How HMDG handles personal information through the ClinicSignal website, application and support services
ClinicSignal is operated by HMDG Limited, trading as HMDG ("HMDG", "we", "us" or "our"), a company registered in England and Wales under company number 10409692 and registered with the Information Commissioner's Office under reference ZB365505. Our registered office is 76 Canterbury Innovation Centre, University Road, Canterbury, Kent, CT2 7FG, United Kingdom.
This policy explains how we handle personal information through the ClinicSignal website, application and related support services. It also explains how we process information supplied by clinics through connected practice management systems such as Cliniko, Nookal, WriteUpp, PracticeHub and Splose.
Contact us about privacy or your information:
When we manage website enquiries, customer relationships, account administration and our own security or legal obligations, HMDG acts as a data controller. This means we decide why and how that information is used.
When a clinic uses ClinicSignal to analyse information about its patients, practitioners and prospective patients, the clinic is the data controller and HMDG acts as its data processor. We process that information on the clinic's documented instructions under our Data Processing Agreement.
If you are a patient, prospective patient or practitioner, your clinic's privacy notice explains its reasons and lawful bases for using your information. This policy supplements that notice.
Clinics checking us before connecting should read the ClinicSignal Data Guide, which sets out exactly what we read from each practice management system, the clinic's own responsibilities, our transfer safeguards and a summary of our independent security review.
Website visitors, enquiries and account users
Depending on how you interact with us, we process:
We receive this information from you, from your clinic when it creates or manages your access, and automatically when you use our services.
We also process the credentials or access tokens supplied to connect authorised systems. These are stored encrypted and are never shown back in the application.
Information from connected clinic systems
When a clinic authorises a connection, ClinicSignal retrieves the information needed for its enabled features. This may include:
| Information | Examples and purpose |
|---|---|
| Patient reference information | Practice management system patient IDs, age bands and new or returning indicators, used to analyse attendance, rebooking and patient cohorts. |
| Appointment information | Dates, times, duration, status, appointment type and assigned practitioner, used to analyse scheduling and utilisation. |
| Financial information | Service prices, invoice totals and payment amounts, used for revenue and business performance analysis. |
| Practitioner information | Names, identifiers, roles, working hours and active status, used for practitioner-level reporting. |
| Referring practitioner contacts | Names, organisation, occupation and provider numbers of referrers recorded in the clinic's system, used for referral reporting. |
| Marketing attribution information | Hashed email and telephone identifiers used to match enquiries with bookings. |
| Marketing permission indicators | Email and SMS marketing consent flags recorded in the clinic's system, used to inform clinic worklists. |
Where a clinic enables authorised marketing integrations, we also receive campaign, enquiry and performance information from those connected services, which may include Google Ads, Google Analytics, Google Search Console and SEMrush.
Patient contact details and dates of birth
Patient names, email addresses, telephone numbers and dates of birth may be returned by practice management system APIs.
ClinicSignal fetches patient names, email addresses, mobile numbers and marketing permission indicators on demand for the clinic's Recall and Plan dashboards and for clinic-generated worklist exports.
Names, raw email addresses and telephone numbers are processed temporarily in memory and are not saved in ClinicSignal's database. Dates of birth are processed temporarily to derive age bands and to identify possible duplicate patient records, then discarded.
For marketing attribution, email addresses and telephone numbers are converted into salted hashes at the point of collection and the raw values are discarded. These hashes and other pseudonymous identifiers remain personal information where they can be linked to an individual.
Exports downloaded by a clinic may contain patient contact details. The clinic controls those copies and is responsible for their security, use and retention.
Clinical information
ClinicSignal does not request or retrieve clinical notes, diagnoses, treatment records, medical histories or free-text clinical fields.
However, appointment types, service descriptions and practitioner assignments can reveal or imply information about a person's health. We treat such information as potentially sensitive and process it only under the clinic's instructions and our DPA.
We use information about website visitors and account users to:
On a clinic's instructions, we process connected clinic information to:
ClinicSignal does not send communications to patients. Clinics decide whether and how to contact patients through their own systems and are responsible for the permissions and legal requirements that apply to those communications.
For information we process as a controller, our lawful bases are:
| Purpose | Lawful basis |
|---|---|
| Providing a service or taking requested steps towards a contract where you are personally a contracting party | Performance of a contract. |
| Managing accounts and relationships with people acting for a clinic or organisation | Our legitimate interests in providing and administering the service and communicating with business contacts. |
| Handling general enquiries and support | Our legitimate interests in responding to requests and supporting users; contract where applicable. |
| Maintaining security and investigating misuse | Our legitimate interests in protecting users, information and our services. |
| Meeting statutory obligations | Compliance with the relevant legal obligation. |
| Establishing or defending legal claims | Our legitimate interests in protecting our legal rights. |
| Website analytics and advertising measurement described in section 11 | Consent. |
Where we rely on legitimate interests, we assess whether the processing is necessary and balance those interests against individuals' rights and reasonable expectations.
For clinic information processed on a clinic's behalf, the clinic determines the applicable lawful basis and, where health information is involved, the relevant special-category condition.
Authorising a connection to ClinicSignal does not itself establish patient consent.
If information necessary to create an account or provide a requested service is not supplied, we may be unable to provide that account or service.
ClinicSignal uses a third-party AI service, provided by Anthropic, to turn structured business information into explanations, insights and responses.
Under our DPA, the AI provider receives only the aggregated or pseudonymised metrics needed for the relevant feature. Practitioner names and roles may be included so that practitioner-level explanations read naturally. We do not submit patient names, raw email addresses, telephone numbers, dates of birth, clinical notes or other direct patient identifiers.
We do not permit the AI provider to use clinic personal information to train or fine-tune its models or to improve its services, unless the clinic expressly agrees otherwise in writing.
The question you type into the Advisor is sent to the AI provider as you entered it and kept with your clinic's account so we can support you; we do not filter it. Do not enter patient-identifying information or clinical records. You are responsible for what your users enter, as set out in the MSA. Questions are deleted automatically after 12 months, deleted with your data when you leave, and deleted earlier on request. A clinic owner can switch the Advisor off for their clinic in Settings.
ClinicSignal analyses patterns and can prioritise business worklists. Its outputs support human decisions; the service is not intended to make solely automated decisions with legal or similarly significant effects on individuals. Clinics remain responsible for decisions about their patients and staff.
Participating clinics instruct us to create anonymised, aggregated information for comparisons within ClinicSignal.
Information remains personal information while it is being anonymised. We apply aggregation, minimum group sizes and suppression controls to reduce the risk of identifying patients, practitioners or clinics: a fleet benchmark is shown only when at least 20 clinics contribute to the cohort being displayed, and smaller cohorts fall back to published sector figures. These safeguards are set out in our DPA.
Clinics can opt out of contributing by contacting us at dpa@hmdg.co.uk. Opting out disables market comparison features but does not affect other functionality.
Benchmark datasets are used within ClinicSignal for participating clinics. They are not sold, licensed or shared with third parties.
Information already irreversibly anonymised cannot be traced back to an individual or clinic and may remain in benchmark datasets after participation ends.
Information is accessible to authorised clinic users and to HMDG personnel who need it to provide support, maintain the service, manage accounts or fulfil legal obligations. Access is subject to role-based permissions and confidentiality requirements.
We use specialist suppliers to provide the service:
| Supplier | Purpose | Location |
|---|---|---|
| Railway Corporation | Application hosting, database hosting and background processing | United States |
| Cloudflare, Inc. | Hosting and delivery of the public website | Global network, with controls in the United Kingdom, European Union and United States |
| Anthropic PBC | AI-assisted generation from permitted structured information | United States |
| Plus Five Five, Inc. (Resend) | Delivery of sign-in links, account notifications and reports | United States |
Optional website analytics and advertising measurement involve Google, Meta and LinkedIn, as described in section 11.
We may disclose relevant information to professional advisers, regulators or public authorities where necessary and lawful.
We do not sell clinic personal information or use it to contact patients for HMDG's own marketing.
Changes to the sub-processors that handle clinic information are handled under the notification and objection procedure in our DPA.
Our application and database are hosted by Railway in the United States, and our AI and email suppliers also process information there. This means that information you provide, and the clinic information we process on a clinic's behalf, is processed outside the United Kingdom.
For these transfers we use appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, together with the supplier's own data processing terms. We undertake the assessments required for those transfers.
You can request information about the safeguards relevant to your information by contacting dpa@hmdg.co.uk.
While a clinic uses the service
We retain clinic information for the duration of the service agreement, subject to the clinic's lawful instructions and our DPA.
Patient contact details and dates of birth processed temporarily are handled as described in section 3.
Disconnecting a practice management system
A clinic can stop future access by revoking the relevant API credentials or integration authorisation in its practice management system, or by removing the connection in ClinicSignal's settings.
Disconnecting a system does not itself terminate the ClinicSignal agreement or automatically delete information already imported. A clinic can separately request deletion or terminate its agreement.
Termination or a clinic's deletion request
Under our DPA:
When the service ends, we stop using the connection to retrieve further clinic information. Any retained backup copies are restricted to backup and recovery purposes until deletion.
Deletion from ClinicSignal does not delete the clinic's source records in its practice management system. It also does not delete exports already downloaded by the clinic.
Information already irreversibly anonymised may remain in benchmark datasets. Information that must be retained by law is retained only for the applicable purpose and period.
HMDG's own records
We retain limited records separately from clinic information where necessary for our own lawful purposes:
These periods apply to HMDG's own records and do not override a clinic's deletion rights under the DPA. Each category has a defined reason for retention and is deleted when that period ends.
The ClinicSignal application uses a small number of strictly necessary cookies to keep you signed in, remember which clinic you are viewing and remember your interface preferences. These do not track you across other websites.
| Cookie | Purpose | Duration |
|---|---|---|
| clinicsignal_session | Keeps you signed in after you use a sign-in link. | 7 days |
| clinicsignal_owner_clinic | Remembers which of your clinics you are viewing. | 30 days |
| clinicsignal_clinic | Lets HMDG staff view a client's dashboard on their behalf. | Session |
| clinicsignal_ui | Remembers your chosen interface layout. | 1 year |
The public website also uses measurement technologies from Google Analytics, Meta and LinkedIn to measure visits and interactions and to assess marketing performance. These may disclose device identifiers, IP addresses, page visits and interaction information to those providers, who may combine it with other information they hold.
| Provider | Purpose | Typical duration |
|---|---|---|
| Google Analytics | Visit and interaction measurement | Up to 2 years |
| Meta Pixel | Advertising measurement and audience building | Up to 90 days |
| LinkedIn Insight Tag | Advertising measurement and audience building | Up to 1 year |
These technologies are used on the public website and on the sign-up and sign-in pages of the application, and are not used inside the signed-in dashboard. They do not load until you accept them in the cookie notice. You can reject them there, and change your choice at any time through the Cookie settings link in the website footer or at the foot of the sign-up and sign-in pages. Refusing optional tracking does not prevent use of the core service. You can also block or delete cookies through your browser settings, and each provider offers its own opt-out tools: Google Analytics opt-out, Meta ad preferences and LinkedIn guest controls.
Withdrawing consent stops future consent-based tracking; it does not affect the lawfulness of processing carried out before withdrawal.
Depending on the circumstances and applicable law, you may have rights to:
You can object to the use of your personal information for direct marketing at any time.
For information HMDG controls, contact dpa@hmdg.co.uk. We may need to verify your identity and will respond within the applicable statutory timeframe, normally one month, explaining any lawful extension.
For patient, prospective-patient or practitioner information controlled by a clinic, contact that clinic first. If we receive a request concerning such information, we will direct it to the clinic and assist it under our DPA.
You can also raise a privacy complaint with us using the contact details above. You have the right to complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint without first completing our complaints process.
We will update this policy when our processing changes and revise the date above. Where required, we will bring significant changes to your attention and obtain consent for processing that requires it.
Changes to contractual processing arrangements remain subject to the procedures in our Data Processing Agreement and Master Services Agreement.