Privacy policy

This policy explains what personal data we collect when you use this website or contact us, why we collect it, and the rights you have over it. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The NHS registration data shown on this site is public and aggregate. It comes from NHS England's published figures and contains no patient-level or personal data. The personal data we handle is mainly the contact details you give us: when you ask us to look at your practice, book a call, subscribe to the GP Patient List Update or sign up for our newsletter. Our hosting provider also keeps standard server logs, described below.

Who we are

Patient Growth is a service of Cardboard Creative Limited, the data controller for the personal data described here. You can reach us at patientgrowth@cardboardcreative.co.uk.

Cardboard Creative Limited is a company registered in England and Wales (company number 12039844), with its registered office at 63 The Causeway, Potters Bar, EN6 5HF. We are registered with the Information Commissioner's Office (ICO), registration number ZC198167.

What we collect, and why

When you submit the "look up your practice" form or a booking enquiry, we collect:

• your name and role at the practice;
• your practice name and ODS code;
• your work email address.

We use this to respond to your enquiry, prepare the list-growth analysis you asked for, and, if you agree, to follow up about our service. We do not sell your data, and we do not use it for automated decision-making or profiling.

If you subscribe to the GP Patient List Update, we collect your name, role, practice and work email. We use them to send you the monthly report and emails about your subscription, such as the reminder before your first payment. We keep a record of what you agreed to when you signed up: the wording of each box, whether you ticked it, and when. We also note in our own records that your practice subscribes.

Payments are handled by Stripe. You enter card or bank details on Stripe's payment page, not on our site, and we never see or store them. Stripe collects your billing name and address for invoices and Direct Debit, and tells us the state of your subscription, for example whether it is in its free period, active or cancelled.

If you sign up for our newsletter, on its own or by ticking the box when you subscribe, we collect your name, role, practice and work email, and a record of your consent: the wording you agreed to, and when. We email you once to confirm, and use your details only to send you the newsletter: occasional tips on helping new patients find and choose your practice, and news about Patient Growth's services.

Our growth service. We email subscribers about our growth service only if they have opted in to our newsletter. Otherwise, we may contact the practice about it by phone or post. Before we call, we check the number against the Telephone Preference Service and the Corporate Telephone Preference Service. We honour any objection: tell us and we will stop.

Letters we post. Some letters we post to practices carry a short link and QR code of their own.

• Our app records only the practice code and the time of a scan. It sets no cookies and stores no IP address or device details.
• Our hosting provider (Hostinger), like any web host, keeps standard server logs of requests to our websites, including IP addresses and browser details. These are for security and running the service, and are kept for a limited period.

We use scan records only to see which letters led to a response. If a practice subscribes through a letter's link, we also note that its subscription came from that letter.

Server logs. When you visit our websites, our hosting provider keeps a standard log of each request: your IP address, an approximate location worked out from it, your browser and device, the page requested, and the time. We use these logs only for security and to keep the service running.

Our lawful basis

We rely on your consent (UK GDPR Article 6(1)(a)), given when you tick the box and submit the form, to contact you about your enquiry and our service. You can withdraw consent at any time (see "Your rights" below); withdrawing it does not affect anything we did lawfully beforehand.

For the GP Patient List Update, the contract is with your practice, not with you personally, so we use your name, role and work email because we have a legitimate interest in running the service the practice signed up for and in dealing with the person who looks after it (UK GDPR Article 6(1)(f)). Where you are the practice yourself, for example a single-handed GP, we also rely on the contract (Article 6(1)(b)). We keep the record of what was agreed, and our note that your practice subscribes, on the same legitimate interest: being able to show what was agreed.

For the newsletter, we rely on your consent (Article 6(1)(a)). It is always optional, and subscribing never depends on it. You can withdraw it at any time with the unsubscribe link in any newsletter, or by emailing us.

For letter links, server logs, and phone or post contact about our growth service, we rely on our legitimate interests (Article 6(1)(f)): knowing whether our letters are useful to practices, keeping our websites secure, and telling practices about our service. You can object to any of these at any time.

For analytics cookies, we rely on your consent (UK GDPR Article 6(1)(a)), given when you accept. It is always optional and nothing on this site depends on it. You can withdraw it at any time from our cookie policy; withdrawing it does not affect anything we did lawfully beforehand.

How long we keep it

We keep enquiry data for 12 months from your last contact with us, after which we delete it, unless you have become a client (in which case our client records are governed by our engagement terms).

GP Patient List Update. We keep your details while your subscription is live, and delete them 12 months after it ends. After that we keep a record with no personal data in it: the practice code, which version of the wording was agreed to, and the dates. We keep that for six years, because a claim about a contract can be brought for six years and it is how we would show what was agreed. If you start signing up but do not complete Stripe's payment page, we delete your details after 7 days.

Newsletter, if you ticked the box when you subscribed. Newsletter emails stop as soon as you unsubscribe. Your newsletter sign-up is kept on its own, not with your subscription: we keep a record that you unsubscribed, so we do not email you again, and delete your details 12 months after you unsubscribe. Your subscription record separately notes that you ticked the box, and that is deleted with the rest of your subscription details, 12 months after the subscription ends.

Newsletter, if you signed up for it on its own. Newsletter emails stop as soon as you unsubscribe. We keep a record that you unsubscribed, so we do not email you again, and delete your details 12 months after you unsubscribe.

Billing records. Stripe keeps records of payments and invoices, and we keep them in our accounts for 6 years, as HMRC requires. They are not held in the system that sends the reports.

Letter links. We keep scan records for 12 months, then delete them.

Server logs. Our hosting provider keeps its standard access and error logs as rolling logs for a limited period, after which they are overwritten. It does not set one fixed period for every server.

Analytics. Google keeps the visit data for 14 months, then deletes it. We see only totals, never anything that identifies a visitor.

Who we share it with

We share your data only with the service providers that help us run our business, acting as our processors under contract: MailerSend, which delivers our emails; Hostinger, which hosts our websites and database; and Stripe, which processes payments for the GP Patient List Update.

Stripe also uses some payment information as an independent controller, for its own fraud prevention and to meet its own legal obligations. Its privacy policy covers that use.

Google. If you accept analytics cookies, Google Analytics sends Google information about your visit: the pages you look at, how far down them you scroll, links you follow away from the site, files you download, whether you started or sent one of our forms, roughly where you are, and your browser and device. It never receives what you type into a form — not your name, your email address or your practice. Google acts as our processor for this. It may process the data outside the UK, including in the United States, with the safeguards UK data protection law requires. Google's privacy policy covers its own use of data. We never sell your data.

Stripe may process your data outside the UK, including in the United States. Any transfer of your data outside the UK, by Stripe or by our other providers, is made with the appropriate safeguards that UK data protection law requires. For Stripe, its privacy policy names them: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and the UK Extension to the EU-US Data Privacy Framework. If you would like a copy of the safeguards that apply to your data, email patientgrowth@cardboardcreative.co.uk and we will send you the relevant terms or a link to them. We never sell your data.

Cookies and tracking

We ask before we set anything. When you first arrive, we ask once whether we may count your visit. Until you accept, no cookie is set and no outside service is called: the Google Analytics code is not loaded, not deferred, and not sitting idle in the page. If you reject, it stays that way, and the site works exactly the same.

If you accept, Google Analytics sets two cookies on this domain. They let us count visits and see which pages practices find useful. Our cookie policy names each one, what it does, and how long it lasts.

We set no advertising cookies, and we run no advertising on this site. Google's advertising features are switched off in our settings. Fonts, images and every other asset load from our own domain.

Your answer is kept in your browser, not in a cookie, and it never reaches us. You can change it at any time from our cookie policy, and changing it is no harder than giving it was.

When you go to Stripe's payment page to subscribe, or to Stripe's billing page to manage a subscription, you are on Stripe's site, and Stripe's own cookie policy applies there.

Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• ask us to delete your data (erasure);
• restrict or object to how we use it;
• ask for your data in a portable format;
• withdraw your consent at any time.

To stop the newsletter, use the unsubscribe link in any issue. To cancel the GP Patient List Update, use the "Manage or cancel your subscription" link in your latest report email.

To exercise any of these, email patientgrowth@cardboardcreative.co.uk. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Changes to this policy

We may update this policy from time to time. The "last updated" date above shows when it last changed.