Privacy Policy

This Privacy Policy applies to InPractice Health websites, business communications, product inquiries and services that link to this policy (collectively, the “Services”). It applies to website visitors, prospective and current customers, research and data partners, authorised platform users and other business contacts.

We obtain information:

• Directly from you when you submit a form, create an account or communicate with us.
• From customers, authorised users and systems they choose to connect.
• From service providers that support hosting, security, communications and business operations.
• From public professional sources and business partners where permitted by law.
• Automatically from devices and browsers when you use the Services.

We use personal information only when we have an appropriate purpose and, where UK or EU data-protection law applies, a lawful basis.

Where we rely on legitimate interests, we consider the purpose, necessity and potential effect on individuals. You may object to this processing as described below. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing.

We may disclose information to:

• Service providers and subprocessors that support cloud hosting, databases, security, communications, support, payments, professional advice and other business operations.
• Customers and authorised users when necessary to provide the Services or respond to their instructions.
• Research or data partners only as authorised by applicable agreements, permissions and law.
• Government authorities, regulators, courts or other parties when required by law or reasonably necessary to protect rights, safety, security and the integrity of the Services.
• A buyer, investor or successor in connection with a financing, merger, acquisition, reorganisation or sale of assets, subject to appropriate confidentiality and legal safeguards.

Our current public website uses essential browser storage to remember display and privacy choices. Optional analytics and marketing technologies are disabled unless you consent. You can accept, reject or customise optional categories and reopen Cookie Preferences from the website footer at any time.

See our Cookie Policy for the current inventory, purposes and durations.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to provide Services, maintain security, comply with law, resolve disputes and enforce agreements. The criteria differ by record type:

• Inquiry and business-contact records are retained while the relationship is active and for a reasonable follow-up period.
• Customer account and service data is retained for the contract term and any required return, deletion, backup or legal period.
• Customer-controlled clinical information is retained according to customer instructions and the applicable agreement, DPA or BAA.
• Security and diagnostic logs are retained for periods proportionate to fraud prevention, incident response and reliability needs.
• Privacy choices are retained for six months unless replaced sooner.

When retention is no longer justified, we delete, de-identify or securely isolate the information, subject to technical backup cycles and legal preservation requirements.

We use administrative, technical and physical safeguards designed to protect information against unauthorised access, loss, misuse, alteration and disclosure. Measures may include encryption, access controls, logging, environment separation, vendor review, workforce confidentiality obligations and incident-response procedures, as appropriate to the risk.

No method of transmission or storage is completely secure. You are responsible for protecting your credentials and notifying us promptly of suspected unauthorised access.

When InPractice Health processes Protected Health Information on behalf of a HIPAA covered entity or another Business Associate, the applicable BAA governs permitted uses, safeguards, incident reporting, subcontractors and return or destruction of PHI. InPractice Health does not use customer PHI for independent advertising purposes.

HIPAA does not apply to every type of health-related information or every organisation. Where other consumer-health, breach-notification or state privacy laws apply, we process information according to the relevant role, agreement and legal requirements.

InPractice Health is based in the United States, and information may be processed in the United States and other countries where we or our service providers operate. Those countries may have data-protection rules different from those in your location.

Where required for transfers from the UK, European Economic Area or Switzerland, we use an approved transfer mechanism such as an adequacy decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum or another lawful safeguard, together with supplementary measures where appropriate.

The Services are intended for organisations and adults acting in a professional capacity. We do not knowingly collect personal information directly from children through the public website. Customer-controlled information about minors, if any, is processed only under customer instructions, applicable agreements and law.

We may update this policy to reflect changes in our Services, practices or legal obligations. We will post the revised policy with a new effective date and provide additional notice when required.