Privacy notice
Last updated 20 October 2026
Who we are
Heathmark is provided by Dominion TechOps Ltd (company number 17266496), registered office Hockeys Farm, South Gorley, Fordingbridge, SP6 2PW. We are registered with the Information Commissioner's Office, registration number ZC275876. For anything about your personal data, email [email protected].
If a firm holds your complaint in Heathmark
If you made a complaint to a firm that uses Heathmark, that firm decides how your data is used: it is the data controller, and we process the data only on its instructions. Please contact the firm, and read its own privacy notice, to use your rights. We will help the firm answer you.
For those records, the firm chooses how long they are kept: between 6 and 20 years after the complaint closes. After that, Heathmark deletes the complainant's name, contact details, the complaint summary and notes automatically. Only the details the firm's figures need stay, such as the dates, product, category, outcome and redress, with nothing that identifies the complainant, so the firm's past figures do not change.
If the firm uses the optional Claude add-on, complaint text is sent to Anthropic for a suggestion after email addresses, phone numbers, postcodes and web links are removed. A person at the firm checks every suggestion.
The rest of this notice covers the data we decide about ourselves.
What we collect and why
| Who | What we hold | Why | Lawful basis |
|---|---|---|---|
| People who use Heathmark | Email address, name if given, role, the firms they belong to, sign-in times, two-step sign-in set-up, and what they change in records (the audit trail) | To run accounts, keep them secure and show firms who did what | Contract with the firm; our legitimate interest in security |
| Billing contacts | Name, email, firm details and payment history. Card details go straight to Stripe; we never see them | To take payment and keep accounts | Contract; legal obligation (tax records) |
| People who email us or book a demo | Name, email, firm, what you tell us | To reply and follow up | Legitimate interest |
| Brokers and firms we contact about Heathmark | Business contact details from public sources, and notes of our conversations | To tell firms about Heathmark | Legitimate interest. You can ask us to stop at any time |
| Website visitors | No cookies. Our host's privacy-friendly analytics counts visits without identifying anyone; our host's security systems see your IP address | To keep the site working and secure, and know how many people visit | Legitimate interest |
We do not sell personal data and we do not use it for advertising.
Who we share it with
We use these providers to run Heathmark. Each acts on our instructions under a contract.
| Provider | What for | Where the data is |
|---|---|---|
| Supabase | Database and sign-in | London, UK |
| Vercel | Runs the app | London, UK |
| Resend | Sends sign-in codes and alert emails | Ireland, EU |
| Stripe | Payments | UK and EU, with some processing in the US |
| Anthropic | The optional Claude add-on, only if the firm switches it on | US |
| Cloudflare | Website hosting, website analytics, the sign-in security check and our domain's email forwarding | Global network |
| Google Workspace | Our own email | Google's data centres, including the US |
| Xero | Our accounts | US |
Where data leaves the UK, we rely on UK adequacy regulations or the safeguards UK law requires, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
We may also share data if the law requires it, or with a buyer of the Heathmark business, who would have to protect it in the same way.
How long we keep it
- User accounts: while the person belongs to a firm, then 12 months after.
- Audit trail entries: as long as the firm's records they relate to.
- Billing records: 6 years after the end of the financial year they relate to, as tax law requires.
- Enquiries and sales notes: 2 years after our last contact, unless you become a customer.
- Website security logs: as long as our host keeps them, usually days.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to move it to another provider. Where we rely on legitimate interests, you can object at any time, and we will stop contacting you about Heathmark if you ask. We reply within one month.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Security
Heathmark keeps each firm's records apart in the database itself, uses sign-in codes instead of passwords, requires two-step sign-in for owners, encrypts data in transit and keeps daily backups.
Changes
We will update this notice when what we do changes, and show the date at the top. If a change matters to customers, we will email owners.