Privacy Policy

1. Introduction

Apptmint Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This policy sets out how we collect, use and protect personal data when you use our website at apptmint.co.uk and our software platform (together, the "Service").

We are registered with the Information Commissioner's Office (ICO) and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

Apptmint Ltd is the data controller for personal data collected through the Service. If you have questions about this policy, contact us at privacy@apptmint.co.uk.

3. What Data We Collect

Information you provide

Account registration details (name, email address, business name)
Contact form submissions
Client records you create within the platform
Appointment and scheduling data
Billing and payment information (processed by Stripe)
Clinical notes and session records
Consent forms and documents

Information collected automatically

IP address and approximate location
Browser type and device information
Pages visited and usage patterns
Referral source

4. How We Use Your Data

We use your personal data for the following purposes:

To provide and maintain the Service
To process payments and generate invoices
To send appointment reminders and notifications
To respond to your enquiries and provide support
To improve the Service and develop new features
To comply with legal obligations (e.g. HMRC, MTD)

5. Lawful Basis for Processing

We process personal data on the following lawful bases:

Contract: Processing necessary to perform our contract with you (providing the Service).
Legitimate interest: Processing necessary for our legitimate business interests (improving the Service, preventing fraud).
Legal obligation: Processing required to comply with UK law (tax records, regulatory requirements).
Consent: Where you have given explicit consent (marketing communications).

6. Data Sharing

We do not sell your personal data. We share data only with:

Stripe: Payment processing. See Stripe's privacy policy.
Infrastructure providers: Hosting and database services located in the UK and EU.
Communication providers: For sending appointment reminders via email, SMS and WhatsApp.

We do not transfer personal data outside of the UK and EU.

7. Data Retention

We retain personal data for as long as your account is active or as needed to provide the Service. After account closure:

Account data is deleted within 30 days
Financial records are retained for 7 years (HMRC requirement)
Clinical data retention is configurable per your practice's policies
Backup data is purged within 90 days

8. Your Rights

Under the UK GDPR, you have the right to:

Access the personal data we hold about you
Rectify inaccurate personal data
Request deletion of your personal data
Restrict or object to processing
Data portability (receive your data in a structured format)
Withdraw consent at any time

To exercise any of these rights, contact us at privacy@apptmint.co.uk. We will respond within 30 days.

9. Security

We implement appropriate technical and organisational measures to protect personal data, including:

AES-256 encryption at rest
TLS 1.3 encryption in transit
Role-based access controls
Regular security audits
Incident response procedures

For full details, see our Security page.

10. Cookies

We use essential cookies required for the Service to function. We do not use third-party advertising cookies. Analytics cookies are only used with your consent.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email or through the Service. The "last updated" date at the top of this page indicates when this policy was last revised.

12. Contact

If you have questions about this privacy policy or wish to exercise your rights, contact us:

Email: privacy@apptmint.co.uk
Post: Apptmint Ltd, United Kingdom

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.