Principles

We handle personal data lawfully, fairly and transparently, under the UK GDPR and Data Protection Act 2018. We collect only what we need, keep it accurate, secure and no longer than necessary, and respect your rights.

Special-category data

Health information on forms is special-category data (Article 9) processed only with your explicit consent, for treatment, safety and records.

Protecting sign-in

To limit password guessing and to stop our sign-up and password-reset forms being used to send unwanted email, we keep a short record of attempts made through our own sign-in, sign-up and password-reset screens.

Each record holds a one-way SHA-256 hash of the email address rather than the address itself, the IP address the attempt came from, which of the three forms it was, and whether it failed or was blocked. Hashing means the record cannot be read back as a list of who has an account with us.

These records are deleted automatically after 24 hours. Where an address or an IP goes over the limit, access to that form pauses for a short period and then unblocks itself; no account is ever permanently locked by this. We consider this necessary for the security of the service.

Bot protection

The app includes a bot-protection check (Cloudflare Turnstile) intended for the sign-up and password-reset forms. It is not currently switched on, so at present nothing is sent to Cloudflare and no check is shown. If it is switched on, the check will run on those forms and a verification token will be sent to Cloudflare, together with your IP address, so that it can confirm the submission is not automated. This section will be updated at that point.

IP addresses and abuse prevention

We record the IP address of signed-in sessions so that abuse, fraud and coordinated misuse of the platform can be investigated. We also check the IP address of a device against records of free trials already claimed, so that the same device cannot take repeated free trials under new email addresses. A shared IP address can produce a false match, so this is only ever used as a supporting signal and never as the sole reason for a decision about you.

Diagnostics when something goes wrong

When the app crashes or a request fails, we record what happened so it can be fixed: the error message, where in the code it came from, and the type of page you were on. Personal data is stripped out in your browser before the report is sent, so email addresses, phone numbers, postcodes, card-shaped numbers, record identifiers and access tokens are replaced with placeholders rather than stored. Web addresses are reduced to the shape of the page, so a link containing a private access token is never recorded.

Where you were signed in, the report is linked to your account so that we can tell whether a fault affected one person or everybody. These records are visible only to our administrators and are used only to diagnose and fix faults.

Campaign measurement

If, and only if, you turn on the Marketing category, we record which advertising campaign brought you to us, so that we can tell which campaigns are worth running. Nothing is recorded for this purpose without that consent, and withdrawing it deletes what is stored on your device.

What is kept is deliberately limited: the campaign labels in the link you arrived through (the utm_source, utm_medium, utm_campaign, utm_term and utm_content values), a single advertising click identifier where one is present (gclid, fbclid, msclkid or ttclid), the host name of the site that referred you but never the full referring address, and the path of the page you landed on with any query string discarded. We keep both the first campaign that introduced you and the most recent one before you acted.

This record is attached to your account only at the point you actually do something: creating an account, making a booking, or completing business onboarding. It is not used to track you across other websites, it is never sent back to an advertising network, and it is not used to make any decision about you or to target you individually.

Marketing messages, and stopping them

Marketing emails and marketing text messages each need their own separate opt-in, and both are off unless you turn them on. We record when you gave that permission and where you gave it, so that we can evidence it.

Every marketing email carries an unsubscribe link, and your mail app's own unsubscribe button works too. Unsubscribing takes effect without needing you to sign in, and asking twice does no harm. By default it stops marketing emails; stopping marketing text messages as well is offered as a separate, deliberate second step, so that a one-click email unsubscribe cannot silently cancel a different permission.

Unsubscribing stops marketing only. You will still receive service messages about a booking you have actually made, such as confirmations, reminders, changes and cancellations, because stopping those would mean missing an appointment you have paid for. Those can be managed separately in Settings.

Analytics and advertising

We currently use no third-party analytics service and no advertising or tracking tags. Before any such provider is introduced, it will be named here and in our Cookies and Storage Policy, and it will run only under a consent category you have turned on.

More & contact

Full detail is in our Privacy Policy. For requests or a data concern, email hello@arcticstudios.uk; you can also complain to the ICO (ico.org.uk).