Privacy policy
Effective 22 August 2026. the Sulaia contracting entity identified in your Order Form, at the registered address identified in your Order Form, is controller for account, website, billing and service-administration data. A clinic is normally controller for patient and workforce data entered into Sulaia, and the Sulaia contracting entity identified in your Order Form processes that data on the clinic's documented instructions under the DPA.
Data, purposes and lawful bases
We process identity and contact details, account credentials and MFA state, clinic configuration, support and contract records, billing and transaction records, device, log and security data, and communications. Clinics may enter patient identity, appointment, communication, consent, photograph and clinical-care data, including special-category health data. We use controller data to take pre-contract steps and perform the contract, meet legal duties, secure and improve the service on legitimate-interest assessments, and, where required, on consent. Clinic patient data is used only to provide, secure and support the service on the clinic's instructions; the clinic must establish its own Article 6 condition and Article 9 condition for health data.
Sharing, international transfers and retention
We disclose data only to authorised clinic users, vetted hosting, database, storage, email, messaging, payments, analytics, monitoring and AI sub-processors, professional advisers, or public authorities where law requires it. We do not sell personal data. Where data leaves the UK, we use an adequacy regulation or an approved transfer safeguard, with supplementary measures where appropriate. Controller data is kept only for the stated purpose, legal claims, tax and security periods. Clinic data follows the clinic's configured retention instructions and is returned or deleted at the end of service unless law requires retention. Current sub-processors and retention details are available from the privacy contact identified in your Order Form.
Security, automated processing and your rights
We use tenant isolation, role-based access, MFA for privileged access, encryption in transit, secrets controls, audit logs, backups, monitoring and incident procedures. No Sulaia AI output makes a solely automated decision with legal or similarly significant effect; clinical and operational decisions remain with authorised people. Subject to exemptions, you may request access, rectification, erasure, restriction, portability, or object to processing, and withdraw consent without affecting earlier processing. For clinic-held patient data, contact the clinic first; we assist it as processor.
Contact and complaints
Contact the privacy contact identified in your Order Form or write to the Sulaia contracting entity identified in your Order Form at the registered address identified in your Order Form. We normally respond to rights requests within one month after verifying identity. You may complain to the UK Information Commissioner's Office at ico.org.uk, without prejudice to another legal remedy. Material policy changes will be dated and brought to account holders' attention before a new use begins.