Privacy notice

Who we are

Phial is a product of General Practice Software Solutions Ltd, a company registered in England & Wales (company no. 05529960) with its registered office at 11 Upper Woodcote Village, Purley, CR8 3HE. We are registered with the Information Commissioner's Office.

For anything in this notice, including any request about your data, contact hello@phial.health. We have not appointed a data protection officer, as we are not required to; enquiries go to the same address and are handled by a director.

Two different roles

Which rules apply depends on whose data it is, so it is worth separating the two:

The practical difference: if you are a member of staff at a practice that uses Phial and you want your data corrected or removed, ask your own organisation first — they instruct us. We will of course help them do it.

What we hold, and why

Information	Why we have it	Our basis for using it
Staff name, work email address, optional mobile number	Signing in, permissions, and sending the alerts and reminders your organisation has set up	Our contract with your organisation; processed on their instructions
Organisation details (name, contact email)	Running your account and its settings	Our contract with your organisation
Product catalogue, batches, expiry dates, quantities and locations	The stock record itself — this is the service	Our contract with your organisation
Fridge temperature readings, including who recorded each one and when	Your cold-chain compliance log	Our contract with your organisation
Movement history — what was received, used, corrected or disposed of, by whom	The permanent audit trail you show an inspector	Our contract with your organisation
Enquiry emails you send us, and our replies	Answering you, arranging a trial, and keeping a record of what we agreed	Our legitimate interest in responding to enquiries, and steps taken before entering a contract
Aggregate website statistics — pages viewed, referring site, country, browser and device type	Understanding which pages are useful. No cookies, no identifier stored, no profile built	Our legitimate interest in improving the site

That is the complete list. We hold no special category data, no patient or client records, and no payment card details — subscriptions are invoiced.

Who else handles it

We use a small number of established providers, each under a data processing agreement, and none of them may use your data for their own purposes. The current data location for each is listed in the sub-processor table on our trust & security page, which we keep as the single source of truth rather than repeating it here:

Provider	What they do for us
Supabase	Hosts the database and handles sign-in. Your organisation's data lives here, in the European Union (Ireland).
Vercel	Hosts and serves this website and the application. Also provides our cookieless website statistics.
Resend	Delivers our emails — reorder digests, reading reminders and sign-in links.

We do not sell your data, share it for anyone else's marketing, or use it to train machine learning models. We would only disclose it if the law required us to.

Transfers outside the UK

Your organisation's records are held in the European Union (Ireland). The UK government recognises the EEA as providing an adequate level of protection, so data can move between the UK and Ireland without additional safeguards. Where any provider processes data outside the UK or EEA, that is covered by the safeguards in our agreement with them, such as the International Data Transfer Addendum to the standard contractual clauses.

How long we keep it

• Your organisation's account and records — for as long as you subscribe. When you leave, we return or delete your data on request.
• Staff accounts — until your organisation removes the person or closes the account. Movement history keeps the name attached to entries that person made, because an audit trail that could be edited afterwards would be worthless as evidence.
• Enquiry emails — while we are in touch and for a reasonable period afterwards as a record of what was discussed.
• Website statistics — retained only in aggregate, and never tied back to an individual.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you
• correct anything that is wrong or incomplete
• delete it, where we have no continuing reason to keep it
• restrict how we use it, or object to our using it under legitimate interests
• provide it in a portable, machine-readable form

Email hello@phial.health and we will respond within one month. There is no charge. If your data sits inside a customer's Phial account, we will pass the request to that organisation, since it is theirs to decide — see "two different roles" above.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you raised it with us first so we can put it right, and we acknowledge complaints within 30 days.