Legal
Platform Privacy Policy
- ICO Registration
- Pending. Registration with the Information Commissioner's Office is in progress and will be in place before the first clinic is onboarded. No registration number is stated in this document until it exists.
- Version
- 1.0
- Effective date
- 20 September 2026
- Last updated
- 20 September 2026
Bailey & Prosper Holdings Ltd
Registered in England and Wales
71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
1. Who we are
Bailey & Prosper Holdings Ltd operates a web-based practice management platform for healthcare and wellness practitioners. In doing so we process personal data in two distinct capacities:
As a data processor: When healthcare practitioners ("Subscribers") use our Platform to manage their patients, we process patient data on behalf of those Subscribers. The Subscriber is the data controller for their patients' data. We act as their processor.
As a data controller: We process personal data of our Subscribers and their staff (account data, billing data, usage data) for our own business purposes. We are the data controller for this data.
This Privacy Policy covers both categories of processing.
2. Contact details
Data controller: Bailey & Prosper Holdings Ltd Address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ Email: hello@baileyprosper.com ICO registration: pending
3. Personal data we collect and why
3.1 Subscriber account data (we are controller)
When you register as a Subscriber we collect:
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, phone number | Account management and communications | Contract (Article 6(1)(b)) |
| Business name, address, ICO registration number | Verifying you are a registered healthcare practitioner | Contract (Article 6(1)(b)) |
| Professional registration number | Verifying regulatory registration | Contract (Article 6(1)(b)) |
| Payment information (processed by Stripe) | Billing | Contract (Article 6(1)(b)) |
| Login activity, MFA status, session data | Security and fraud prevention | Legitimate interests (Article 6(1)(f)) |
3.2 Platform usage data (we are controller)
When you use the Platform we collect:
| Data | Purpose | Legal basis |
|---|---|---|
| IP address, browser type, device information | Security monitoring, rate limiting, and evidencing electronic signatures (retained alongside a signature as contextual corroboration of when and from where it was given) | Legitimate interests (Article 6(1)(f)) |
| Feature usage analytics (anonymised) | Improving the Platform | Legitimate interests (Article 6(1)(f)) |
| Error logs | Diagnosing and fixing technical issues | Legitimate interests (Article 6(1)(f)) |
3.3 Patient data (we are processor)
When Subscribers use the Platform to manage their patients, we process patient data on their behalf. This includes special category health data (clinical notes, consent forms, medical history) under Article 9 UK GDPR.
We process this data solely on the Subscriber's instructions and do not use it for any of our own purposes. The Subscriber's privacy notice to their patients governs this processing.
For patient data processing, your rights should be exercised with the Subscriber (your healthcare practitioner), not with us directly.
4. Special category data
Patient health data is special category personal data under Article 9 UK GDPR. We process this data as a data processor on behalf of Subscriber data controllers. The lawful basis for this processing is Article 9(2)(h): processing necessary for the provision of health care.
We implement enhanced security measures for all special category data including mandatory multi-factor authentication for practitioner access, row-level security at the database layer, and encryption at rest and in transit.
5. How long we keep data
| Data type | Retention period |
|---|---|
| Subscriber account data | Duration of subscription plus 2 years |
| Billing records | 7 years (legal requirement) |
| Patient clinical records | Minimum 8 years from last treatment for adults; until age 25 for patients treated as minors (HCPC requirement) |
| Patient consent forms and PDFs | Same as clinical records |
| Security and audit logs | 3 years |
| Platform usage analytics (anonymised) | Indefinitely (no personal data) |
After the applicable retention period, data is permanently deleted from all systems including backups.
6. Who we share data with
We do not sell your data. We do not share your data with advertisers or use it for marketing purposes unrelated to our Platform.
We share data only with the following categories of recipients:
6.1 Sub-processors
We use the following sub-processors to provide the Platform. Each has been subject to a Data Processing Agreement:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase, Inc | Database hosting and storage | EU (London, eu-west-2) |
| Vercel, Inc | Application hosting | Global CDN |
| Resend (Plus Five Five, Inc) | Transactional email delivery | United States |
| Upstash, Inc | Rate limiting (Redis) | EU (eu-west-2) |
We will notify Subscribers of any changes to our sub-processor list at least 30 days in advance.
6.2 Legal requirements
We may disclose personal data where required by law, court order, or regulatory authority. Where permitted by law, we will notify you before making such a disclosure.
7. International transfers
Resend is based in the United States. Transfers to Resend are covered by Standard Contractual Clauses and the EU-US Data Privacy Framework.
All other sub-processors process data within the UK or EU. Patient data is stored in Supabase's eu-west-2 region (London).
8. Your rights
As a Subscriber (data subject for account data), you have the following rights under UK GDPR:
- Right of access: request a copy of the personal data we hold about you
- Right to rectification: request correction of inaccurate data
- Right to erasure: request deletion of your data (subject to legal retention obligations)
- Right to restriction: request that we limit how we use your data
- Right to data portability: request your data in a machine-readable format
- Right to object: object to processing based on legitimate interests
- Rights related to automated decision-making: we do not make automated decisions with legal or significant effects about you
To exercise any of these rights, contact us at hello@baileyprosper.com. We will respond within one month.
Note for patients: Your rights in respect of your clinical records should be exercised directly with your healthcare practitioner, not with us. We act on their instructions.
9. Data security
We implement the following security measures to protect personal data:
- Encryption at rest (AES-256) and in transit (TLS 1.2+)
- Mandatory multi-factor authentication for all practitioner accounts
- Row-level security policies enforcing tenant isolation at the database layer
- Comprehensive audit logging of all access to clinical data
- Rate limiting to prevent brute force attacks
- Signed URLs with 15-minute expiry for all document access
- Regular security reviews and dependency updates
- Signed commits and branch protection on all code changes
10. Data breaches
In the event of a personal data breach affecting your data, we will notify you without undue delay and in any event within 72 hours of becoming aware, as required by UK GDPR Article 33. We will provide details of the nature of the breach, the data affected, and the steps we are taking to address it.
11. Data Protection Complaints
You have the right to raise a data protection complaint with us. To do so, email hello@baileyprosper.com with the subject line "Data Protection Complaint". We will acknowledge your complaint within 30 days and respond without undue delay.
If you are not satisfied with our response, or if we fail to respond, you may complain to the Information Commissioner's Office:
ICO helpline: 0303 123 1113 Website: ico.org.uk/make-a-complaint
12. Cookies
The Platform uses the following cookies:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Maintaining your login session | Session |
| Security cookie | CSRF protection | Session |
We do not use advertising or tracking cookies. We do not use third-party analytics cookies.
13. Changes to this Privacy Policy
We will notify you of material changes to this Privacy Policy by email at least 30 days before the changes take effect. The current version of this Privacy Policy is always available within the Platform.
Bailey & Prosper Holdings Ltd. Registered in England and Wales.
ICO Registration Reference: pending