effect.

12. Contact us

Questions about this Privacy Policy, or requests relating to your own account data, can be sent to [contact email pending — see brand-identity.md; aretemedical.co.uk is not yet a live mailbox]. If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk.