Privacy Notice
This notice explains how PrivaPay Ltd ("PrivaPay", "we", "us") handles personal information. It covers patients who are billed through our platform, and the staff of the providers, insurers and partners we work with.
1. Who we are
PrivaPay Ltd is a company registered in England and Wales, company number 16804815.
We operate a payments platform for UK and Irish private healthcare. We take out-of-pocket patient payments for providers, and we settle approved insurer claims.
Contact for any privacy question, including to exercise your rights: privacy@privapay.health, or write to us at our registered office.
2. Our role — this matters for what you can ask us
We act in two different capacities, and which one applies determines who you should approach.
As a processor. When a hospital, clinic, consultant or billing bureau uses our platform to invoice you, they decide what to bill and why. We act on their instructions.
As a controller. We decide how we use information in our own right for: our website and cookies; our own business records; fraud prevention and platform security; and the identity checks we are required to carry out on business customers.
If you are a patient asking to see, correct or erase your billing record, contact the provider who treated you. We will help them respond, and we will tell you who to approach if you come to us first.
3. Information we handle
Patients
- Name, date of birth, postal address, email address and mobile number
- Your provider's patient or account reference, insurer name, membership and authorisation numbers
- Invoice line items, which identifies the treating clinician, the specialty, the site and the procedure
- Payment records: amount, date, method, card token, last four digits, expiry, authorisation and settlement references
- Messages and calls between you and us, including delivery and read status, replies, and your opt-out choices
- Technical data when you open a payment link: IP address, device and browser type, and timestamps
We do not receive or store your full card number or CVV. Card details are captured directly by our payment provider.
Providers, insurers, partners and their staff
- Name, job title, employer, work email, work phone
- Account credentials, access rights, audit logs of actions taken in the platform
- Bank account and settlement details, and the identity and verification records we are required to hold
- Contract, billing and correspondence records
Website visitors
The marketing site does not record pages viewed, referrer, approximate location, or cookie identifiers. See section 12.
4. Why we use it, and our lawful basis
Where we rely on legitimate interests we have assessed that our interest does not override your rights.
| What we do | Lawful basis (UK GDPR Article 6; EU GDPR Article 6 for individuals in the EEA) |
|---|---|
| Issue invoices, take payments, operate payment plans, process refunds | Contract, or legitimate interests where the contract is between you and your provider |
| Settle approved insurer claims and produce remittance and reconciliation files for providers | Legitimate interests, accurate settlement between provider and insurer |
| Send you transactional messages about your bill or payment (section 7) | Contract and legitimate interests |
| Prevent and investigate fraud, secure our systems, meet PCI DSS obligations | Legitimate interests; legal obligation |
| Identity verification, sanctions screening and anti-money-laundering checks on business customers | Legal obligation |
| Keep accounting, tax and audit records | Legal obligation |
| Handle complaints, disputes, chargebacks and legal claims | Legitimate interests; legal claims |
| Manage our relationships with providers, insurers and partners, and market our services to businesses | Legitimate interests |
| Improve the platform, monitor service quality and produce aggregated statistics | Legitimate interests |
| Marketing messages that need your permission | Consent |
Health information. Invoice and claim data reveals that you received healthcare and often what kind.
We do not use your health information for marketing, profiling or automated decision-making.
5. Automated decision-making
We do not make decisions about you that produce legal or similarly significant effects using automated processing alone.
6. Who we share information with
- The provider who treated you, and where relevant your insurer, so your claim and balance can be settled
- Payment and banking providers, including Adyen, our acquirer and settlement partner, and the card schemes
- Communications providers, including Twilio Inc., which transmits our text messages, and our email provider
- Software and infrastructure suppliers: cloud hosting, and your provider's EHR and practice-management integrations
- Professional advisers: auditors, lawyers, insurers, and debt recovery agents where a provider instructs us to escalate an unpaid balance
- Regulators, law enforcement and courts, where we are required to disclose or need to establish or defend a legal claim
- A buyer or investor, under confidentiality, if we sell or reorganise the business; this would be in an anonymised manner
Every supplier that processes personal information on our behalf acts under a written contract that restricts them to our instructions. Some recipients — such as card schemes, banks, regulators and professional advisers — receive information as independent controllers and are bound by their own legal and regulatory obligations.
We do not sell personal information to anyone, and we do not share it with third parties for their own marketing.
7. Text messages and emails
We send messages about your bill, for example that an invoice is ready, a payment link, a receipt, a payment plan reminder, a failed payment, or a refund confirmation. We send them because you are being billed for treatment, not to sell you anything.
How you come to receive them
Your mobile number reaches us in one of three ways: your provider gave it to us as part of instructing us to bill you; you gave it to us directly on a payment page or form; or you sent us a message first. Where we ask for your number on our own forms, we tell you at that point what we will send and how often.
Frequency
Message volume varies with your account. Typically this is fewer than six messages per bill. We do not send recurring campaign messages.
Opting out
Contact us at privacy@privapay.health. Opting out of texts does not stop us contacting you by other means about money you owe, and does not cancel a payment plan or a debt — we will write to you by email or post instead.
Costs
Message and data rates may apply, depending on your mobile plan and where you are.
What we do with messaging data
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-message opt-in data and consent will not be shared with, sold, rented, or transferred to any third parties, affiliates or lead generators for marketing, promotional or lead-generation purposes.
We share your mobile number only with the communications providers and mobile networks that are needed to deliver the message to your handset — Twilio and the carriers — and with your treating provider, whose record it is. Twilio acts under our data processing agreement and may use your number only to deliver our messages and administer your account. Mobile carriers that transmit the message are bound by their own regulatory obligations.
We keep a record of your opt-out on a suppression list so that we do not message you again. That record exists only to honour your choice.
Marketing
We do not send marketing texts to patients. We may send business marketing emails to provider, insurer and partner contacts about our services, where we have consent or where the soft opt-in under regulation 22 of PECR (or, for contacts in Ireland, regulation 13 of S.I. No. 336 of 2011) applies. Every such message carries an unsubscribe link.
Keep in mind
A text message is not a secure channel. We keep the content of our messages to the minimum needed — we do not include your diagnosis, treatment detail or card details in a text.
8. Sending information outside the UK
Most information stays in the UK or the European Economic Area. Some of our suppliers, including Twilio, are based in or route data through the United States or other countries.
Where information leaves the UK we rely on UK adequacy regulations where they apply, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and additional technical measures. Where information leaves the EEA we rely on European Commission adequacy decisions or the EU Standard Contractual Clauses, together with a transfer impact assessment. You can ask us for details of the safeguard used for a particular transfer.
9. How we protect it
We hold PCI DSS scope for card data so that it never enters our providers' systems. We encrypt personal information in transit and at rest, restrict access on a least-privilege basis with multi-factor authentication, log access to records, test our systems independently, and train our staff.
We operate an information security management system aligned to ISO/IEC 27001:2022.
10. How long we keep it
Where we act as a processor, the provider's retention instruction governs and may be shorter.
| Record | Period |
|---|---|
| Invoice, payment and settlement records | 7 years from the end of the relevant accounting period, for tax and audit |
| Claim and remittance data held for a provider | For the term of our agreement with the provider, then returned or deleted on their instruction |
| Card tokens | The earlier of the card token being disabled or deleted by the card holder, or 7 years |
| Message content and delivery logs | 24 months |
| Opt-out and suppression records | Indefinitely — we need them to keep honouring your opt-out |
| Identity and anti-money-laundering records on business customers | 5 years after the relationship ends |
| Complaints and disputes | 6 years from resolution |
11. Your rights
You can ask us to give you a copy of your information; correct it; erase it; restrict or object to how we use it; send it to another organisation in a portable format; and withdraw consent where we relied on it. You can object to direct marketing at any time and we will always stop.
Some rights are limited. We cannot delete an invoice we are legally required to keep, and where we act as a processor we must refer your request to your provider.
We will respond within one month. There is no charge unless a request is clearly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, and we will explain why.
If you are unhappy, contact us first. You can also complain to the Information Commissioner's Office — ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you are based in Ireland, you may also complain to the Data Protection Commission — dataprotection.ie, +353 (0)1 765 0100, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
12. Cookies
Neither the marketing site at www.privapay.health nor the platform at app.privapay.health sets any cookies.
A signed-in session on the platform is stored in the browser's local storage, not in a cookie. Sidebar open or closed is likewise a local-storage preference on that device and is never sent to our servers. Neither site sets analytics cookies. There is no cookie banner and no cookie settings link.
13. Children
Our services are not directed at children. Where we bill for treatment given to someone under 18, we deal with the parent, guardian or other person responsible for the account, and we do not knowingly collect a child's contact details directly.
14. Changes
We will post any change here and update the version and date above. If a change materially affects how we use your information we will take reasonable steps to notify you, for example by email or by a prominent notice on our website.