Privacy Policy Version 2026-10-04.3 · Last updated 4 October 2026 This notice explains how planner.clinic uses personal information about account holders, clinic team members and billing contacts, and how the service handles clinic-controlled patient information. It should be read alongside your clinic’s own patient privacy information. 1. Who we are and how to contact us planner.clinic is a trading name of The Curatory Group Limited, company number 16808153, registered in England and Wales. Our registered office is Higgison House, 381-383 City Road, London, United Kingdom, EC1V 1NW. This is a registered office rather than a customer correspondence address. For privacy questions or rights requests, email info@planner.clinic (mailto:info@planner.clinic). Please do not include patient information in your initial message. We are the controller for account administration, our billing records, service security, support and marketing. Your clinic is the controller for patient-related information it puts into the service; we process saved-plan information on the clinic’s instructions to provide storage, recall and deletion. A patient should normally direct a request about a treatment plan to their clinic. We will assist the clinic with requests relating to information we process for it. The Curatory Group Limited is registered with the ICO. Our Clinic Data Processing Agreement (/dpa) sets out the processing terms offered to clinics, including provider details and assistance with return, deletion and rights requests. Authorised clinic representatives can review their acceptance through Clinic agreements (/agreements). 2. Information we collect and where it comes from - Account information you provide, including your name, email address and authentication details. A clinic administrator may provide your email address to invite you. - Clinic information provided by you or your team, including clinic name, workspace address, contact details, locations, branding and treatment library. - Service information generated through use, including plan-generation counts, security and plan-recall audit logs, subscription status and support communications. - Billing information supplied by you or Stripe, including billing business name and address, customer and subscription references, plan and quantities, payment and invoice status, amounts, discounts and transaction references. Stripe collects your card information directly; we do not receive or store your full card number or card security code. - Pseudonymised saved-plan information, including treatment structure, proposed dates, prices and display choices, associated with a clinic and a hashed plan code. - Terms and Data Processing Agreement acceptance, Privacy Policy acknowledgement and optional marketing preferences. Agreement records include the clinic’s legal name, the accepting representative, their confirmation of authority, document versions and acceptance time. Previous acceptance records are preserved. 3. Patient information Patient first names and plan-specific custom messages remain in local browser storage on the clinic’s device, expire 48 hours after the draft’s last edit and are not included in the saved server copy. Expired drafts are cleared while the app is open or when it is next opened. Generated PDFs are not retained by planner.clinic. The clinic controls documents it downloads or shares. A pseudonymised copy of each final plan’s treatment structure is retained for authorised clinic recall. The intended content is generic treatment descriptions, prices and administrative planning information; general pain and downtime indicators describe the treatment, not the patient’s health. Clinical records and patient-specific health information must stay on the practitioner’s own platforms. Do not enter diagnoses, symptoms, medical histories, medications, allergies, clinical findings or outcomes into planner.clinic, including personal messages. Patient identifiers must not be entered in server-bound fields. Generic treatment information is not automatically health data. A record may still be personal data when linked to an identifiable patient through a code or information held by the clinic, so saved plans are not described as anonymous. Classification depends on the actual content and use; information revealing an identifiable person’s health status would require the appropriate additional safeguards and a scope review before that use. The clinic remains responsible for its lawful basis and patient privacy information. 4. Purposes and lawful bases - Providing accounts, subscriptions and support: performance of our contract where you personally contract with us; otherwise our legitimate interests in providing the service to your clinic and administering its authorised users. - Securing accounts, preventing misuse, investigating billing problems and improving service reliability: our legitimate interests in running a safe and dependable service, taking account of your rights. - Keeping necessary tax and accounting records and responding to valid legal requirements: compliance with our legal obligations. - Optional marketing emails: your consent, which you may withdraw at any time. Account and payment information needed to provide a requested service must be supplied for us to do so. Optional marketing is not a condition of access. We do not use saved patient plans for advertising or to make automated clinical decisions. Clinics determine the legal bases for the patient information we process on their behalf. 5. Marketing and service messages At signup you can choose an optional, unticked box for product news, tips and offers from planner.clinic. We record your choice, email address, the wording shown and its version, source and time. Signup opt-in takes effect after email confirmation. You can withdraw consent in Email preferences (/email-preferences), using the unsubscribe link in marketing emails or by emailing info@planner.clinic. Changing your account email requires a fresh opt-in. Withdrawal does not affect earlier lawful processing. Necessary account, payment, security and contractual notices are service communications and are separate from marketing preferences. 6. Recipients and international processing Authorised members of your clinic can access clinic information according to their permissions. We use Vercel for hosting and Supabase for authentication and database services. They process service information under their applicable contractual arrangements. We use Stripe for checkout, subscription billing, invoices and payment administration. Stripe also processes payment information for its own purposes, including fraud prevention and meeting legal obligations, as explained in the Stripe Privacy Policy (https://stripe.com/gb/privacy). Patient names, plan messages and treatment structures are not sent to Stripe as billing metadata. We use Resend (Plus Five Five, Inc.) to deliver branded subscription receipts. Resend processes the billing recipient’s email address and name, receipt contents, invoice links and delivery information. No patient names, treatment plans or clinical information are included. Sending is configured in Resend’s EU region, but provider support and other processing may take place outside the UK and EEA, including in the United States. See Resend’s Data Processing Addendum (https://resend.com/legal/dpa) for its processing and transfer safeguards. Open and click tracking are disabled for these service emails. We may disclose necessary information to professional advisers or public authorities where needed for a legal obligation or the establishment, exercise or defence of legal claims. Provider processing, support or subprocessors may involve countries outside the UK; a UK database location does not mean all processing stays in the UK. Transfers requiring protection must use an applicable UK adequacy arrangement or contractual safeguards, such as approved clauses with the UK Addendum or the UK International Data Transfer Agreement. Contact us for information about the safeguards applicable to your data and how to obtain a copy. 7. Retention and security Each saved plan copy expires one year after generation. Recall is blocked after expiry and a daily job deletes expired saved-plan records. Recalling and regenerating a plan creates a separate copy with its own code and one-year period; it does not extend or overwrite the original. Clinic users can delete a saved copy earlier. Recall requires both a logged-in member of the same clinic and the plan code. The saved-plan database record stores a one-way hash of that code; the original code may appear in request URLs and associated infrastructure logs, which must also be protected. The saved-plan purge does not remove separate audit metadata, downloaded documents or local drafts. Audit records follow their own purpose-based retention. Clinic-wide return and deletion are support-assisted: contact info@planner.clinic. Where a backup cannot immediately be selectively erased, data must remain protected and beyond ordinary use until it expires, and deletion instructions must be reapplied if restored. We will explain the applicable retention and completion timetable when handling the request. Cancelling a paid subscription changes access and does not itself delete the account or clinic records. Account and clinic information is retained while the account is active, and afterwards only as needed for security, support, legal obligations or claims. We retain billing and invoice records for the applicable accounting and tax retention period, and acceptance evidence where needed to establish the applicable agreement. Retention depends on the record’s purpose, relevant legal requirements and any ongoing dispute; it is not extended merely for marketing. Contact us about account deletion or the retention applicable to a particular record. We retain marketing consent and withdrawal evidence to demonstrate and respect your choices. Receipt delivery records prevent duplicate messages and help resolve delivery problems; pending message content is removed after the provider accepts it, while limited invoice and delivery identifiers remain for billing support. These records are restricted to authorised service administration. We use access controls, encryption in transit and restricted administrative access. You should secure your device, downloads and recall codes. No online service can guarantee absolute security. 8. Your rights and complaints Depending on the circumstances, you may have rights to access, correct, erase or restrict use of your information, object to processing based on legitimate interests, request portability and withdraw consent. Email info@planner.clinic to exercise a right. We may need proportionate information to verify a request; some records must be retained to meet legal obligations. Patients should normally contact their clinic for requests concerning their care and treatment plans. To make a data protection complaint to us, email info@planner.clinic. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and explain the outcome. You may also complain to the UK Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/). You do not have to contact us first, although we welcome the opportunity to resolve a concern. 9. Changes to this notice We identify the current version and provide a downloadable copy above. We will bring material changes to your attention as appropriate. Acknowledging this notice is not consent to all processing: the lawful bases above apply, and marketing remains a separate choice.