Privacy policy
Who we are
Fedelsoft Practice Manager is provided by Fedelsoft Ltd, a company registered in England and Wales (company number 14256263, registered office Grove House, Waltham Road, White Waltham, Maidenhead SL6 3TN, ICO registration [ICO REGISTRATION NUMBER]). You can reach us at support@fedelsoft.com.
We hold personal data in two different roles. For your Fedelsoft account, your subscription and anything you send us through this website, we are the data controller. For the patient, staff and business records that a practice, clinic or hospital keeps in Fedelsoft, that organisation is the controller and we act as its processor, on its instructions and under a written agreement with it.
If you are a patient of an organisation that uses Fedelsoft, your first point of contact about your record is that organisation.
What we collect and why
Your account. Your name, username, email address, mobile number, role and the organisations you work with. We use these to sign you in, to show you only what your role allows and to send you the messages the service depends on. Sign-in secrets are stored in protected form, never as plain text. Our lawful basis is our contract with you or with your organisation.
Your subscription. The organisation's name and billing contact, the plan chosen and a record of payments. Card details are entered with our payment provider and are not stored by Fedelsoft. Our lawful basis is contract, and our legal obligation to keep accounting records.
Records your organisation keeps in Fedelsoft. Patient details, appointments, clinical notes, letters, consents, photographs, documents, invoices, staff rotas and similar records. These include health data. We process them only to provide the service to the organisation that entered them, and we do not use them for our own purposes.
Enquiries. If you write to us or fill in a form on this website, we keep what you send so that we can reply.
Technical records. Sign-in times, the address a request came from and error logs, kept to secure the service and to find faults. Our lawful basis is our legitimate interest in running a secure service.
Questions put to Ask and text sent for drafting. When you use the AI features, the text involved is sent to our AI provider to produce the answer or the draft. It is limited to what your role may already see.
We do not sell personal data, and we do not use it for advertising.
Google user data
Connecting a Google account is optional. If you connect yours from Settings, Fedelsoft asks Google for two things: your Google account email address, and permission to view and edit events on your calendars. It asks for nothing else, and it cannot see your email, contacts or files.
What we access. Your Google account email address, and the events on your primary calendar.
How we use it. Fedelsoft adds your clinics, operating lists, appointments, cases and meetings for the coming 120 days to your calendar, and updates or removes those entries as your Fedelsoft diary changes. So that moving an appointment in Google can move it in Fedelsoft, we ask Google for the changes to your calendar. Google's answer includes your other events. Fedelsoft acts only on the entries it wrote itself, which carry its own mark, and discards everything else without storing it.
What we write to your calendar. A title, a place, a time and a short note. An appointment or case entry shows the patient's initials and Fedelsoft record number, and a case entry shows its title. Patients are never named.
What we store. Your Google account email address; the token that lets Fedelsoft reach your calendar, held in encrypted form; your choices about what to sync; and a list of the calendar entries Fedelsoft wrote, so that it can keep them up to date. We do not store your other calendar events.
Who we share it with. Nobody. Google user data is held by the providers that host Fedelsoft, listed below, and is not passed to anyone else. It is not sold, not used for advertising and not used to train AI models. It is not sent to our AI provider.
How to remove it. Disconnect from Settings at any time. Fedelsoft then revokes its access with Google and deletes the token and its list of entries. The entries already on your calendar stay there as your own record, and you can delete them in Google. You can also remove Fedelsoft's access from your Google account under third-party access.
Fedelsoft's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Who processes data for us
We use the providers below to run Fedelsoft. Each acts on our instructions under a data processing agreement. Those marked optional are used only when you or your organisation connect them.
| Provider | What it does, and when | Where data is held | Safeguard for transfers outside the UK |
|---|---|---|---|
| Cloudflare | Runs the application, stores files and sign-in sessions, and transcribes consultation recordings. Always | Files in EU data centres; the application and sessions on Cloudflare's global network | UK Addendum to the EU standard contractual clauses |
| Supabase | Hosts the database. Always | United Kingdom (London) | Not needed: held in the United Kingdom |
| MailerSend | Sends email. Always | EU (Belgium) | UK Addendum |
| ClickSend | Sends text messages, when your organisation sends them | [NOT CONFIRMED] | [NOT CONFIRMED] |
| Stripe | Takes card payments for subscriptions and memberships | United States and other countries | UK extension to the Data Privacy Framework, or the UK Addendum |
| Anthropic | Answers questions put to Ask and drafts text, when you use the AI features | United States | UK Addendum |
| Receives the calendar entries Fedelsoft writes. Optional, per person | Google's own network, under your own Google account | Google's own terms with you | |
| Zoom | Provides video consultation links. Optional, per practitioner | United States by default | UK Addendum |
| Dropbox | Holds an organisation's files in its own Dropbox account. Optional, per organisation | United States by default | The organisation's own agreement with Dropbox |
| Xero | Receives invoices and payments for bookkeeping. Optional, per organisation | United States | UK Addendum |
| reMarkable | Sends forms to, and receives drawings from, a person's own tablet. Optional, per person | Europe | Adequacy regulations or standard contractual clauses |
We will update this list before adding or replacing a provider.
Where data is kept, for how long, and how it is protected
Where. Data is held by the providers listed above, in the places shown. Where a provider keeps or handles data outside the United Kingdom, the transfer is covered by the safeguard shown against it.
How long.
| Data | Kept for |
|---|---|
| Your account | While it is open, then deleted within 90 days of closure |
| Records an organisation keeps in Fedelsoft | As that organisation instructs. The default is 8 years after the patient's last contact, and until a child's 25th birthday (26th if they were 17 when treatment ended) |
| An organisation's data after its subscription ends | Available to export for 90 days, then deleted; backups are cleared within a further 30 days |
| Consultation recordings | The audio is deleted once the transcript is filed. The transcript is kept as part of the record |
| Billing records | 6 years after the end of the financial year |
| Sign-in and technical logs | 12 months |
| Enquiries sent to Fedelsoft | 2 years after the last contact |
| Text sent to the AI provider | Deleted by the provider within 30 days |
| Google user data | Until you disconnect |
How it is protected. All traffic is encrypted in transit. Access is limited by role and by organisation, and every person signs in with their own credentials. Tokens for connected services such as Google are stored encrypted, under a key held separately from the database. Access by Fedelsoft staff to an organisation's records is limited to what support or maintenance requires.
Your rights, cookies and changes
Your rights. Under UK data protection law you may ask for a copy of your personal data, ask us to correct or delete it, ask us to restrict or stop using it, and ask for it in a portable form. Write to support@fedelsoft.com and we will answer within one month. If your request concerns a record held by an organisation that uses Fedelsoft, we will pass it to that organisation, which must answer it. You may complain to the Information Commissioner's Office at ico.org.uk at any time.
Cookies. The application sets only the cookies it needs to keep you signed in and to complete a connection you have started, such as Google Calendar. This website sets no advertising or tracking cookies.
Children. Fedelsoft accounts are for people working in healthcare and are not offered to children.
Changes. We will post any change to this policy on this page with its date, and tell account holders by email before a change that affects how their data is used.
Contact. Fedelsoft Ltd, Grove House, Waltham Road, White Waltham, Maidenhead SL6 3TN. support@fedelsoft.com.
Last updated: [DATE OF PUBLICATION]