For practices
How we process your patients' data
1. Who is responsible for what
Your practice is the controller of your patients' data: you decide what is recorded and why. Stable State Consulting Ltd is your processor: we process it only to provide BusinessDayBook to you, on your documented instructions (your use of the service and your settings in it), and for no other purpose.
2. What we process
| Subject matter | Providing practice management and online booking: your diary, patient records, recalls, patient emails and texts, online booking, data exports and patient data requests. |
|---|---|
| Duration | For as long as you use the service, then until your data is deleted after you leave (section 8). |
| Nature of processing | Storing, organising, retrieving, displaying, sending messages, exporting, and deleting or anonymising on your instruction or under your retention policy. |
| People the data is about | Your patients (including children, and their parents or guardians), and your staff. |
| Types of personal data | Names, dates of birth, contact details, addresses, GP details, NHS numbers, appointments, recalls, notes, alerts, documents and communication preferences. From when clinical records are added: sight test records and prescriptions. |
| Special category data | Health data (eye care, and anything recorded in notes, alerts and documents). |
3. What we commit to
- Process your data only on your instructions, and tell you if we believe an instruction breaks data protection law.
- Make sure everyone with access is bound by confidentiality, and that access is limited to those who need it to run the service.
- Keep the security measures in section 4 in place, and improve them as risks change.
- Use only the sub-processors in section 5, under contracts with equivalent protections, and tell you at least 30 days before adding or replacing one, so you can object.
- Help you meet your obligations: patients' requests, security, breach notifications, and data protection impact assessments.
- Delete or return your data when you leave (section 8).
- Give you the information you need to show we meet these commitments, and allow for reasonable audits.
4. Security measures
- Separation: every request is limited to your practice's data and checked again on each record; automated tests try to reach other practices' data and must fail.
- Access: two-factor authentication for every account, strong passwords checked against known breaches, sign-in rate limits, and automatic sign-out after 30 minutes idle. Roles limit what each member of staff can do.
- Encryption: HTTPS only (with HSTS); data encrypted on disk; NHS numbers, alerts and notes encrypted again in the database; background jobs carrying patient data encrypted.
- Audit: a log of changes, every opening of a patient record, downloads, exports, erasures and sign-ins, available to your practice owners.
- Our staff: our support tools show no patient data, and there is no way for us to sign in as your staff.
- Logs: no patient names, dates of birth, contact details or clinical information in system logs.
- Hosting and backups: United Kingdom hosting with encrypted daily backups.
- Public pages: online booking protected against spam and abuse, with nothing about other patients ever shown.
5. Sub-processors
| Who | What for | What data | Where |
|---|---|---|---|
| Linode. Akamai Technologies, Inc. | Runs the application, database and file storage | All data, including patient records | United Kingdom |
| Mailgun Technologies, Inc. | Sends appointment and recall emails | Patient name, email address and the email's content | European Union (Mailgun's EU region) |
| Twilio Ireland Limited | Sends text messages, when a practice switches them on | Patient mobile number and the text (never the appointment type) | Ireland (Twilio's EU region) |
| Cloudflare, Inc. | Secure connections (HTTPS) for practices' own booking addresses, and spam protection | Booking pages as they pass through, encrypted | Global network |
| Stripe Payments Europe, Limited | Billing practices for their plan and credits | Practice billing details only: no patient data | European Union, with some processing in the United States |
Transfers outside the UK are protected by safeguards approved under UK law, such as an adequacy decision or the International Data Transfer Addendum.
6. Helping you with patients' requests
BusinessDayBook gives your practice the tools to answer patients' data protection requests yourself: find everything held about a patient, export it for a subject access request, correct it, restrict it, or erase it (keeping, and locking, only what the law requires, such as clinical records). If a patient contacts us directly, we pass the request to you the same day and don't respond to it ourselves.
7. If something goes wrong
If we become aware of a personal data breach affecting your data, we'll tell you without undue delay, with what we know about it, its likely effects and what we're doing about it, so you can meet your own obligation to report it to the ICO within 72 hours where required.
8. When you leave
You can download a full copy of your practice's data at any time, as spreadsheets and JSON with all uploaded documents. When you leave, we give you a final export, remove your custom domains straight away, and delete your data from the service within 30 days, unless you tell us otherwise or the law requires us to keep it. Data in backups is overwritten as the backups age.
Contact
Questions about data processing: [email protected]. A signed copy of our data processing agreement is available on request.