Privacy Policy

1. Who We Are

ClinicWeb is operated by PRIME SCOTLAND LIMITED (the “Controller” for marketing and website operations). We build and support NHS‑compliant GP practice websites. We do not need or process clinical records via the website.

2. What Data We Collect

• Contact details you provide (e.g., name, email, phone) when you make enquiries.
• Operational details for projects (e.g., domain, brand assets, content you supply).
• Technical data (e.g., device/browser information, IP address) and usage data (pages viewed, navigation paths) when analytics are enabled.

Patient clinical information is not collected or processed by ClinicWeb via the website. Practices remain responsible for patient‑facing tools and their data flows.

3. How We Collect Data

• Directly from you (forms, email, phone, project intake).
• Automatically from your device when you browse (cookies and analytics, if consented).
• From third‑party tools you connect (e.g., consultation platforms), subject to their policies.

4. How We Use Data

• Provide and improve our websites and services.
• Respond to enquiries and deliver projects.
• Maintain security and prevent abuse.
• Analyse aggregated usage to improve navigation and content (when analytics are enabled).

5. Lawful Bases

• Contract: to deliver requested services.
• Legitimate Interests: operate and secure our services; improve usability.
• Consent: non‑essential cookies/analytics where you opt‑in.
• Legal Obligation: comply with laws and enforce rights.

6. Cookies & Analytics

We use essential cookies for site operation. With your consent, we may enable analytics to understand usage. See our Cookie Policy for details and how to change preferences.

7. Sharing & Processors

We may use trusted service providers (e.g., hosting, analytics) who process data on our behalf under contracts that require appropriate safeguards. We do not sell personal data or use advertising cookies.

8. International Transfers

Where data may be transferred outside the UK/EEA by a provider, we rely on appropriate safeguards (such as standard contractual clauses) or equivalent protections. We choose providers with strong privacy practices.

9. Retention

We retain data only as long as needed to deliver services, comply with legal obligations, or resolve disputes. Cookie preferences are retained up to 180 days; analytics data (if enabled) are retained per the provider’s policy.

10. Security

We use reasonable technical and organisational measures to protect data. No system is 100% secure; we monitor and improve safeguards continuously.

11. Your Rights

Under UK GDPR, you have the following rights:

• Right of Access – Request a copy of your personal data.
• Right to Rectification – Request correction of inaccurate data.
• Right to Erasure – Request deletion of your data ("right to be forgotten").
• Right to Restrict Processing – Request we limit how we use your data.
• Right to Object – Object to processing based on legitimate interests.
• Right to Data Portability – Request your data in a machine-readable format.
• Right to Withdraw Consent – Withdraw consent for non-essential cookies/analytics at any time.

Submit a Data Request

We aim to respond to all requests within 30 days. If you are unsatisfied with our response, you can complain to theInformation Commissioner's Office (ICO).

12. How to Exercise Your Rights

To exercise any of your data protection rights:

1. Submit a Request: Use our Data Subject Request Form or email us at hello@clinicweb.uk.
2. Verification: We may ask you to verify your identity to protect your data from unauthorised access.
3. Response Time: We will respond within 30 days. Complex requests may take up to 90 days (we will notify you).
4. No Fee: Most requests are free. Manifestly unfounded or excessive requests may incur a reasonable fee.

We keep records of all data subject requests for compliance purposes.

13. Contact

Privacy enquiries: hello@clinicweb.uk

Data Protection Contact (DPO): Privacy Officer, PRIME SCOTLAND LIMITED — hello@clinicweb.uk

Company: PRIME SCOTLAND LIMITED — Registered in Scotland No. SC604374. Registered office: Summit House, 4-5 Mitchell Street, Edinburgh, Scotland, EH6 7BD.

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in services, law, or guidance. Material updates will be published here with an updated date.