Privacy Policy

1. About us

Practice Well ("we", "us", "our") provides practice management, compliance, sales and growth consultancy to GP, dental and other CQC-registered healthcare providers. This policy explains how we collect, use and protect personal information when you visit practicewell.co.uk, contact us, or work with us.

For the purposes of UK data protection law, Practice Well is the data controller for the personal information described in this policy.

Contact: bee@practicewell.co.uk

2. Information we collect

• Enquiries and contact details: your name, job title, practice or company name, email address, phone number and anything you tell us when you contact us through our website, email, phone or social media.
• Client information: contact and billing details for practice owners and managers we work with, contracts, invoices and correspondence.
• Website data: basic technical information such as IP address, browser type, device and pages visited, collected through cookies and similar technologies (see section 9).
• Marketing preferences: whether you have agreed to hear from us.

We do not knowingly collect information from children, and we do not ask for special category data (such as health information) through our website.

3. How and why we use your information

• To respond to enquiries and arrange discovery calls or practice reviews. Lawful basis: legitimate interests, or steps taken at your request before entering a contract.
• To deliver our services and manage our relationship with clients, including contracts, invoicing and payments. Lawful basis: performance of a contract.
• To meet legal obligations, such as tax, accounting and record-keeping. Lawful basis: legal obligation.
• To send updates and marketing about our services. Lawful basis: consent, or legitimate interests for existing business contacts. You can unsubscribe at any time.
• To run and improve our website and keep it secure. Lawful basis: legitimate interests, and consent for non-essential cookies.

4. Data we handle on behalf of our clients

When we provide services such as compliance support, payroll, onboarding, HR or training, we may access personal data held by our clients, including staff records and, where necessary, patient information. In these cases our client remains the data controller, and we act as a data processor. We only process this information on our client's documented instructions, keep it confidential and secure, and do not use it for any other purpose. These arrangements are set out in our client agreements.

5. Who we share information with

We never sell your personal information. We only share it where necessary with trusted providers who help us run our business, including:

• Microsoft 365, for email, file storage and documents
• our website hosting provider
• our accountants, payroll and professional advisers
• our insurers, where needed for a claim or policy
• regulators, HMRC or law enforcement where we are legally required to

Each provider is required to keep your information secure and use it only for the purpose we share it for.

6. International transfers

Some of our service providers may store or process data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement.

7. How we keep your information safe

We take the security of personal information seriously. Our measures include:

• secure, password-protected business accounts with multi-factor authentication
• access limited to the people who need it
• encrypted connections on our website and email
• confidentiality obligations in all our client and team agreements
• cyber security insurance, so we are prepared to respond quickly and effectively if an incident ever occurs

If a personal data breach occurs that is likely to put your rights at risk, we will notify you and, where required, the Information Commissioner's Office (ICO) within 72 hours.

8. How long we keep information

• Enquiries that do not lead to work: up to 2 years.
• Client records, contracts and invoices: 6 years after the end of our working relationship, to meet tax and legal requirements.
• Client data processed on your behalf: returned or securely deleted at the end of our agreement, in line with your instructions.
• Marketing contacts: until you unsubscribe.

9. Cookies

Our website uses essential cookies to work properly and, with your consent, analytics cookies to help us understand how visitors use the site. You can accept or decline non-essential cookies through the cookie banner, and change your settings in your browser at any time.

10. Your rights

Under UK data protection law, you have the right to:

• access the personal information we hold about you
• ask us to correct inaccurate information
• ask us to delete your information
• object to or restrict how we use it
• ask for your information to be transferred to another organisation
• withdraw consent at any time, where we rely on consent

To make a request, email bee@practicewell.co.uk. We will respond within one month and there is usually no charge.

11. Complaints

If you have any concerns about how we handle your information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

12. Changes to this policy

We may update this policy from time to time. The latest version will always be available on our website, with the date it was last updated.