Privacy Policy

afterclinic is a clinical-notes service operated by AfterClinic Ltd, a company registered in the United Kingdom (“afterclinic”, “we”, “us”). We provide software that helps private healthcare practitioners record, transcribe, and structure their clinical notes.

For the clinical notes our customers create about their own patients, the practitioner is the data controller and afterclinic acts as a data processor on their behalf. For account and marketing data described below, afterclinic is the data controller.

• Clinical notes (text only). When a practitioner records or dictates a session, audio is transcribed and structured into a text note. Audio is processed entirely in memory and is never written to disk or stored.Only the final text note is persisted. Notes may contain health information about the practitioner’s patients, which the practitioner controls.
• Account information. When you create an account we collect your email address and name, your professional specialty, and authentication data (including two-factor authentication settings where enabled).
• Waitlist registrations. If you join our pre-launch waitlist, we collect your email address and the timestamp of your registration — nothing else.
• Operational logs. We keep audit and security logs of account activity (such as sign-ins and data-erasure requests). These logs never contain audio or transcript content.

We use Google Analytics 4 (provided by Google LLC) to understand how visitors use our public website and blog. Google Analytics collects:

• Pages visited and time spent on each page.
• Referral source (how you found us).
• Device type, browser, and approximate location (country/region level).
• Whether you have visited before.

Google Analytics is only active on our public-facing pages (the homepage, blog, and waitlist). It is not active on the practitioner dashboard or any pages that display clinical data.

No clinical notes, patient information, or session content is ever sent to Google Analytics.

Your choices: You can opt out of Google Analytics tracking across all websites using the Google Analytics Opt-out Browser Add-on. You can also disable analytics cookies in your browser settings.

Google LLC is a data processor under this arrangement. Data collected by Google Analytics may be transferred to and stored in the United States. Google participates in the EU-US Data Privacy Framework and provides Standard Contractual Clauses for UK data transfers.

For more information, see Google’s Privacy Policy.

We rely on the following lawful bases under Article 6 (and Article 9 for health data):

• Performance of a contract. Processing account data and clinical notes to provide the service you have signed up for.
• Legitimate interests. Operating, securing, and improving the service (for example, maintaining audit logs and preventing abuse), balanced against your rights and freedoms.
• Consent. Adding you to the launch waitlist and contacting you about launch. You may withdraw consent at any time (see your rights below).
• Legal obligation. Where we must retain certain records to comply with UK law.

Health information within clinical notes is special-category data; it is processed for the provision of health care under Article 9(2)(h), under the controlling practitioner’s instructions.

• Clinical notes are retained until the practitioner deletes them or closes their account, subject to any retention period the practitioner configures. On account deletion, notes are erased.
• Waitlist emails are retained only until the product launches and we have notified you, or until you ask to be removed — whichever comes first.
• Audit and security logs are retained according to our legal and security retention schedule, then deleted.

Under UK GDPR (Articles 15–21) you have the right to:

• Access the personal data we hold about you (Article 15).
• Rectification of inaccurate or incomplete data (Article 16).
• Erasure of your data (“right to be forgotten”, Article 17).
• Restriction of processing in certain circumstances (Article 18).
• Data portability — receive your data in a portable format (Article 20).
• Object to processing based on legitimate interests or for direct marketing (Article 21).

To exercise any of these rights, contact us at privacy@afterclinic.com. Where afterclinic acts as a processor for clinical notes, we will direct your request to the relevant practitioner (the controller). You also have the right to complain to the UK Information Commissioner’s Office (ICO).

We do not sell, rent, or trade your personal data to third parties, and we do not use clinical-note content for advertising.

We use a small number of trusted providers to run the service. Each is bound by a data-processing agreement, and we host data in the EU/UK where available:

• Supabase — application hosting and database.
• Stripe — subscription billing and payment processing.
• Resend — transactional and notification email.
• Google LLC — website analytics on our public pages (Google Analytics 4).

For any privacy question, or to exercise your rights, email privacy@afterclinic.com. We aim to respond to all requests within one month, as required by UK GDPR.