Data processing

Why this page exists

If you run a clinic, the most important question you can ask any marketing supplier is what they do with your patients' information. Most suppliers answer that question in a contract you only see after you have signed. Here it is before.

The rule that governs everything else

Health information never enters an advertising tool. Not into Google Ads, not into Meta, not into an analytics property, not into a spreadsheet that syncs to one. There is no exception, no matter how much better the targeting would be. This is not a best-effort commitment. It is the design constraint the whole system is built around.

Concretely, that means:

• Enquiry forms we build collect only what booking an appointment needs: a name, a way to contact you back, and a service or body area. They do not collect symptoms, history, medication, imaging or anything a clinician would recognise as clinical detail.
• Conversion tracking records that an appointment was booked or attended. It never records who, and never records what for.
• Where a booking or practice-management system is connected, the connection is one-way and aggregate: counts and totals, never rows about individuals.
• Reporting figures that come from your practice-management system are read by us as totals you or your team have exported. We do not hold a copy of your patient record.

Who is controller and who is processor

For your patients' data, your clinic is the controller. It is your data and your duty of care. Where we handle any personal data on your behalf — for example, enquiry records passing through a form we built — Clinovo acts as your processor and acts only on your written instructions.

For our own business records about you and your staff — the contract, invoices, the email thread — Clinovo is the controller.

What we commit to as your processor

• Process personal data only on your documented instructions.
• Keep it confidential, and bind anyone who works on your account to the same duty.
• Use appropriate technical and organisational security: unique credentials, multi-factor authentication on every account that supports it, encryption in transit, and access limited to the people who need it.
• Not engage a new sub-processor without telling you first and giving you a fair chance to object.
• Help you respond to a subject access request or a regulator, and tell you without undue delay if there is ever a breach.
• On the day the engagement ends, delete or return the personal data we hold for you, and confirm in writing that we have.

Access, and how it ends

Every advertising, analytics and Business Profile account we work in is owned by your clinic, not by us. We work inside your accounts by invitation. When an engagement ends, our access is removed and yours is unaffected: the campaigns, the history, the tracking configuration and the landing page all stay with you. There is no account to hand back because it was never ours, and nothing is held hostage.

Sub-processors

The providers we may use in delivering an engagement are: a website host and CDN, an email provider, a form-delivery provider, a payment processor, and the advertising and analytics platforms your clinic already owns. A current named list is provided on request and forms part of the engagement paperwork.

Advertising compliance

No advertising claim about a clinical service is published without your own qualified clinical lead approving it in writing. We do not publish claims about clinical outcomes, we do not use before-and-after imagery in regulated categories, and we do not make superiority claims that cannot be substantiated. Where a rule of the CAP Code, the ASA, the GMC, the HCPC or the CSP applies to something a clinic wants to say, the rule wins.

Questions

Email hello@clinovo.uk. If your own governance lead wants this in a signed data processing agreement before you engage us, say so and we will sign one.