Privacy policy

1. Who we are

Footnotes is provided by Garry Finch, a sole trader, trading as The Finch Workshop, of [postal address for notices] (“we”, “us”).

You can contact us about anything in this policy at hello@myfootnotes.co.uk.

This policy covers the Footnotes app at app.myfootnotes.co.uk and the emails it sends. It explains what we collect, why, who else handles it, how long it's kept and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).

2. Our two roles

For practitioners' accounts, we're the controller. That covers the details you give us to sign in and run your account, and the technical information our systems record when you use the app. Sections 3 to 5 describe it.

For patients' records, we're a processor. Each practitioner who uses Footnotes is the controller of their patients' records: they decide what to record and why, and they're responsible to their patients for it. We store and handle those records only to provide the app to that practitioner, under our data processing agreement with them. Section 6 describes it.

3. What we collect about practitioners

• Account details: your email address and password (stored only in a scrambled, one-way form we can't read), and the secret behind your authenticator app for two-step sign-in.
• Business details you add: your company or trading name, website, address and phone number, the services you offer with their prices, and your settings, such as how long records are kept.
• Activity: when you sign in, and a log of which patient records were looked at, changed, exported or deleted, and when. The log holds record IDs only, never what the records say.
• Technical information: your IP address, browser and device type, and the time and address of each page you open. Page addresses carry record IDs, never patient names or details.
• What you send us: emails, feedback and support requests.

4. Why we use it, and our lawful basis

• To provide Footnotes to you (creating and securing your account, running the app, sending sign-in and password emails, and putting your business details on emails to your patients): because it's necessary for our contract with you, the terms of use.
• To keep Footnotes secure (spotting unusual sign-ins, investigating misuse, keeping the activity log): our legitimate interest in protecting the service, practitioners and patients.
• To run and improve the beta (answering support requests, asking for and using your feedback, telling you about changes that affect you): our legitimate interest in developing a service practitioners find useful. We won't send you marketing emails without your agreement.
• To meet legal obligations, such as keeping financial records once Footnotes charges a subscription, or responding to lawful requests from authorities.

Where we rely on legitimate interests, we've weighed them against your rights, and you can object (see section 10).

5. How long we keep practitioners' details

We keep your account details while your account is open. When you close it, or we end the service, you have 30 days to export your records; we then delete your account and everything in it within 90 days, including from backups. We keep only what the law requires us to, such as billing records once there are any (normally six years), and correspondence we need for a dispute.

Technical logs held by our hosting providers are kept for short periods, normally no more than 30 days.

6. Patients' records

Practitioners use Footnotes to record, for each patient: name, address, phone, email and date of birth; GP and emergency contact; medical history, medicines, mobility and footwear; consent signatures; appointments and the services booked; foot assessments, foot maps and treatment notes; and before and after photos taken during visits. Health information is special category data, which the law protects most strongly.

What we do with these records:

• store them securely and show them only to the practitioner who holds them;
• send the emails the practitioner asks Footnotes to send, such as visit summaries and appointment reminders, which never include detailed clinical notes or medical history;
• help the practitioner answer a patient's request, for example with the full-record export and deletion tools;
• delete them when the practitioner deletes them, or when the practitioner's account ends.

What we never do with them:

• use them for our own purposes, including marketing, analytics, research or training AI systems;
• sell or share them, except with the service providers in section 7 and where the law requires;
• look at them, except when the practitioner asks us to for support, or to fix a fault or security problem, and then only as far as needed.

If you're a patient, your practitioner decides how your record is used and how long it's kept, and should have given you their own privacy notice. Please contact them to see, correct or delete your record. If you contact us instead, we'll pass your request to your practitioner straight away and help them answer it. We can't act on it ourselves, because the record is theirs.

By default Footnotes flags a record for review 8 years after an adult's last visit, and for a child at their 25th birthday (26th if they were 17 at their last visit), following the NHS Records Management Code of Practice. The practitioner can choose a longer period, and decides what happens to the record then.

7. Who else handles the information

We use a small number of service providers (sub-processors) to run Footnotes. Each has signed a data processing agreement with us and may use the information only to provide their service.

We may also share information if the law requires it, to protect someone's safety, or with a buyer if Footnotes is ever sold (who would have to keep to this policy). We'd tell practitioners first unless the law prevents it.

8. Where the information is stored

Records are stored in the European Union, in Ireland. The UK recognises the EU as giving an adequate level of protection, so no extra safeguards are needed for that. Our providers are American companies, and their staff in the USA may occasionally have access, for example to provide support. Where that happens, the transfer is protected by the UK's International Data Transfer Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework.

9. How we keep it secure

• Sign-in needs a password and a code from an authenticator app.
• Everything is encrypted on its way between the device and our servers, and when stored on them.
• The database itself checks that each practitioner can reach only their own patients.
• Every view, change, export and deletion of a patient record is logged.
• Records kept on a phone or tablet for use with no signal are encrypted, locked behind a PIN, cleared on sign-out, and wiped after five wrong PINs.
• Finished visit records can't be changed, only added to with dated amendments.
• Patient details are never put in web addresses or technical logs, and never sent to analytics or error-tracking services.

If a security breach affects patients' records, we'll tell the practitioners concerned without delay, so they can meet their own duty to tell the ICO and their patients.

10. Your rights

You have the right to:

• get a copy of the information we hold about you;
• have it corrected if it's wrong, or completed if it's missing something;
• have it deleted, unless we need to keep it by law;
• have its use restricted while a complaint is looked into;
• object to our use of it on the basis of legitimate interests;
• receive it in a format you can take to another service.

Practitioners can do most of this in the app. Otherwise email hello@myfootnotes.co.uk. We'll answer within one month, and it's free.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Cookies and storage on your device

Footnotes uses only what it needs to work. There are no advertising, analytics or tracking cookies.

• Sign-in cookies keep you signed in and tell the app when you were last active, so it can lock after 30 minutes.
• Encrypted device storage holds today's visits and any visit not yet sent, so you can work with no signal. It's cleared when you sign out.
• An offline screen: the app saves the code for its no-signal screen on the device. It holds no patient information.

Because these are strictly necessary for the service you've asked for, the law doesn't require us to ask for consent first. The app's fonts and icons are part of the app, so opening it doesn't contact any other company.

12. Children

Footnotes accounts are for adult practitioners only. Practitioners may keep records for patients who are children; those records are handled as described in section 6, and the practitioner is responsible for having the right consent from the child or a parent.

13. Changes to this policy

We'll update this policy when Footnotes or the law changes, and change the date at the top. If a change matters, such as a new service provider handling patient records, we'll tell practitioners by email at least 30 days before it takes effect.