This notice explains how Atlacare Ltd handles your personal information when you use the Atlacare patient portal ("the Portal").
1. The important distinction
Your healthcare provider — the clinic or practitioner you are a patient of — decides how your health records are used. They are responsible for them under data protection law. For anything about your health information, read your provider's own privacy notice and contact them directly.
Atlacare provides the software your provider uses. We handle your health records on your provider's behalf and on their instructions, to make the Portal work. We do not decide what happens to them.
Separately, there is a limited set of information that Atlacare handles in its own right — the technical and security information needed to run the Portal safely. This notice is about that information.
2. Who we are
ATLACARE LTD, company number 17284670, registered office 96 Sirius Close, Wokingham, England, RG41 3DT.
For privacy questions about this notice, contact [email protected].
3. What we handle in our own right, and why
To run the Portal securely, we handle:
Sign-in and access information — the email address you use to sign in, and how and when you sign in. Why: to give you access to the Portal at all, and to keep your account secure.
Technical information — device and browser type, and internet (IP) address. Why: to keep the Portal working, and to protect it against misuse.
Security and error logs — records of activity and technical faults. Why: to protect the Portal, investigate problems and incidents, and fix faults.
Website analytics — general information about which Portal pages are used, but only if you accept analytics when asked. Record references are removed before this information is sent, so it never identifies which of your individual records you looked at. See our Cookies and Similar Technologies Policy. Why: to understand how the Portal is used and improve it.
Our legal grounds
- Because it is necessary to provide the Portal to you — signing you in, giving you access, and keeping the service running.
- Because we have a legitimate interest — keeping the Portal secure, preventing fraud and misuse, investigating incidents, maintaining service integrity and troubleshooting technical faults. We have considered your rights and interests and believe these uses are ones you would reasonably expect.
- Because you consented — for optional analytics only. You can withdraw consent at any time.
4. What we do not do
We do not sell your information. We do not use it for advertising. We do not use your information, and we do not allow others to use it, to train artificial intelligence models.
5. Automated decisions
We do not make decisions about you solely by automated means that produce legal effects or similarly significantly affect you, and we do not profile you.
6. Who we share it with
We share the information above only with service providers who help us run the Portal securely — for example our hosting, communications and error-monitoring providers — and only so far as they need it to provide their service to us. They are bound to protect it and may not use it for their own purposes.
Our current providers are listed at atlacare.com/sub-processors.
Most of these providers operate within the UK or the European Economic Area. Where information is transferred outside the UK or EEA, we put in place the safeguards required by data protection law, such as the Standard Contractual Clauses and the UK International Data Transfer Addendum.
We may also disclose information where the law requires it.
7. How long we keep it
We keep the information described in section 3 only for as long as we need it for the purposes set out there.
In practice that means:
- Sign-in and access information — while you have Portal access, and for a limited period afterwards so that we can investigate any security question that arises.
- Technical and security logs — for a limited period set by what is needed to detect and investigate security incidents.
- Error logs — for a short period while faults are diagnosed and fixed.
- Analytics information — for the period described in our Cookies and Similar Technologies Policy.
When information is no longer needed for these purposes, we delete or anonymise it.
8. Your rights
You have rights over your personal information, including to ask for a copy of it, to ask us to correct it, to ask us to delete it, to object to certain uses, and to withdraw consent where you gave it.
Your health records are controlled by your provider, so requests about those records should go to your provider. Where we hold those records as your provider's processor, we will help them respond to you.
Requests about the sign-in, technical and security information covered by this notice can come to us at [email protected].
If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office (ico.org.uk). We would ask you to contact us first so we can try to put things right.
9. Changes
We may update this notice from time to time. The current version is always available in the Portal, with the date it was last updated.