Privacy Policy

1. Introduction

This privacy policy explains how Practicos Software Limited ("we", "us", "our") collects, uses, stores, and protects personal data when you use our practice management software for speech and language therapists.

We are committed to protecting your privacy and handling your data in an open and transparent manner. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who We Are

Data Controller:

Controller vs Processor: We act as the data controller for account, billing, and marketing data. For Client Data you upload (including clinical records), we act as a data processor on your instructions, and you remain the data controller.

Contact:
Email: privacy@practicos.co.uk

3. What Data We Collect

3.1 Account Information (Practitioner Users)

• Full name
• Email address
• Authentication credentials (managed by our identity provider)
• Practice/organisation name
• Professional registration details
• Profile photograph (optional)

3.2 Client Records

Data you enter about your clients:

• Client name and contact details
• Date of birth
• Guardian/parent contact information
• Referral source and reason
• Communication preferences

3.3 Clinical Notes (Special Category Data)

• SOAP notes and session documentation
• Assessment results and observations
• Treatment goals and progress
• Session attendance records
• Health-related information

Important: Clinical notes contain special category data (health data) under UK GDPR Article 9. This data is processed under the healthcare provision exemption (Article 9(2)(h)) as it is necessary for the provision of health care by a health professional bound by professional secrecy obligations.

3.4 Appointment Data

• Appointment dates, times, and durations
• Appointment types and status
• Session notes and outcomes

3.5 Billing and Payment Information

• Invoice details
• Service rates
• Payment history
• Business bank details (for invoice generation)

We do not store full payment card details. Card payments are processed securely by our payment provider, Stripe.

3.6 Technical and Usage Data

• IP address
• Browser type and version
• Device information
• Pages visited and features used
• Login timestamps

4. How We Use Your Data

5. Special Category Data (Health Information)

Clinical notes and client health information constitute "special category data" under UK GDPR. We process this data under Article 9(2)(h) — processing is necessary for the provision of health or social care or treatment, and is undertaken by or under the responsibility of a health professional subject to the duty of confidentiality.

As a registered speech and language therapist, you are responsible for ensuring you have an appropriate legal basis to record and process your clients' health data. Practicos provides the secure platform; you remain the data controller for your client data.

6. Data Sharing and Third Parties

6.1 Service Providers

6.2 International Transfers

Some of our service providers are based outside the UK, including in the United States. For these transfers, we rely on:

• The UK-US Data Bridge adequacy regulations
• Standard Contractual Clauses (SCCs) approved by the ICO
• Additional technical safeguards including encryption

We can provide our Data Processing Addendum (DPA) and relevant SCCs on request.

6.3 Other Disclosures

We may disclose personal data if required by law, court order, or to protect our legal rights. We will notify you where legally permitted.

We do not sell your personal data to third parties.

7. Data Retention

We retain personal data only as long as necessary for the purposes outlined above:

When you delete your account, we will delete or anonymise your data after the export window has ended, typically within 30 days, except where retention is required by law or for the exercise of legal claims.

8. Data Security

We implement appropriate technical and organisational measures to protect your data:

• Encryption: Data is encrypted in transit (TLS) and at rest where supported
• Access controls: Role-based access, multi-factor authentication available
• Infrastructure: Hosted with reputable cloud providers using industry-standard security controls
• Backups: Regular encrypted backups with secure storage
• Monitoring: Continuous security monitoring and incident response procedures

9. Your Rights

Under UK GDPR, you have the following rights:

To exercise these rights, contact us at privacy@practicos.co.uk. We will respond within one month.

Note for practitioners: You are responsible for responding to data subject requests from your clients regarding the clinical data you have entered. We will assist you in fulfilling these requests.

10. Cookies

We use cookies and similar technologies to:

• Keep you signed in
• Remember your preferences
• Understand how you use our service (with your consent)
• Improve performance

We ask for your consent before using non-essential cookies. You can change your cookie preferences at any time. For full details, see our Cookie Policy.

11. Children's Data

Practicos is designed for use by adult healthcare professionals. We do not knowingly collect data directly from children under 16. Client records you create for child clients are processed under your professional responsibility.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes via email or through the application. The "Last updated" date at the top indicates when this policy was last revised.

13. Complaints

If you are unhappy with how we handle your data, please contact us first at privacy@practicos.co.uk.

You also have the right to complain to the Information Commissioner's Office (ICO):

14. Contact Us

For any questions about this privacy policy or our data practices: