Privacy Notice

This notice explains how Seen to Seated handles information about website visitors, business contacts, customers, and people whose clinic inquiries pass through our systems. It distinguishes our own business information from information handled for a clinic. It is not the clinic's patient privacy notice.

1 Who we are

Seen to Seated and The Seen to Seated Method are brands of Crimson Fox Retail Ltd, company number 16808606, registered in England and Wales. Our registered office is Unit 1, Kataria Point, Riches Road, Ilford, IG1 1JH, United Kingdom.

Email [email protected] for privacy requests and questions. Our service is intended for private clinics serving adults throughout the United Kingdom.

2 Our role and the clinic role

We control information used to manage our own website, business inquiries, customer accounts, billing, and our own permitted business marketing. We act as a processor or similar contracted service provider when handling a clinic's patient inquiries under its instructions. Where applicable, we act as its HIPAA business associate.

The clinic decides why it collects patient information, how it uses it for care and follow-up, and its professional retention duties. Read its privacy notice too. This notice does not obtain patient marketing permission or replace a clinic's HIPAA Notice of Privacy Practices. A clinic must provide its own applicable health-data notices.

3 Information handled and sources

For our own business, we may handle your name, work email, telephone number, clinic name, role, business address, correspondence, meeting details, contract and billing records, access and security logs, and feedback. We obtain it from you, your organization, account activity, and the service providers involved in those transactions. Payment providers process payment details; do not email full card or bank credentials to us.

For clinic inquiries, intended fields are name, contact details, treatment sought, and booking preferences. We may also handle inquiry text, messages, appointments, call metadata, consent evidence, and suppression records. Enabled Voice AI processes audio recordings, transcripts, summaries, actions, and updates saved to contacts. People may volunteer additional health information, even though we do not request a full medical history.

Sources include the person contacting the clinic, clinic staff, authorized imports of past inquiries or existing patients, and the approved call, messaging, form, chat, and booking services. A contact's presence on an imported list does not establish permission to market to them.

4 Purposes and limits

We use our business information to answer inquiries, provide requested guides, arrange meetings, supply and administer services, invoice, maintain accounts, protect security, comply with law, and manage disputes. Where permitted, we send business tips and offers with the appropriate permission or other lawful basis and an opt-out.

We process clinic information to answer administrative inquiries, capture contact and booking details, route calls, support callbacks, send authorized messages and reminders, maintain inquiry visibility, and provide approved reactivation campaigns. Clinical diagnosis, treatment suitability, and clinical triage remain with the clinic. We do not make patient treatment or eligibility decisions.

We do not use clinic leads, recordings, or conversations for our own advertising, unrelated profiling, general AI model training, or improvement for other customers. Operational AI processing is limited to the authorized service and applicable supplier arrangements. We do not sell clinic inquiry data or use it for cross-context behavioral advertising. Patient lists are not uploaded to advertising audiences under the standard service.

Patient testimonials, images, and stories need separate appropriate permission before use. A clinic's approval of content is separate from a patient's permission. Contact the clinic about withdrawing patient-content permission; we will cooperate with instructions and our own legal duties.

5 Calls and follow-up

When enabled, recording may begin as the call connects. Transcripts are produced afterward. A welcome announcement does not mean recording waits until the caller agrees. The clinic's call route must provide the notices, permissions, and alternative inquiry arrangements required for its actual circumstances.

During clinic working hours, the system may attempt a live transfer; outside hours or if transfer fails, it captures details for a response. A receiving clinic or destination service may process the transferred call under its own arrangements. The service is not an emergency or clinical response service.

Marketing email and SMS require the relevant permissions and controls. You can unsubscribe from our own marketing through its link or by emailing us. For a clinic's messages, use its provided opt-out or contact it directly. We help synchronize relevant suppression records. A treatment relationship, missed call, or acceptance of service terms is not blanket marketing permission.

6 Lawful processing

For our own business administration, the basis is legitimate interests in responding to business inquiries, managing corporate customer relationships, securing services, and resolving disputes; contract where the person is themselves party to it; and legal obligation for required records. We balance legitimate interests against individual rights. We use consent for optional tracking or marketing where required and honor objections. We do not treat silence or reading this notice as consent.

For clinic patient data, the clinic identifies its lawful basis and any required health-data condition and gives documented instructions. Health information needs additional protection. We do not claim that a general legitimate interest alone authorizes its use. Recording permissions and electronic-marketing requirements must be assessed separately.

7 Recipients and access

HighLevel/LeadConnector and the relevant telecommunications and operational AI suppliers support hosted inquiry handling, calls, messages, booking, and record storage. Only enabled and approved functions are used for clinic data. The actual supplier and feature arrangements must meet the clinic's applicable safeguards before activation.

Google, Microsoft OneDrive, Calendly, and separate content AI tools may support our business administration and content work. Under the standard arrangement, clinic consumer inquiry data and private conversations are not copied into those separate tools. This is distinct from approved operational AI within the inquiry system.

Stripe or another agreed payment service handles business payments. Clinic patient payments use the clinic's own secure payment links. Social and advertising platforms process information through their own accounts and terms; ordinary creative publication does not authorize disclosure of private inquiries to them.

The business is currently owner-operated. Future staff or contractors may work in different countries, but only people needing information for assigned work receive access under appropriate confidentiality, data protection, and transfer arrangements. Clinic business coaching does not require access to identifiable patient inquiries. Supplier and contractor details for clinic processing are governed by the DPA register.

We may disclose information when legally required, to protect lawful rights and security, to professional advisers under confidentiality, or in a genuine business transfer with appropriate protections. We do not publish private patient records as portfolio material.

8 International handling

We operate from the UK. Approved suppliers may process information in the US and other locations identified in their applicable arrangements; supplier support may involve India. Contractor locations depend on actual appointments. This notice is not unrestricted worldwide authorization.

Where UK transfer restrictions apply, appropriate safeguards must be in place, such as applicable adequacy arrangements or approved contractual transfer terms with required assessments and additional protections. Contact us for relevant information and a copy of safeguards, subject to lawful confidentiality restrictions. US patient processing must also meet any applicable healthcare or location restrictions.

9 Retention and return

Clinic audio and full transcripts have an agreed operational retention period of 90 days, subject to lawful clinic instructions, necessary legal holds, and verified deletion controls. Summaries, saved inquiry details, booking information, and other operational records are kept for the active service and the agreed return process, unless a different lawful schedule is documented. They do not automatically share the audio retention period.

Customers can request free data return before service ends and for 30 calendar days afterward. Existing recordings may expire before that window ends. Contact exports and individual recording or transcript retrieval are separate processes. After the window, unneeded records are deleted under instructions, except required retention and protected supplier backups. Backups may not disappear immediately; retained copies remain protected and are not used for unrelated purposes. We do not promise recovery of permanently deleted records.

The clinic must arrange retention of its required clinical and professional records; this operational service is not a replacement repository. Necessary consent and suppression evidence may be retained to demonstrate permissions and avoid unwanted contact.

We retain our own business records only while needed for the stated purposes, legal accounting and tax requirements, security, or claims. We review open inquiries and permitted follow-up needs rather than keeping every business lead indefinitely. Ask us for the criteria relevant to your information.

10 Cookies analytics and advertising

Google Analytics and Meta Pixel are planned, but have not been enabled for this service's websites as of this notice's date. Any necessary website, embedded form, booking, security, or preference technologies must be assessed separately. Linking to another site is different from embedding its tracking.

Before optional tools are activated, we will update the technology inventory and notice, explain purposes and recipients, and provide the required choices. Optional advertising tracking will not activate before consent where required. We will use consent for optional analytics unless a verified legal exception applies. Refusing optional tracking must not prevent a basic inquiry. Choices can be changed through the provided cookie settings.

Clinic pages need a separate assessment and clinic-specific disclosure. We must not send treatment details, contact fields, recordings, appointment details, or other protected patient information to advertising tools through URLs, events, forms, or audiences. Routine cookie acceptance is not a substitute for a required health-data authorization. Where applicable US law requires an opt-out or recognition of a qualifying browser signal, the implemented controls must honor it.

This planned-tracking section must be updated when deployment changes. Cookie names, suppliers, purposes, duration, and controls will be listed in the completed cookie notice before activation.

11 Rights and choices

Where UK data protection law applies, you may request access, correction, erasure, restriction, or portability where the conditions apply. You may object to legitimate-interests processing and object at any time to direct marketing. Withdraw consent at any time without affecting earlier lawful processing. Rights have exceptions, including necessary legal retention. We normally respond within one month, with any lawful extension explained.

Complain to us or to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. You do not have to contact us before complaining to the ICO. Our ICO registration is ZC182685.

Email [email protected] with enough information to locate the relevant account or inquiry. Do not send unnecessary medical information or identity documents. We verify requests proportionately. If we hold information for a clinic, we forward the request or direct you to that clinic and assist as required.

12 Security adults and updates

We use appropriate access controls, individual logins, multifactor authentication, confidentiality arrangements, and risk-based security measures. No system is absolutely secure. Report suspected incidents to [email protected]. We do not claim that a vendor's optional certification automatically covers our configuration.

Our services target adult private-clinic business activity. Do not deliberately submit children's information through the standard inquiry service. If such information is received, we involve the clinic in lawful handling rather than assuming it has no protection.

We update this notice when practices or legal requirements change. Material changes will be communicated appropriately. A new notice does not authorize a new use of existing information where permission or other legal steps are required.