Privacy notice

1. Who we are

Practiva Ltd (company number 17454196), registered office Warrington, UK. We help UK private healthcare practitioners launch and grow their practices through Practiva Launch (a done-for-you practice launch with an ongoing managed Subscription) and Practiva Grow (an online dashboard).

Practiva Ltd is the controller of the personal data described in this notice, except where we act for our clients (see section 7). We are registered with the Information Commissioner’s Office under number ZC273685. To contact us about this notice or your personal data, email Support@practiva.uk.

2. Who this notice covers

• visitors to practiva.uk;
• people who enquire about our services;
• our clients and their authorised users, for Practiva Launch and Practiva Grow;
• healthcare practitioners whose public professional information is used in Practiva Grow benchmarks (section 5);
• our suppliers, contractors and other business contacts.

3. What we collect and why

4. How we get personal data

Mostly from you: when you use our website, contact us, sign up or work with us. Information about benchmarked practitioners comes from public sources (section 5). Data from Google accounts comes from Google when a client connects their accounts (section 6).

5. Practitioners included in Practiva Grow benchmarks

Practiva Grow helps subscribing practitioners monitor and build their online presence, and in part to compare their public digital presence with selected colleagues in the same specialty and area. To do this, we collect information that practitioners, or others, have published about their professional practice. We do not contact benchmarked practitioners individually, because we have no relationship with them and doing so would involve disproportionate effort. Instead we publish this notice and our “How Practiva Grow works” page.

What we collect

• professional identity: name, professional title, specialty, areas of practice and geographic area of practice;
• practice websites, published contact routes, and online booking or virtual consultation options;
• public hospital, private provider, directory (such as Doctify and Top Doctors) and insurer listings, and how complete the published information is;
• public review ratings, the number of reviews and the date of the latest review, with the source. We do not collect the text of reviews or reviewers’ names;
• whether the practitioner or their website appears in selected Google searches, with the observed position, search terms, location and device;
• conditions, treatments and topics covered on their website;
• published consultation fees, with the hospital or provider, source and date;
• practice locations;
• source links, dates, confidence ratings, the reasons a colleague was selected for comparison, and AI-generated comparative summaries.

Where it comes from

Only from publicly available sources: practice, hospital and private provider websites, professional directories, review platforms, insurer listings and Google search results. We gather it through AI-assisted web research (using OpenAI’s web search), controlled Google search observations (using DataForSEO) and direct visits to public web pages. We respect websites’ access restrictions: if a site blocks automated access, we use another public source instead.

Why, and our lawful basis

Our legitimate interests in providing Practiva Grow to subscribing practitioners and in producing anonymised market insight. We have assessed these interests against benchmarked practitioners’ interests and put safeguards in place. We use only professional information that has been made public to attract patients. Results are shown only to the subscribing practitioner, and to Practiva staff supporting them, and are never published. Benchmarks compare digital presence only; they are not a judgement of clinical skill or quality of care. We do not collect review text or anything about patients.

Who sees it

The subscribing practitioner and their authorised users, Practiva staff and contractors supporting them, and the suppliers that process it for us (section 10). Aggregated Data that does not identify any practitioner may be shared more widely (section 8).

How long we keep it

For as long as the practitioner who asked for the benchmark remains a subscriber. We delete it within 90 days after that subscription ends.

6. Google user data in Practiva Grow

Practiva Grow lets clients connect their own Google accounts. This section explains what we access and how we use it.

Practiva Grow never changes a client’s Google accounts. It does not edit listings, post updates or reply to reviews, even though Google’s Business Profile permission would allow this.

How we use it: Only to provide the features the client sees in Practiva Grow: dashboards, alerts, reports, comparisons with the client’s own past performance, and recommendations, such that everything is visible in one place. To produce AI-assisted explanations and suggestions, relevant data is sent to OpenAI, which processes it on our behalf and does not use it to train its models.

Who can see it: The client and their authorised users. Practiva staff and contractors view a client’s Google data only with the client’s consent (given when connecting their accounts, and which can be withdrawn at any time in Practiva Grow or by emailing us), where needed for security, or to comply with the law.

Storage and security: Stored in the Practiva Grow database, hosted by Supabase in London (UK), and encrypted in transit and at rest. Google access tokens are stored encrypted, and access to them is restricted.

Sharing: We do not sell Google user data, use it for advertising, or include it in Aggregated Data. We do not transfer it to anyone except the service providers who process it for us to provide Practiva Grow (WeWeb, Supabase and OpenAI), or where required by law or for security.

Retention and deletion: We keep Google data while the account is connected and the subscription continues. If a client disconnects a Google account, we delete the access token immediately and the related data within 30 days. All Google data is deleted within 90 days after the subscription ends. Clients can remove Practiva Grow’s access at any time from their Google Account (myaccount.google.com/permissions) and can ask us to delete their data by emailing Support@practiva.uk.

Limited Use: Practiva Grow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. When we act for our clients

For Practiva Launch clients we provide websites, practice email, phone numbers and related services, and in Practiva Grow we analyse data from clients’ connected accounts. Practiva does not deliberately access patient enquiries. If we do handle personal data in these services, for example patient enquiries sent through a client’s website or practice email, we act on the client’s instructions as their processor. The client is responsible for that data, and its own privacy notice applies. Please contact the practice directly; we will help them respond.

8. Aggregated Data

We create anonymised, aggregated insights from Practiva Grow and our services, such as trends in patient search demand, digital presence and published fees by specialty and area. Aggregated Data does not identify any practitioner, practice, patient or other individual, and never includes data from clients’ Google accounts, patient information or review text. We may use it to improve our services, to publish research and reports, and to supply it to commercial organisations in the healthcare sector, such as hospital groups, private providers and insurers. We follow the ICO’s guidance on anonymisation; once anonymised, Aggregated Data is not personal data.

9. Marketing

We send clients occasional news about our own services. You can opt out at any time using the link in each email or by contacting us. We send offers from partners, or share your contact details with partners, only if you have ticked the relevant box. We have no such partners at present; we will name any partner and ask for your consent before sharing. Advertising cookies are used only with your consent.

10. Who we share personal data with

We use the following suppliers. Our current list of sub-processors for client data is at practiva.uk/sub-processors.

We may also share personal data with our professional advisers, bank and insurers; with regulators, law enforcement or courts where the law requires; and with a buyer of our business, who would have to protect it in the same way. We do not sell personal data.

11. International transfers

Some of our suppliers are outside the UK (section 10). Where they are, we rely on UK adequacy regulations (which cover the EEA and US organisations certified under the UK–US data bridge) or on approved contractual safeguards. Contact us for more details.

12. How long we keep personal data

13. Your rights

You have the right to:

• ask for a copy of your personal data;
• ask us to correct it;
• ask us to delete it;
• ask us to restrict how we use it;
• object to our use of it, including an absolute right to object to direct marketing;
• ask us to transfer it to you or someone else, where we rely on consent or contract;
• withdraw consent at any time, where we rely on consent.

Email Support@practiva.uk. We will respond within one month. If you have a concern about how we use your personal data, please tell us first: we will acknowledge it within 30 days and try to put things right. We do not make decisions about people based solely on automated processing that have legal or similarly significant effects. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

14. Security

We protect personal data with measures including encryption, multi-factor authentication, access controls, a password manager and backups. Our contractors and suppliers are bound by confidentiality and data protection terms.

15. Children

Our services are for professionals and are not directed at children.

16. Changes to this notice

We will update this notice when our practices change and show the date at the top. If the changes are significant, we will tell clients directly.