Privacy Policy
Version 1.0 — Effective date: 28 July 2026
This policy explains how Promptmed Ltd handles your personal data when you use ptwr.org and app.ptwr.org (the "Service"). We keep it short and in plain language, because that is how we would want to read it ourselves.
1. Who is responsible for your data
The data controller is Promptmed Ltd, registered in England and Wales (Company No. 16351362), registered office: Unit 4, 80 Station Road, Hampton, TW12 2AX.
Privacy contact: [email protected]
We comply with the UK GDPR and the Data Protection Act 2018 and, where we offer the Service to people in the EU/EEA, with the EU GDPR.
2. What we collect — and what we deliberately do not
We collect:
- Account data — your email address and a hashed version of your password (we never store the password itself), your plan type, and your account settings.
- Payment data — handled by Stripe, our payment processor. We receive only limited payment metadata (for example the last four digits of your card, the card brand, billing country and transaction records). We never see or store your full card number.
- Usage data — which topics and pages you open, searches you run inside the app, and basic session information. Search queries are used to return results and may be kept in aggregated, non-identifiable form to help us decide which topics to write next.
- Technical data — IP address, browser and device type, and security logs, collected automatically to keep the Service secure and working.
- Support communications — emails you send us and our replies.
- Marketing preferences — whether you have opted in to product emails, and your opt-outs.
We deliberately do not collect:
- Patient data. The Service has no facility to store clinical information and you must not enter patient-identifiable data anywhere in it, including the search field.
- Special category data. We do not ask for or collect data about your health, ethnicity, or any other special category of personal data.
- Your professional registration number. Registration requires only an email address.
3. Why we use your data and our legal basis
| Purpose | Data used | Legal basis (UK/EU GDPR Art. 6) |
|---|---|---|
| Providing your account and the Service | Account, usage | Contract — Art. 6(1)(b) |
| Taking payment and managing subscriptions | Payment metadata | Contract — Art. 6(1)(b) |
| Keeping tax and accounting records | Payment records | Legal obligation — Art. 6(1)(c) |
| Security, fraud prevention, debugging | Technical, logs | Legitimate interests — Art. 6(1)(f) |
| Improving content and features | Aggregated usage | Legitimate interests — Art. 6(1)(f) |
| Answering support requests | Support communications | Contract / legitimate interests — Art. 6(1)(b)/(f) |
| Sending service emails (renewal and trial reminders, changes to terms) | Contract — Art. 6(1)(b) | |
| Sending marketing emails | Email, preferences | Consent — Art. 6(1)(a) |
We do not sell your personal data, and we do not use it for advertising by third parties.
4. Cookies
We use a small number of cookies and similar technologies. These are described in our Cookie Policy.
5. Who we share data with
We use a small number of service providers who handle data for us under contract:
- Stripe — payment processing and subscription billing.
- Cloudflare — hosting, content delivery and security for the website and app.
- Our email provider — sending service and (with your consent) marketing emails.
We may also disclose data where the law requires it, or to a successor if the Service is sold, in which case this policy continues to apply.
6. International transfers
We are a UK company and host the Service primarily in the UK/EEA. Some of our providers (for example Stripe and Cloudflare) are US-headquartered and may process limited data in the United States. Where that happens, the transfer is protected by the European Commission's Standard Contractual Clauses together with the UK Addendum, and where the provider is certified under the EU–US Data Privacy Framework (and its UK Extension), by that framework as well. Transfers between the EEA and the UK are covered by the European Commission's adequacy decisions for the UK.
7. How long we keep data
| Data | Retention |
|---|---|
| Account data | While your account is active, then 12 months after deletion or prolonged inactivity |
| Payment and tax records | 7 years (UK accounting and tax law) |
| Security logs | 6 months |
| Support communications | 24 months after the ticket is closed |
| Marketing data | Until you withdraw consent, plus a minimal suppression record |
| Aggregated, anonymised statistics | Indefinitely (no longer personal data) |
| Backups | Rotated within 90 days |
8. How we protect your data
We use encryption in transit (TLS) and at rest, password hashing, access controls on a least-privilege basis, logging of administrative access, separately stored backups, and vetting of the providers listed above. No system is 100% secure; if a personal data breach occurs that is likely to put your rights at risk, we will notify the UK Information Commissioner's Office within 72 hours and, where the risk to you is high, we will notify you directly without undue delay.
9. Your rights
You have the right to:
- access a copy of the personal data we hold about you;
- correct inaccurate data;
- delete your data ("right to be forgotten");
- restrict or object to processing based on legitimate interests;
- receive the data you gave us in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- object to direct marketing at any time — we will stop immediately.
We do not carry out any solely automated decision-making that produces legal or similarly significant effects about you.
To exercise any right, email [email protected]. We will respond within one month (extendable by two months for complex requests, in which case we will tell you). You can also delete your account directly in the app, which triggers the retention schedule above.
If you are unhappy with our response, you can complain to the Information Commissioner's Office (ico.org.uk) or, if you live in the EU/EEA, to your national data protection authority (list at edpb.europa.eu).
10. Children
The Service is for people aged 18 or over. We do not knowingly collect data from anyone under 18; if you believe we have, email [email protected] and we will delete it.
11. Changes to this policy
We will post any changes at ptwr.org/privacy with a new version number and effective date, and for material changes we will email you in advance.