Privacy notice
How we use personal data
1. Who we are
BusinessDayBook is a practice management and online booking service for opticians, run by Stable State Consulting Ltd, a company registered in England and Wales with number 15536612, of Cubo, 12th Floor, Bank House, Pilgrim Street, Newcastle upon Tyne, NE1 6SQ..
2. If you are a patient of a practice
If your optician uses BusinessDayBook, your optician decides how your information is used: they are the controller and we are their processor. We hold and process your information only to provide the service to your practice, on its instructions, and never for our own purposes. We don't sell it, use it for marketing, or share it with anyone except the providers listed below.
Your practice's own privacy notice explains how it uses your information. To see, correct or delete your information, please contact your practice: they have the tools to do this in BusinessDayBook. If you contact us instead, we'll pass your request to your practice the same day.
When you book online, the booking page uses only cookies it needs to work (see Cookies).
3. What we collect about practice staff, customers and visitors
For this information, we are the controller.
- Practice staff who use BusinessDayBook: name, email address, role, sign-in times, the device's IP address, and a record of actions taken (the audit log). Why: to provide the service and keep it secure. Lawful basis: performance of our contract with your practice, and our legitimate interest in keeping patient data secure.
- Practice owners and billing contacts: name, email address, practice name and address, VAT number, and payment card details (handled by Stripe; we never see the full card number). Why: to bill for the service. Lawful basis: contract, and our legal obligations to keep financial records.
- People who email us: what you send us. Why: to reply and to provide support. Lawful basis: our legitimate interest in responding to enquiries.
- Website visitors: our web servers record technical information (such as IP address and pages requested) to keep the service secure. Lawful basis: legitimate interest in security. We don't use analytics or advertising tracking on this website.
4. Cookies
This website, including this page, sets no cookies.
The staff sign-in area and the online booking pages use strictly necessary cookies only: a session cookie that keeps you signed in or remembers your progress through a booking, and a security cookie that protects forms. They are encrypted, sent only over secure connections, and expire when you close your browser (or after 30 minutes without use when signed in). Because they're strictly necessary, they don't need your consent. We use no advertising, analytics or tracking cookies anywhere.
5. Who we share it with
We use these providers ("sub-processors") to run the service. Each is bound by a contract requiring it to protect the data and use it only to provide its service to us.
| Who | What for | What data | Where |
|---|---|---|---|
| Linode. Akamai Technologies, Inc. | Runs the application, database and file storage | All data, including patient records | United Kingdom |
| Mailgun Technologies, Inc. | Sends appointment and recall emails | Patient name, email address and the email's content | European Union (Mailgun's EU region) |
| Twilio Ireland Limited | Sends text messages, when a practice switches them on | Patient mobile number and the text (never the appointment type) | Ireland (Twilio's EU region) |
| Cloudflare, Inc. | Secure connections (HTTPS) for practices' own booking addresses, and spam protection | Booking pages as they pass through, encrypted | Global network |
| Stripe Payments Europe, Limited | Billing practices for their plan and credits | Practice billing details only: no patient data | European Union, with some processing in the United States |
Where a provider processes data outside the UK, we make sure it's protected by safeguards approved under UK law, such as an adequacy decision (including the UK Extension to the EU–US Data Privacy Framework) or the International Data Transfer Addendum.
We may also share information if the law requires it, for example with the police or a regulator.
6. How long we keep it
- Staff accounts: while the account is in use, then removed when the practice deletes it or leaves the service.
- Audit logs (who did what, including IP addresses): six years.
- Records of emails and texts sent to patients: two years.
- Billing records: six years, as tax law requires.
- Support emails: two years after the conversation ends.
- Server logs: 30 days.
Patient information is kept for as long as each practice decides, under its own retention policy, and deleted when the practice leaves the service (after giving it a full copy). See data processing.
7. Your rights
You have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to have it transferred to you or someone else. Some rights depend on the lawful basis, and some records must be kept by law. We'll reply within one month.
8. Contact and complaints
Questions about privacy: email [email protected]. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.
We'll update this notice when how we use personal data changes, and show the date at the top.