Privacy
Privacy notice
Version 2026-10-06. This notice explains the information Vericenta uses to scope and provide website and social-media assurance services. Vericenta Ltd is the data controller for the company-side processing described here, company number 17441523, registered office 24 Howe End, Kirkbymoorside, York, YO62 6BD.
Who is responsible for your information?
Vericenta Ltd (company number 17441523, registered office 24 Howe End, Kirkbymoorside, York, YO62 6BD, ICO registration reference ZC245228) is responsible for the controller-side processing described in this notice. Privacy enquiries can be sent to hello@vericenta.com.
Controller and processor roles
These roles are not the same for every data flow. Vericenta acts as controller for customer/contact administration, billing references, security, quality assurance, reviewer decisions, professional audit-trail records and issued-report records.
Where a client specifically instructs Vericenta to process personal data solely on that client's behalf, Vericenta acts as processor for that data and the standard Article 28 Data Processing Schedule applies. The actual role is assessed by the purpose and instructions for each data flow rather than by a blanket label.
Information we use
- Business, website and social-media scope details, including clinic name, website address and public social profile URLs supplied for review.
- Contact details you provide, such as name, email address and optional telephone number.
- Limited business contact information used for relevant B2B outreach, including organisation name, public business email address, business website/domain, contact source and marketing preference/suppression records.
- Notes you choose to add to a scope check, order or review request.
- Public-facing website and social-media content needed to scope, review and carry out the agreed service, plus client-supplied screenshots, exports, direct links or transcripts where platform access is incomplete.
- Review findings, reviewer decisions, report content and the professional-review audit trail.
- Order, subscription and payment-reference information. Card details are handled by the payment provider and are not stored in Vericenta's application database.
- Operational and security information needed to protect the service and prevent abuse.
- Technical anti-abuse information used by Cloudflare Turnstile on the free website check, such as IP address and browser signals needed to validate a legitimate submission.
Where we get information from
Vericenta obtains information directly from clients and contacts when they make an enquiry, request a scope check, create or use an account, place an order, communicate with Vericenta or provide material for review.
Vericenta may also obtain information from other sources where this is necessary for the service: public-facing websites and registered public social-media accounts within the agreed review scope; material supplied by a client such as screenshots, exports, direct links or transcripts; and service providers involved in account administration, authentication, payments, security and service operation. Where information comes from a public source or a third party, Vericenta uses only the information reasonably needed for the stated purpose.
For limited B2B outreach, Vericenta may identify relevant healthcare organisations and published business contact details from public business websites and other public business sources. Public availability is not treated as permission by itself: Vericenta records the source, checks the applicable marketing route, provides privacy information and honours objections and opt-outs.
Public website/social content and patient information
Do not submit patient records, case files, private health information or other unnecessary special-category personal data through the intake, notes or order forms. Notes should describe public-facing business scope only, and material sent in breach of this instruction may be deleted. Vericenta may review material already published on the submitted public website or registered public social-media accounts. Public healthcare content can contain names, testimonials, photographs, videos or health-related statements about identifiable people. The service is not designed for private medical records and clients should not submit them through the general website/social-review intake.
Where identifiable material is encountered on a public website or registered social account, or appears in client-supplied social screenshots/exports/transcripts, Vericenta aims to retain only the wording and context reasonably needed for an assurance finding, evidence trail or agreed monitoring service. Clients are responsible for ensuring material they supply can lawfully be provided for the requested business assurance purpose. Vericenta's data-protection controls require minimisation, exclusion or a documented lawful condition before any special-category data is processed for Vericenta's own controller purpose.
Why we use information
| Purpose | Expected lawful basis |
|---|---|
| Respond to enquiries and run the free scope check | Steps at your request before a contract and/or legitimate interests |
| Deliver a paid review, report or Ongoing Assurance service | Performance of the contract and legitimate interests in providing and evidencing the service |
| Maintain reviewer decisions and quality controls | Legitimate interests in professional governance and quality assurance |
| Secure accounts, prevent abuse and investigate incidents | Legitimate interests and applicable data-protection/security obligations |
| Maintain billing and tax records | Contract and applicable legal obligations |
| Send limited, relevant B2B information about Vericenta's services to appropriate business contacts | Legitimate interests where appropriate, subject to the applicable electronic-marketing rules, transparency and the right to object |
Business outreach and direct marketing
Vericenta may send limited, relevant business-to-business information about its healthcare website assurance services to appropriate healthcare organisations. Before outreach, Vericenta records the source and subscriber type, checks the applicable electronic-marketing route and screens the contact against its do-not-contact register.
Where UK data-protection law applies to the business contact information, Vericenta may rely on legitimate interests for proportionate B2B outreach after considering the purpose, necessity and impact of the processing. If information is obtained from a public or other indirect source, Vericenta provides the required privacy information within the applicable period and normally includes access to this notice in the first marketing contact.
Vericenta does not use patient information, private health information or inferred health conditions to target its ordinary business marketing. Its current direct-marketing controls prohibit unapproved tracking pixels and require a clear sender identity and simple opt-out.
You can object to Vericenta using your personal information for direct marketing at any time. For direct marketing this right is absolute: once a relevant objection or opt-out is received, Vericenta stops the affected marketing and keeps only the minimum suppression information needed to prevent accidental future contact. You can opt out by replying to a marketing email or by contacting hello@vericenta.com.
Special-category information
Vericenta does not ask clients to submit private patient records through the standard service. Public healthcare websites and social-media accounts can nevertheless contain identifiable testimonials, patient stories, images or health-related statements.
Vericenta minimises this material, removes or avoids retaining personal identifiers where they are not needed, and does not use such material for unrelated profiling, marketing or model training. Where a client instructs Vericenta to process special-category information as processor, the client is responsible for establishing the appropriate lawful basis and authority for that processing. If Vericenta ever needs to process special-category data for its own controller purpose, the specific UK GDPR Article 9 condition and any associated Data Protection Act requirement must be documented before that processing begins.
International transfers
Some service providers may process information outside the UK. Where that happens, Vericenta uses an applicable UK adequacy decision or an approved transfer safeguard, together with the documentation required for that transfer. Vericenta records the transfer mechanism used for each material provider in its supplier and data-protection records.
Who we share information with
Where necessary to provide and secure the service, Vericenta may share personal information with specialist providers used for application hosting, database and authentication services, website review, automated analysis, payment processing, anti-abuse protection (including Cloudflare Turnstile on the free website check) and transactional email. These providers receive only the information needed for their role and are subject to the appropriate contractual and security controls.
Vericenta may also disclose relevant personal information to professional advisers, insurers, regulators, law-enforcement bodies or other authorities where this is reasonably necessary and permitted or required by law. Vericenta does not sell personal information to advertisers or other third parties. Material service providers are recorded in Vericenta's supplier and data-protection records, including their role, contractual data-processing terms and applicable transfer safeguards.
Retention
Our standard retention schedule uses the following periods:
- Unconverted enquiries/free checks: up to 12 months after the last meaningful interaction.
- Raw website and social-media content collected for review: normally up to 90 days after the relevant report or monitoring cycle/evidence need, unless needed for an active issue or evidence hold. Only the minimum evidence needed for an approved finding should be retained longer.
- Approved reports and professional-review audit trail: six years after the service relationship ends.
- Annual-report entitlement records: kept while the earned edition remains available to the client, then normally up to six years after that entitlement ends or is revoked.
- Billing/accounting records: at least the applicable statutory period, normally six years from the end of the relevant company financial year.
- Security/authentication logs: normally up to 12 months unless an active incident requires longer.
- Marketing prospect records: retained only while reasonably needed for the documented outreach purpose and review cycle, subject to periodic review and any earlier objection or suppression.
- Marketing suppression records: the minimum identifier and preference evidence may be retained as long as reasonably necessary to ensure an opt-out or direct-marketing objection continues to be honoured.
- Report access tokens: secure report links expire after 30 days; raw bearer tokens are not persisted and non-reversible token hashes are retained only for limited operational/audit evidence.
Automated analysis and professional review
Vericenta uses structured automated analysis to discover and classify content, compare registered public social-media material where access permits, and generate candidate observations. Automated analysis supports the review process rather than replacing the final professional reviewer. Substantive client-facing findings follow the Vericenta professional-review workflow before a report is finalised. The free scope check may automatically estimate website size and the relevant pricing band; Vericenta does not use this service to make solely automated decisions with legal or similarly significant effects about individuals. More detail is available in the Automated intelligence and professional review policy.
Your rights and complaints
Depending on the circumstances, individuals may have rights of access, rectification, erasure, restriction, portability and objection. The right to object to processing for direct marketing is absolute, and Vericenta will stop the affected direct marketing when such an objection is received. Requests are handled under Vericenta's documented rights-request procedure. Contact hello@vericenta.com to exercise a data-protection right or raise a privacy complaint with Vericenta.
If you are unhappy with how Vericenta has used your information or handled a privacy concern, you also have the right to complain to the Information Commissioner's Office.