Privacy policy
What we do with personal information, written so you can actually check it. If you booked an appointment with a business that uses Booked, section 2 is the one you want.
1 Who we are #
Clayton Ball Limited, trading as Booked, is the controller of the personal information described in this policy. We are registered in England and Wales under company number 17478614.
Our registered office is at 1 Richmond Road, Lytham St. Annes, England, FY8 1PE.
Anything about this policy, or any request about your own information, goes to privacy@trybooked.co. It reaches our Data Protection Lead directly. We are not required to appoint a Data Protection Officer and have not appointed one; we have named a person who owns this instead, which we would rather say plainly than imply a role we do not have.
Our registration with the Information Commissioner’s Office is confirmed on request.
2 Whose information this covers — and whose it does not #
Booked is a WordPress plugin. It installs on a business’s own website and stores that business’s appointments, customers, answers and documents in that business’s own database, on that business’s own hosting. There is no central system holding every practice’s patients at once.
That architecture decides the law that applies. For the people who book through a Booked form, the business running the site is the controller — it decides why and how their information is used — and we are its processor, acting only on its instructions. The terms of that relationship are in our data processing agreement, which forms part of the contract with every customer.
This policy covers the people we make decisions about ourselves:
- People at businesses that buy, trial or evaluate Booked.
- People who contact us — support chat, email, a security report, the contact form.
- People who visit trybooked.co.
- People who apply for a job with us.
- Partners, agencies and resellers in our partner programme.
There is one narrow exception, and it is worth naming rather than hiding. When a customer uses Booked Payments, our payment partner and we each have our own legal duties around fraud, anti-money-laundering and disputes. For those specific duties we act as a controller in our own right over a limited set of transaction data, not merely on the customer’s instructions. Section 5 says what that data is.
3 What we collect, and why #
| What | Where it comes from | Why we have it |
|---|---|---|
| Name, work email, business name, phone number | You, when you start a trial or buy | To create your account, licence the software to you, and reach you about it |
| The website domain your licence is activated on, your plugin version and your PHP and WordPress versions | Your site, each time it checks its licence | To confirm the licence is valid for that domain, and to tell you when a version you are running has a problem |
| Billing name, billing address, VAT number, the last four digits and brand of your card, and your payment history | You, through Stripe’s own payment fields | To take payment and to meet our tax and accounting obligations |
| Support conversations — chat transcripts, emails, and any screenshot or log you send us | You | To answer you, and to fix the thing you found |
| Anything you choose to show us when you ask for help with your site | You, when you grant access | Only to do the thing you asked. We do not browse a customer’s records otherwise |
| For Booked Payments users: business ownership and identity details, and bank account details for payouts | You, through Stripe | Because the law requires a payment provider to know who it is paying |
| For Booked Payments transactions: amount, currency, time, outcome, the disputed-transaction record, and the IP address a booking was placed from | Your site, at the time of the payment | Fraud prevention, dispute defence and anti-money-laundering duties |
| If you sign in with Google: your name, email address, profile picture and Google account identifier | Google, when you choose to sign in that way | To sign you in and match you to the right account |
| If you connect a Google or Microsoft account: the tokens that keep the connection working, and the address of the account | The provider, when you connect it | So the calendar write or the mail send keeps working without asking you to sign in each time |
| For job applicants: your CV or links, your email, and our notes on your application | You | To consider you for the role |
What we do not collect
- Card numbers. They are typed into fields hosted by Stripe and never touch our systems or your website.
- The content of your AI prompts or their answers. We meter AI use — which feature, which model, how many tokens, what it cost — and store none of the text.
- Visitor IP addresses, for country detection. Where the product shows you which country a visitor is in, the lookup happens on your own server against a table shipped with the plugin. No address is sent anywhere or stored.
- Analytics or advertising data on this website. There is no Google Analytics, no advertising pixel and no third-party tracker on trybooked.co. See the cookie policy.
4 The lawful basis for each of those #
UK GDPR requires a specific lawful basis for every purpose, not a general one for the organisation. Ours are:
| Purpose | Lawful basis | Where it is a legitimate interest, what that interest is |
|---|---|---|
| Providing the software and your account | Performance of a contract | — |
| Taking payment and issuing invoices | Performance of a contract | — |
| Keeping accounting and tax records | Legal obligation | — |
| Licence checks and version reporting from your site | Legitimate interests | Stopping a paid licence being used on sites it does not cover, and being able to warn you about a version with a known fault |
| Answering support and keeping the conversation | Performance of a contract, and legitimate interests | Being able to see what we told you last time, so you do not have to explain it twice |
| Fraud prevention and dispute defence on Booked Payments | Legal obligation, and legitimate interests | Preventing payment fraud and defending chargebacks — an interest shared by us, by you and by the cardholder |
| Security monitoring and abuse prevention | Legitimate interests | Keeping the service and its customers safe from attack |
| Product emails about changes, outages and releases | Legitimate interests | You need to know when software you depend on changes or breaks |
| Marketing emails to people who are not customers | Consent | — |
| Considering a job application | Legitimate interests, and steps before entering a contract | We cannot hire without reading applications |
Where we rely on legitimate interests we have weighed them against your rights and recorded the result; you can ask us for that assessment. Where we rely on consent you can withdraw it whenever you like, and every marketing email carries an unsubscribe link that works without logging in.
6 If you connect a Google or Microsoft account #
Two features can connect to an account you already have: writing your bookings into your calendar, and sending your confirmations and reminders from your own mailbox. Both are off until you turn them on, and neither is required to use Booked.
When you connect one, you are shown the exact permissions on the provider’s own consent screen before anything happens. These are the only ones we ask for:
| Permission | What it lets us do | What it does not let us do |
|---|---|---|
| Send email as you (gmail.send, Mail.Send) | Send your booking confirmations and reminders from your address, so they arrive from you rather than from us. | Read, search, list or delete anything in your mailbox. This permission cannot read mail — it can only send it. |
| Calendar events (calendar.events, Calendars.ReadWrite) | Write your bookings into the calendar you choose, and update or remove one when the booking changes. | Read your existing appointments. Nothing is ever read back out of your calendar. |
| Who you are (openid, userinfo.email, userinfo.profile) | Confirm which account you connected, so we can show you which mailbox is in use, and sign you in if you choose to. | Anything else. It is your name, email address and profile picture. |
What we store: the access token, the refresh token that keeps it working, and the address of the account, so the connection survives and you can see which one it is. Nothing else, and never your password — we never see it, because you type it on Google’s or Microsoft’s own page and not on ours.
Disconnecting: there is a Disconnect button next to the connection in your settings, which deletes both tokens immediately. You can also revoke access from your Google account or Microsoft account at any time, and it stops working straight away without us doing anything.
Limited Use. Booked’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms, and this is a commitment not a summary: we use the data only to provide the feature you switched on; we do not transfer it to anyone except as needed for that feature, for security, or where the law compels us; we do not use it for advertising of any kind; we do not sell it; no human reads it except with your explicit permission or where required by law; and it is never used to train any AI model, ours or anybody else’s.
The same commitments apply to the Microsoft connection. We hold it to the same standard because it is the same job, not because a second policy makes us.
7 Sending information outside the UK #
Our own systems and databases are hosted in the United Kingdom. Some of the companies in the table above are not, and the table says which.
Where information does leave the UK, it is covered by the International Data Transfer Addendum to the EU Standard Contractual Clauses — the transfer mechanism approved by the UK government — together with the technical measures described on our security page. We review each transfer for the risk the destination country poses, and we will give you a copy of the clauses for any transfer that affects you on request.
One point worth naming because it is easy to miss: the fonts on this website are served by Google Fonts, which means your browser makes a request to a Google server and Google therefore sees your IP address. No cookie is set and nothing is stored by us. If that matters to you, a content blocker will stop it and the site still works — it simply uses your system’s own typeface.
8 How long we keep things #
We keep information for as long as it is doing a job, and then we delete it. Specifically:
| What | How long | Why that long |
|---|---|---|
| Your account and licence | While you are a customer, then 12 months | So a licence can be restored if you come back, and disputes about it can be settled |
| Google or Microsoft connection tokens | Until you disconnect, or your account closes | They exist only to keep the connection working, and are deleted the moment you disconnect |
| Invoices, payments and accounting records | 6 years after the end of the financial year they fall in | Required by UK tax law |
| Booked Payments transaction and identity records | 5 years after the relationship ends | Required by anti-money-laundering law |
| Support conversations | 3 years from the last message | Long enough to see the history of a recurring problem, short enough not to be a store of old screenshots |
| Security and audit logs | 12 months | Long enough to investigate an incident found late |
| AI usage records (feature, model, tokens, cost — no text) | 24 months | Billing and capacity planning |
| Marketing contacts who are not customers | 24 months from the last time you engaged, or until you unsubscribe | A list nobody opens should not exist |
| Unsuccessful job applications | 6 months after we decide, unless you agree to us keeping it longer | Long enough to come back to you about another role, and to answer a question about the decision |
When a customer stops using Booked, the personal information in their own database stays in their own database — it is on their site, and it is theirs to keep or delete. What we delete is our copy: the account, the licence and anything we hold centrally, on the schedule above.
9 Your rights, and how to use them #
Under UK GDPR you have the right to:
- Get a copy of the personal information we hold about you, and be told what we do with it.
- Have it corrected if it is wrong or incomplete.
- Have it deleted, where we no longer need it and no legal duty makes us keep it.
- Restrict what we do with it while a dispute about it is resolved.
- Object to us using it for our legitimate interests, or for direct marketing — and for direct marketing, the objection is absolute and we must stop.
- Take it with you in a machine-readable form, where we hold it on the basis of consent or a contract.
- Withdraw consent at any time, where consent is what we relied on.
Write to privacy@trybooked.co. We will answer within one month. If a request is genuinely complex we may take up to two months more, and we will tell you within the first month if that happens and why. There is no charge, unless a request is repetitive or excessive — in which case we will tell you what we propose to charge before doing anything, not after.
We may need to confirm who you are before we act, because handing someone else’s record to the wrong person is the worst outcome of a subject access request. We will ask for the least that will settle it.
10 How we keep it safe #
The full account is on our security page, including the parts that are not finished. In summary: everything travels over TLS; documents are encrypted at rest with AES-256-GCM and stored outside the web root, reachable only through a permission-checked route; every administrative action is written to an audit log; access to production is limited to the people who need it and is logged; and the architecture keeps each customer’s data in their own database rather than pooling it.
What we do not claim: we hold no ISO 27001 or SOC 2 certificate and we have not yet had an independent penetration test. We say so on the security page too. A third-party test is the next thing we are paying for, and we would rather tell you that than let a badge you assumed we had do the talking.
If you think you have found a vulnerability, write to security@trybooked.co. We aim to acknowledge within 30 minutes during working hours, we will not take legal action against anyone who reports something in good faith, and we will tell you what we did about it.
If a breach happens that is likely to risk people’s rights, we will report it to the Information Commissioner within 72 hours of becoming aware of it, and tell the people affected without undue delay where the risk to them is high. Where we are a customer’s processor rather than the controller, we tell the customer without undue delay so that they can do the reporting — the timings are in clause 8 of the data processing agreement.
11 The AI features, and automated decisions #
Booked has features that use a large language model — drafting screening questions, summarising a month of bookings, writing up a consultation note, preparing a response to a payment dispute. Three things are true of all of them.
- They run through us, not through you. A customer site never holds an AI key and can never send a free-form prompt. It names one of a fixed list of features and sends the structured facts that feature needs; there is no path that forwards an arbitrary prompt, model or token budget.
- The text is not kept and is not used for training. Our AI provider does not train on data sent through the business API. We store the meter reading — feature, model, tokens, cost — and none of the content.
- Nothing is decided about a person by a machine alone. Every AI output is a draft for a human to accept, edit or throw away. A consultation note is reviewed by the clinician; a dispute response is reviewed before it is filed. There is no automated decision-making that produces legal effects or similarly significant effects on anyone, within the meaning of Article 22.
If you would rather no AI feature ran at all, they can be turned off for your site entirely and the rest of Booked works exactly as before.
13 If you apply for a job #
Applications come to jobs@trybooked.co and are read by the people hiring for that role. We hold what you sent, plus our notes and the outcome.
- We keep unsuccessful applications for 6 months and then delete them, unless you tell us you would like us to hold on to it for future roles.
- We do not run background checks, credit checks or automated CV screening.
- The paid piece of work in our hiring process is paid whatever the outcome, and we do not keep or use it afterwards.
- If you are offered a job and accept, your application becomes part of your employment record and a separate employee privacy notice applies, which you get before you start.
14 Children #
Booked is sold to businesses, and this website is not aimed at children. We do not knowingly collect information about children through it.
The software itself is a different question, and one our customers must answer: a clinic may well book appointments for children, and a parent or guardian may give the details. In that case the clinic is the controller and it is for them to decide how consent and parental responsibility are handled. Booked gives them the tools — per-question consent records, a full answer history and an export — but the decision is theirs, and our data processing agreement says so.
15 If you are not happy #
Tell us first if you are willing to — privacy@trybooked.co — because most of it we can simply fix.
You do not have to, and you never lose the right to go straight to the regulator. In the UK that is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk. Complaining to them costs nothing and does not affect anything else between us.
16 Changes to this policy #
The version number and date at the top of this page change whenever the document does. Where a change affects your rights or what we do with your information, we email customers at least 30 days before it takes effect rather than quietly updating the page.
Earlier versions are kept and we will send you any of them on request, so a claim about what this policy said last year can be checked rather than argued about.