Who we are
Scriptis Software Ltd is a company registered in England and Wales, company number 17535222. Our address is 71 Vyse Street, Jewellery Quarter, Birmingham B18 6EX.
If you have any question about this policy or your personal information, email hello@scriptis.co.uk.
The two ways we handle personal information
1. Information about our customers and website visitors. When a clinic signs up to Scriptis, or someone contacts us or visits this website, we decide how that information is used. For this information we are the controller, and this policy explains what we do with it.
2. Information clinics keep in Scriptis about their own clients. Client records, consent forms, medical history, treatment notes, photos and bookings belong to the clinic that uses Scriptis. The clinic is the controller and Scriptis only stores and handles that information on the clinic's behalf, as their processor, under the data processing agreement in our terms.
If you are a client of a clinic that uses Scriptis, the clinic's own privacy notice explains how your information is used, and you should contact the clinic directly about your records. If you contact us instead, we will pass your request to the clinic straight away and tell you we have done so.
What we collect
From clinics that sign up or ask about Scriptis
- your name, clinic name, email address, phone number and business address
- the names and email addresses of the people you add as users
- your subscription plan, payment history and invoices (your card or bank details are held by our payment provider, not by us)
- messages you send us and notes of calls with you
- security records about your account, such as login times, the device and browser used, failed login attempts and account lockouts
From visitors to this website
- anything you send us by email, such as a sign-up or demo request
- basic technical information that every website receives, such as your IP address and browser type, which our hosting provider records in its server logs for security
This website does not use advertising or tracking cookies. The Scriptis software uses one essential cookie to keep you logged in, which it cannot work without.
Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Set up and run your account, give you support and send you service emails | Contract: we need it to provide the service you signed up for |
| Take subscription payments and keep invoices | Contract, and legal obligation to keep tax and accounting records |
| Alert account owners to new-device logins, failed logins and lockouts, and investigate misuse | Legitimate interests: keeping clinics' records secure |
| Reply to sign-up and demo requests and other enquiries | Legitimate interests: answering people who contact us |
| Tell you about new Scriptis features | Legitimate interests for existing customers, and you can opt out at any time. We do not send marketing to anyone else without consent |
| Deal with complaints, legal claims and requests from regulators | Legal obligation and legitimate interests |
We do not sell personal information, and we do not use the client records clinics keep in Scriptis for our own purposes.
Who we share it with
We use a small number of trusted companies to run Scriptis. Each one is bound by a contract to protect the information and use it only to provide its service to us.
| Who | What for | Where |
|---|---|---|
| SiteGround | Hosting the website and software, storage and backups | United Kingdom (London data centre) |
| Our card payment provider (Stripe or Square) | Taking subscription payments | United Kingdom and EU |
| Our email delivery provider | Sending service emails, alerts and reminders | United Kingdom and EU |
| Google Fonts | Showing the typeface on this website. Your browser sends your IP address to Google when it loads the font | Google's global servers |
We may also share information with our accountants, lawyers and insurers, or with the police, the Information Commissioner's Office or another regulator when the law requires it.
Information sent outside the UK
Our hosting is in the UK. If any of our providers handle information outside the UK, we make sure the destination is approved by the UK government as having adequate protection, or that an approved safeguard such as the International Data Transfer Agreement is in place.
How long we keep it
| Information | How long |
|---|---|
| Customer account details | For as long as you subscribe. When an account is deleted or deactivated, it is deleted from live systems straight away and from backups within 30 days |
| Invoices and payment records | 6 years after the end of the financial year they relate to, as required by tax law |
| Emails and support messages | 2 years after our last contact with you |
| Security logs | 12 months |
| Sign-up and demo enquiries that do not become customers | 12 months |
How we protect it
Information is encrypted when it travels over the internet and when it is stored. Every user has their own login, the software locks itself after 15 minutes without use, account owners are emailed about logins from new devices, an account locks after 3 wrong passwords, and everyone is asked to change their password every 60 days. We take daily backups and keep an audit trail of who viewed or changed each record.
If a data breach puts your information at risk, we will tell you and, where the law requires it, the Information Commissioner's Office.
Your rights
You have the right to:
- ask for a copy of the personal information we hold about you
- ask us to correct anything that is wrong or incomplete
- ask us to delete your information
- ask us to limit how we use it, or object to us using it, including for marketing
- ask for your information in a format you can move to another service
To use any of these rights, email hello@scriptis.co.uk. We will reply within one month. We may ask for proof of identity first, so that we only give information to the right person.
Complaints
If you are unhappy with how we have handled your personal information, please tell us first. Our complaints page explains how, and what happens next.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO will usually expect you to have raised the complaint with us first.
Changes to this policy
We will update this page if the way we use personal information changes, and change the date at the top. If the change is significant, we will also email our customers.