Public privacy notice (Article 13)
Understand where your clinic privacy notice appears and what patients should be told about their personal and health information.
The public privacy notice at /privacy/<slug> is a UK GDPR
Article 13 / 14 disclosure. It tells prospects and patients
exactly:
- What data is collected
- Who controls it (the clinic) and who processes it (us + sub-processors)
- The legal basis for processing
- How long it's kept
- Their rights and how to exercise them
Where it's linked
From every collection point:
- Lead funnel landing pages and step pages
- Booking page (before Stripe payment)
- Patient sign-up flow (after payment but before account activation)
- Footer of the patient dashboard
Customising the notice
Open /practice/dpa → Public notice tab.
You can customise:
- Clinic name + ICO registration number
- Data Protection Officer name + email
- Retention policy text (must meet UK GDPR minimum)
- Specific tenant-level notes (e.g. "we share data with our NHS partner X")
What you cannot edit:
- The platform-level processor list (Supabase, Stripe, etc.) — that's derived from your DPA register acknowledgements
- The Article 13/14 mandatory disclosures (legal basis etc.) — the template enforces them
What the patient sees
- Plain-English summary at the top
- Detailed processor table (acknowledged sub-processors only)
- Their rights as a data subject + how to exercise each
- Contact for data-subject requests
- Effective date + version
When to update
- Onboarding a new processor — automatic when you
acknowledge a new entry in
/practice/dpa - Changing retention — update the retention text + bump the version
- Changing your DPO — update + bump version
- Substantive changes — notify patients via the in-portal banner (the system can fire a "privacy-notice-updated" comm template if you want active acknowledgement)
Versioning
Every save creates a new version. Patients who sign up under v3 are bound by v3 wording. Existing patients are notified of material changes via the configured comm template; minor typographic edits don't trigger that.
Anchoring to the funnel
The funnel landing page links the privacy notice before the patient enters any data, so consent is meaningful and informed (UK GDPR Art 7). The funnel's anti-spam page also links it — even rejected submissions get a fair chance to read the privacy posture.