Last updated: September 2026
Picanse Ltd respects your privacy. This policy explains how we use personal data when we act as a controller — for example, when you visit www.picanse.com, enquire about our services, create or administer a clinic account, or pay for PICANSE.
It does not describe in detail the patient data that a clinic places in PICANSE. The clinic is the controller of that data and is responsible for its patient privacy notice. Picanse processes it on the clinic's documented instructions under our Data Processing Agreement.
1. Who we are and how to contact us
Picanse Ltd (company number 17329285) is registered in England and Wales. Our registered office is Unit 16 The Mead Business Centre, Mead Lane, Hertford, Herts, United Kingdom, SG13 7BJ. Our ICO registration number is ZC251978.
Email: info@picanse.com
Website: www.picanse.com
2. Personal data we collect
Depending on how you interact with us, we may collect:
- Website enquiries: name, email address, telephone number and message you send us.
- Clinic account data: clinic name, contact details, subscription details, authorised users, settings and correspondence.
- Staff user data: name, work email, role, login/access information and security/audit activity.
- Billing and payment data: billing contact/address, invoices, subscription status, Picanse Wallet top-ups, transaction references and payment status. Card payment details are processed by Stripe; we do not store full card numbers.
- Website usage and cookie data: IP address, device/browser information, pages viewed, referral information and cookie preferences, where collected through cookies or similar technologies.
- Support and communications: records of communications with us and information needed to resolve a query or protect the service.
When a clinic uses PICANSE to manage patient data, it determines the purposes and means of that processing. We process those records, including health data, only as the clinic's processor under the DPA; please contact the relevant clinic first about such data.
3. Why we use data and our lawful bases
| Activity | Purpose | Lawful basis |
|---|---|---|
| Website enquiries and demonstrations | Respond to your request and manage the prospective customer relationship | Legitimate interests; steps before entering a contract where applicable |
| Clinic accounts and subscriptions | Set up, provide, administer and support PICANSE | Performance of a contract; legitimate interests for service management |
| Staff user accounts and audit logs | Authenticate users, provide role-based access, secure the service and investigate misuse | Performance of a contract; legitimate interests in security and prevention of fraud |
| Billing, invoices and wallet payments | Take payment, manage the account and maintain financial records | Performance of a contract; legal obligation for tax/accounting |
| Service communications | Send service, security, administrative and contractual notices | Performance of a contract; legitimate interests |
| Website analytics and non-essential cookies | Understand and improve our website | Consent, where required by PECR/UK GDPR |
| Security, fraud prevention and legal claims | Protect our systems, users and rights; comply with law | Legitimate interests; legal obligation where applicable |
We do not use patient message content for advertising, profiling or training AI models.
4. Who we share data with
We share data only where necessary and under appropriate contractual/security arrangements, including with:
- IONOS, which provides UK hosting and infrastructure in London;
- Stripe, which processes payments and wallet top-ups;
- SendGrid, which delivers transactional emails;
- Meta Platforms / WhatsApp Business Platform (Cloud API), where a clinic enables WhatsApp messaging, to deliver and receive messages;
- professional advisers, auditors, insurers and service providers where necessary to operate our business; and
- regulators, courts, law-enforcement bodies or others where legally required or necessary to establish, exercise or defend legal claims.
We do not sell personal data or share it for third-party marketing.
5. International transfers
Our PICANSE hosting is in London, UK. Some suppliers, including Meta, Stripe and SendGrid, may process limited data outside the UK, including in the United States. Where this happens, we use a lawful transfer mechanism required by UK GDPR, such as an adequacy regulation (including the UK–US Data Bridge where the recipient is certified), the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with supplementary measures where appropriate.
6. Security
We use appropriate technical and organisational safeguards, including encryption in transit and at rest, access controls, role-based permissions, tenant isolation, audit trails, restricted staff access, backups and security/incident-management procedures. No system can be guaranteed completely secure. We maintain a breach procedure and will notify affected people and the ICO where the law requires us to do so.
7. How long we keep data
We keep data only for as long as necessary for the purpose collected, including:
| Data | Retention period |
|---|---|
| Website enquiries and prospective customer correspondence | Up to 24 months after last meaningful contact, unless a longer period is needed for a legal claim or you ask us to delete it sooner where applicable |
| Clinic account and staff-user data | For the account term and normally up to 90 days after closure, subject to legal requirements and backup cycles |
| Patient/clinic data processed for a clinic | As instructed by the clinic; active-system data deleted within 90 days of account closure, subject to law and backup cycles |
| Wallet, invoice and billing records | 6 years from the end of the financial year |
| Audit and security logs | 12 months |
| WhatsApp connection data after disconnect | 30 days |
| Cookie preferences | Up to 12 months, or as stated in the cookie tool |
8. Your rights
Subject to UK GDPR conditions and exemptions, you may ask us to access, correct, delete, restrict or receive a portable copy of your personal data, or object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time. To exercise a right, email info@picanse.com. We may need to verify your identity. We normally respond within one month.
If your request concerns patient data held by a clinic in PICANSE, please contact that clinic first. We will assist the clinic as our customer and processor.
9. Cookies
Our website uses strictly necessary cookies and may use functional and analytics cookies. Analytics cookies are not set unless you opt in. See our Cookie Policy for more information and how to manage your choices.
10. Complaints
Please contact us first at info@picanse.com if you have a data-protection concern. You may also complain to the Information Commissioner's Office (ICO) on 0303 123 1113. Under the Data (Use and Access) Act 2026, we maintain a complaints procedure; please see our Complaints Procedure page.
11. Changes to this policy
We may update this policy from time to time. We will post the updated version on this page and, where changes are material, take appropriate steps to notify affected clinic customers.