Data Retention & Third-Party Sharing Policy
How long EveryClinic keeps personal data, and who we share it with to operate the Platform
Version 2.0 (Model B — payments marketplace) · Supersedes v1.0 · Draft — internal governance document
Table of Contents
What changed in this version
Retention periods are now set (previously [X] placeholders) and a payment/transaction-records category added. Our payment provider (Stripe) is now listed as a recipient, and the previous statement that we do not share data with payment processors has been reversed to reflect Model B. This document is the single source of truth for retention periods, referenced by the Privacy Policy.
1. Purpose and scope
This policy sets out, in one place: (a) how long EveryClinic keeps different categories of personal data, and (b) which third parties we share personal data with in order to deliver a Booking and operate the Platform, and on what basis.
It expands on the Privacy Policy (sections 5 and 8) for internal governance purposes, and is used by the team to configure actual deletion schedules and vendor contracts. It is a working document, not just a public statement, and is the authoritative source for the retention periods referenced in the Privacy Policy.
A separate Record of Processing Activities (ROPA) is maintained under Article 30 of the UK GDPR; this policy supports, but does not replace, that record.
2. Retention principles
- We keep personal data only for as long as necessary for the purpose it was collected for (storage limitation), and delete or anonymise it once that purpose ends, subject to legal retention requirements.
- Where a specific retention period is required by law (e.g. tax records), that period takes precedence over our default periods below.
- Backups: data deleted from live systems may persist in encrypted backups for a limited rolling period (35 days) before being permanently overwritten.
3. Retention schedule
| Data category | Examples | Retention | Reason / notes |
|---|---|---|---|
| Active account data | Name, email, phone, password hash, preferences | Duration of active account | Needed to provide the Platform |
| Closed account data | As above, post closure | 6 years from closure | Limitation period for contract claims (England & Wales) |
| Booking records | Appointment date, Clinic, service, commission calculation | 6 years from booking | Tax/HMRC record-keeping; commission dispute window |
| Payment / transaction records | Payment status, amount, refunds, chargebacks (not card numbers) | 6 years from transaction | Tax/HMRC; payment reconciliation and dispute defence |
| Marketing consent (opt-in) | Consent given, date, method, wording shown | Duration of consent + 2 years after withdrawal/lapse | Evidence of lawful basis (accountability) |
| Marketing suppression / opt-out | Email/phone on do-not-contact list | Indefinite (minimal data only) | Prevents unwanted re-contact; ICO-recommended practice |
| Support & complaint records | Correspondence, resolution notes | 6 years from closure | Handling repeat issues, evidencing resolution |
| Reviews submitted by Patients | Rating, text, appointment reference | Duration of Clinic’s Listing, or until removed on request or no longer relevant | Public-facing content; subject to removal and fair-presentation duties (DMCC Act 2024) |
| Clinic KYC / compliance records | Regulator registration, insurance certs, practitioner IDs | 6 years post-termination of Clinic Agreement | Regulatory evidence, dispute defence |
| Analytics / usage data | Page views, device data, aggregated behaviour | 14 months | Product improvement; short window to limit exposure |
| Security & access logs | Login attempts, admin actions | 12 months | Security investigation window |
4. Third parties we share data with to deliver a Booking
To make and manage a Booking, we share the minimum necessary Patient data with the following categories of recipient:
| Recipient | Data shared & purpose | Safeguard |
|---|---|---|
| The Clinic you book with | Name, contact details, appointment details, and any notes you provide — so the Clinic can deliver the appointment | Governed by the Clinic Partner Agreement; Clinic acts as independent controller for care it provides |
| Our payment provider (Stripe) | Name, contact and payment amount/status — to take and process your payment, issue refunds, and settle the Clinic net of commission | Stripe is an FCA-authorised provider processing under its own terms; DPA/processor terms in place; EveryClinic does not store card data |
| Cloud hosting / infrastructure provider | All Platform data, as processor, to host the service | Data Processing Agreement (DPA); UK/EEA hosting preferred, SCCs/UK IDTA if not |
| Email / SMS delivery provider | Contact details and message content, to send confirmations, reminders and (where consented) marketing | DPA in place; provider processes on our instructions only |
| Analytics provider | Usage/device data, generally pseudonymised or aggregated | DPA; opt-out available via cookie settings |
| Customer support tool | Contact details and support conversation content | DPA in place |
| Professional advisers (legal, accountancy) | Data disclosed as reasonably necessary for advice | Confidentiality obligations under professional engagement |
| Regulators / law enforcement | As legally required | Disclosed only where a valid legal basis/request exists |
We share the payment data necessary to take and process your payment with our payment provider (Stripe). EveryClinic does not collect or store your full card details; those are handled directly by Stripe under its PCI-DSS compliance (see Payment Handling Policy, clause 2.3).
We do not sell personal data, and we do not share special category (health-related) data with advertisers, data brokers, or analytics/ad-tech providers for targeting purposes.
5. International transfers
Where any recipient above is located outside the UK, we put an appropriate transfer safeguard in place before sharing data — typically the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses, or reliance on a UK adequacy determination that meets the applicable data protection test for that country.
6. Deletion and anonymisation
When a retention period in section 3 expires, data is either permanently deleted or irreversibly anonymised (so it can no longer be linked to an individual), and removed from active systems and, in due course, from backups.
Patients may request earlier deletion under their UK GDPR erasure right (see Privacy Policy, section 9); we will action this unless a legal retention requirement (e.g. tax records) applies.
7. Responsibility and review
This policy is owned by Lakhbir Dhillon (Data Protection Officer), who is responsible for keeping the retention schedule, the ROPA and the third-party list accurate as new vendors or data categories are added.
This policy is reviewed at least annually, and whenever a new third-party processor is onboarded or a retention period is changed.