Privacy notice · for the people we hold data about
What we know about you, and how little that is.
This is the notice required by Articles 13 and 14 of the UK GDPR. It is written for the people whose personal data we actually hold: the practice staff who have an account, and anyone who emails us. It says what we hold, why we are allowed to hold it, who else touches it, and how to make us stop.
The only personal data we hold is your work email address and your sign-in records. We hold no patient data, because no mechanism exists to send it to us. If you want the technical detail behind that sentence, the data flow one-pager is the longer answer.
Who we are
Practice Atlas Ltd is the data controller for the personal data described in this notice. Your practice remains the controller for patient data, which never reaches us.
What we hold, why, and what allows us to
| Data | Why we have it | Lawful basis |
|---|---|---|
| Work email address | It is your username. Access is granted per person and is revocable, so an account has to be attached to someone. | Performance of a contract (giving you the account you asked for) |
| Password | Stored only as a cryptographic hash by our authentication provider. We never see it and cannot recover it. | Performance of a contract |
| Sign-in records | When an account signed in, so we can spot abuse and unlock the encrypted application only for approved accounts. | Legitimate interests (keeping the service secure) |
| Emails you send us | To answer you. Kept while the conversation is live and for a reasonable period after. | Legitimate interests (responding to you) |
| Server request logs | Standard web-server metadata, including IP address, generated by hosting any site at all. | Legitimate interests (security and keeping the site up) |
We do not sell personal data, we do not share it for advertising, and we make no automated decisions about you that produce legal or similarly significant effects.
Patient data, in one paragraph
Practice Atlas supplies search logic; the searches themselves run inside your own clinical system. When the application shows you figures, it is reading files you loaded, in your own browser, on your own machine. Those files are never uploaded to us. When you build a search, the rule structure alone is sent to our compile service, and a rule structure cannot contain patient data by construction. So there is no patient data of yours for us to disclose, retain, breach or hand back.
Who else processes it, on our instructions
The web host serves the encrypted application and the public pages. It never receives patient data, account credentials or search logic; it sees standard request metadata such as IP addresses. The Terminology Server receives search terms only, never anything about a patient and nothing about you.
Where data goes outside the UK
We would rather tell you the awkward version than the tidy one. There are two places where processing is not confined to the UK, and neither involves patient data.
How long we keep it
- Account dataFor the life of the account. Removed when the account is closed.
- Sign-in recordsRetained while the account exists, as a rolling security record.
- Compile submissionsNot retained beyond the request that carried them.
- EmailsWhile the conversation is live and for a reasonable period after it closes.
- Patient dataNever held, so no retention applies.
Cookies and browser storage
We set no advertising cookies, no analytics and no trackers. There are no third‑party scripts, fonts or content delivery networks on any of our pages, which is a deliberate architectural choice rather than a policy one: the application is a self‑contained encrypted file.
Two kinds of storage do exist in your own browser, and neither is sent to us:
Because we run no analytics or advertising, there is nothing here that exists for our benefit rather than yours.
Your rights
You can ask us to give you a copy of your personal data, correct it, delete it, restrict or object to what we do with it, or provide it in a portable form. Because the data we hold about you is small and specific, most of these are quick to action. Email support@practiceatlas.org and we will respond within one month.
Where we rely on legitimate interests, you have the right to object, and we will stop unless we can show a compelling reason not to. You will not be treated differently for exercising any of these rights.
Complaints
If something we have done with your data concerns you, you can complain to us directly. There is no form to fill in and no particular form of words to use: tell us what happened and what you want us to do about it, and send it to the address below.
You can also complain to the Information Commissioner's Office at any time, and you do not have to come to us first. The ICO can be reached at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
Practice Atlas is in closed beta and the product is still changing. If we start processing personal data in a way this notice does not describe, we will update it here and date the change. The data position itself is not something we intend to weaken: it is the reason the product is built the way it is.
Last updated: 11 August 2026. What changed: the complaints section now sets out how to complain and our commitment to acknowledge within 30 days, and this notice is now linked from the footer of our public pages. First published 6 August 2026.