Privacy Notice

Controller and processor roles

Dubbl7 is the controller for its own platform account, business-user, contact, billing, security and business-administration data. Each business customer is normally the controller for the customer and client information it enters into Dubbl7 One.

For that business-controlled customer and client information, Dubbl7 acts as processor. We process it to provide and support the service, on the business customer's documented instructions, and where necessary to meet legal or security requirements. The business customer remains responsible for its controller obligations.

Information we handle

Depending on how the service is used, this may include business-user names, email addresses, roles and account details; business contact and billing information; customer or client names, contact details, appointment and booking details, form responses, service records, payment-related records, memberships, plans and waiting-list information; and technical and security information such as access, error and service logs. Business customers may choose to enter health or other special-category information in forms, practitioner notes or free-text fields.

Why we use platform data

We use the data for which Dubbl7 is controller to set up and administer accounts, provide support, manage billing and service communications, protect the service, prevent misuse, meet legal obligations and improve reliability. Our lawful bases are usually performance of a contract, compliance with legal obligations and our legitimate interests in operating and securing the service. We will ask for consent where the law requires it.

Providers and transfers

We use Vercel for application hosting and deployment infrastructure, Supabase for database, authentication, storage and backend infrastructure, and Resend for transactional and application email delivery. These providers may process personal data only as needed to provide their services to us.

Where personal data is transferred outside the UK, we will use appropriate safeguards required by applicable data-protection law. The appropriate safeguard depends on the circumstances and may include recognised adequacy arrangements or contractual protections.

Retention, security and deletion

We keep personal data only for as long as needed for the service, our legitimate operational needs, and applicable legal, accounting, security or business retention requirements. The service does not currently use an automated retention or deletion engine; retention and deletion decisions are reviewed through a documented manual process.

We use proportionate technical and organisational measures designed to protect personal data. On account closure or a valid deletion request, we will handle data in line with the relevant business customer's instructions where it is controller, and with applicable retention, legal and security requirements.

Your rights and contact

You may have rights to request access, correction, deletion, restriction, objection or portability, depending on the circumstances. If you are a customer or client of a business using the service, you should normally contact that business first because it controls your information. We handle requests concerning Dubbl7-controlled data through our documented operational process and assist business customers with relevant requests concerning the data they control.

You may complain to the Information Commissioner's Office if you are unhappy with how personal data is handled. For privacy questions or a request concerning Dubbl7-controlled data, contact privacy@dubbl7.com.