Privacy notice

1.Who is responsible

SQEDULE LTD (registered in England and Wales, company number 17485470) runs this booking service and is the controller of the information described here. When you book, the clinic you choose provides the appointment and becomes responsible for the details it receives from you. SQEDULE is responsible for your account, the searches you run and your bookings on this site, and the records it keeps to run and recover bookings.

2.What we collect

• Your name, email address and phone number when you create an account or complete a booking. Sign-in is handled by an identity provider that stores your password, never SQEDULE.
• When you sign up: your confirmation that you are 18 or over, and which versions of this notice and the terms of use you agreed to, with the date.
• The appointment you request, the clinic, practitioner, time, price, cancellation terms and the acknowledgements you give, so the booking can be honoured and disputes resolved. The service you book (for example a physiotherapy or skin consultation) can say something about your health, so we treat it as health information.
• For a home-visit appointment only, the address where the practitioner should visit and any access notes you add (such as a buzzer or where to park). We never ask for an address for an appointment in clinic or online. If you tick the box to save it, we also keep the address (not the access notes) on your account to fill in your next home visit.
• Your device's location, only if you choose "Use current location" or search near your current location, and only after your browser asks you. It is rounded to about 100 metres in your browser before it reaches SQEDULE and is used to find clinics near you. SQEDULE does not store it: links carry only the words "Current location", and this browser tab keeps the rounded position until you close it or sign out. A saved availability request keeps only the postcode district around it. You can always type a postcode or area instead.
• Your marketing email choice, and when you gave or withdrew it.
• Payment records: amounts, refunds, any dispute and Stripe's references. Card details are entered directly with Stripe, our payment provider, and are never stored by SQEDULE.
• Support and data requests you send through the help page or the contact form, the name and email address you give there, and the replies to them. If a clinic asks SQEDULE for help with one of your bookings, the request it writes is kept with that booking.
• Favourite clinics (you can save a clinic once you have booked with it), waitlist requests and the search criteria attached to them, when you choose to save them.
• For each favourite clinic, which of its two choices you switched on (offers and news, last-minute availability alerts), the wording you agreed to, where and when you chose, when you switched them off, and which new appointment times we emailed you about.
• Choices you made under the earlier way of choosing emails from a clinic, before 8 October 2026, kept as a record of what you agreed to.
• A record of the emails and app notifications we send you: what kind, when and whether they were delivered. The text of account emails is kept for 30 days.
• For each clinic you book with, when you first booked and whether you found it through SQEDULE or through the clinic's own link, widget, website or messages. Clinics pay SQEDULE for the patients SQEDULE finds for them, so we keep this to bill them correctly (our legitimate interests, Article 6(1)(f)). It is never shared with other clinics.
• The words you type into the search, which may describe a health concern. They are read once by a language model (Amazon Bedrock, run for SQEDULE by Amazon Web Services in the European Union) to work out which concerns and services they mean; the search itself runs on those concerns, and the words are not stored against you, kept in links or written to logs. When the words could not be understood at all, we keep them for 7 days with nothing identifying you (email addresses, links and numbers removed), so the list of concerns the search understands can be improved, and then delete them.
• Technical records: request logs, a short-lived count of sign-in attempts by network address, browser security reports and anonymous page-speed measurements. These are used to keep the service secure and working and are not linked to your account.
• How selected public SQEDULE pages are used, measured with Google Analytics only if you accept analytics cookies: the type of public page, your browser and device type and an approximate location from your network address. We do not send page identifiers, search words or the address of the page you came from. With your consent, a cookie also lets it recognise repeat visits. It is not linked to your account. We do not send analytics information to Google before you accept or from account, booking, clinic workspace or clinic-owned pages.

3.Why we use it, and our lawful basis

UK data protection law (UK GDPR) needs a lawful basis for each use:

• Your account, bookings, confirmations, reminders, changes, payments and refunds: to perform our contract with you (Article 6(1)(b)).
• A home-visit address and access notes, and a saved address you choose to keep: to perform our contract with you by arranging the visit you booked (Article 6(1)(b)). The address sits alongside the health information described below, which is covered by the explicit consent you give at booking.
• Searching, including the words you type and your location if you choose to share it: to give you the search you asked for, our legitimate interest in running a booking service people can search (Article 6(1)(f)). There is no consent step for searching: the words and the location are used for that search only, as described above, and are never used to build a profile of you or for marketing.
• Accounting, tax and dispute records, and answering data-rights requests: to meet legal obligations (Article 6(1)(c)).
• Keeping the service secure, preventing abuse, answering support requests and improving search: our legitimate interest in running a safe, working service (Article 6(1)(f)).
• Google Analytics cookies: only if you accept them, on the basis of your consent (Article 6(1)(a)). You can change your choice on the cookie policy at any time. Without your choice, Google Analytics is not loaded and no analytics information is sent to Google.
• Marketing email: only if you opt in on your notification preferences, on the basis of your consent (Article 6(1)(a)). Booking never signs you up. You can turn it off there at any time, and every marketing email tells you how to stop.
• Last-minute availability alerts from a favourite clinic (new and short-notice appointment times, including the clinic's own last-minute messages): only if you switch them on for that clinic, on the basis of your consent (Article 6(1)(a)). Saving a clinic never switches them on. The free alerts are sent by email. You can switch them off in Favourites or your notification preferences at any time, and every alert email has a link to stop them.
• Offers and news from a favourite clinic (new services, practitioners, locations or opening hours, its news and its offers): only if you switch them on for that clinic, when you save it after a booking, on its page, in Favourites or in your notification preferences, on the basis of your consent (Article 6(1)(a)). Favouriting a clinic never signs you up. The clinic chooses one of SQEDULE's message templates and SQEDULE writes and emails it to everyone who chose it; you get at most five clinic emails a week from all clinics together. Each clinic sees only how many patients chose each, and only once at least five have, never who. Every email has a link to stop them.

4.Health information

The service you book can reveal something about your health. This is special category data. We use it to arrange and manage the care you asked for, with your explicit consent (Article 9(2)(a)), which you give when you acknowledge this notice at booking. When you book, we share the service and your details with the clinic you chose so it can provide your care; the clinic then uses them as a healthcare provider (Article 9(2)(h)). The words you type into the search can also say something about your health; how they are used is described above, and they are never linked to your account.

You can withdraw your consent at any time by cancelling a booking or by asking us to delete your account. Withdrawing does not undo a booking the clinic has already accepted, and records we must keep for legal or financial reasons stay for their retention period.

We never use health information for marketing.

5.Who receives it

• The clinic you book with, which sees your name, contact details and the request.
• A home-visit address and access notes go only to the clinic providing that visit (and its practitioner). They are not shown in clinic lists, on other clinics' screens, in links, in our logs or in analytics.
• If you add your appointments to your own calendar, your calendar app fetches them (clinic, service and time) from SQEDULE through the private link you set up.

These suppliers process information for SQEDULE. Each one, what it receives, where and how information leaving the UK is protected is listed on our suppliers page.

• Amazon Web Services, which hosts the service and stores its records in London, and through it Amazon Bedrock (the search language model, in the European Union), Amazon Location Service (place names typed into the search), Amazon Simple Email Service (email) and Amazon Cognito (sign-in).
• Stripe, which processes payments and holds card details on the clinic's behalf, and receives your name, email and the service booked if a payment is disputed. Stripe may process information in the United States, under the UK-US data bridge.
• Google, which provides Google Analytics and processes measurements only after you accept analytics cookies, possibly in the United States under the UK-US data bridge. Its advertising features are switched off.
• Have I Been Pwned's Pwned Passwords service, which we ask whether a new password has appeared in a known data breach. It receives only the first five characters of a one-way code made from the password, never the password, your email or your name.
• Companies House and the Care Quality Commission, which SQEDULE checks clinics against. They receive clinic details only, never patient information.
• Google Fonts, which supplies the typefaces on clinic websites through SQEDULE's own server, so your browser never contacts Google for them.

SQEDULE does not sell your information and does not share it with advertisers.

6.How long we keep it

Booking, payment and cancellation records are kept for as long as needed to complete the appointment, handle refunds or disputes and meet accounting rules. A home-visit address and its access notes are not needed for accounting: they are removed from the booking 30 days after the visit (after its latest time, if it moved), and straight away for a past visit when you ask us to delete your account. A saved address stays until you delete it on My profile or ask us to delete your account. A waitlist request stops emailing you after its last date and is deleted 30 days later. Search words that could not be understood are deleted after 7 days. Technical logs are kept for a limited period. The exact retention periods are set in SQEDULE's retention schedule and can be requested through the contact form.

Our database keeps encrypted backups for up to 35 days so it can be restored after a fault. Information we delete, including when you ask us to delete your account, can remain in those backups until they expire. It is not put back into use unless a restore is needed, and then it is deleted again.

7.Children

SQEDULE is for adults aged 18 and over. You confirm that you are 18 or over when you create an account, and each booking confirms that you are an adult booking for yourself. Children's health services are listed for information only and cannot be booked through SQEDULE: children's care is arranged directly with clinics, under each clinic's own processes. We do not knowingly collect information about children. If you think a child has created an account, tell us through the contact form and we will delete it.

8.Your rights

You have the right to:

• get a copy of the information we hold about you (access)
• have wrong or incomplete information corrected (rectification)
• have your information deleted, except records we must keep for legal or financial reasons (erasure)
• object to or ask us to restrict a use based on our legitimate interests
• receive the information you gave us in a portable format (portability)
• withdraw consent, for marketing, availability alerts or health information, at any time

When signed in, the privacy centre shows your choices in one place and lets you download your data or ask for your account to be deleted. Anyone can ask for a copy or a correction, including without signing in, through the contact form. To delete an account, we ask you to sign in and request it from the privacy centre, so we know the request comes from the account holder. We answer within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

9.Cookies and storage on your device

SQEDULE sets one cookie that keeps you signed in and is strictly necessary for the service. During a search it also sets a short-lived cookie (sqedule_journey, kept for 30 minutes) holding a random reference that records whether you reached a clinic through SQEDULE or through the clinic's own link, so the clinic is billed correctly. There are no advertising cookies.

On payment pages, Stripe, our payment provider, sets two cookies to prevent fraud: __stripe_mid (kept for one year) and __stripe_sid (kept for 30 minutes). They are strictly necessary for a secure card payment and are set only on pages where you pay. Google Analytics is loaded only if you accept analytics cookies; before that, no analytics information is sent to Google. You can change your choice on the cookie policy. Page-speed measurements are sent to SQEDULE only and contain no identifier.

Your browser also keeps a few things on your device for SQEDULE: your analytics choice, and, until you close the tab or sign out, the words of your last search, the rounded places you searched from and the references that recover an interrupted booking.

10.Changes

Each version of this notice has an identifier, shown at the top of this page. Every booking records the version you acknowledged, and a changed version is shown to you again before your next booking.