Legal

Privacy policy

Last updated: 29 October 2026

1. Who we are

Praxis Assist ("we", "us", "our") provides virtual medical secretary services to doctors and healthcare practices, and outsourced administration services to businesses, in the United Kingdom.

Praxis Assist is a company registered in India. Because we offer services to people in the UK, we are fully compliant with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

UK representatives: as a business based outside the UK, we have representatives in the UK, as required by Article 27 of the UK GDPR. You can reach them through hello@praxisassist.co.uk.

For any privacy question, email hello@praxisassist.co.uk.

2. Our two roles

When you contact us or become a client: we are the controller

We decide how and why we use the personal data you give us when you fill in our enquiry form, email us, or sign up as a client.

When we work on your patient or business data: we are the processor

When we carry out secretarial or admin work for you, you (the doctor, practice or business) remain the controller of that data. We act only on your documented instructions, under a written data processing agreement that meets Article 28 of the UK GDPR. Patients who want to know how their information is used should read their clinician's own privacy notice.

3. What we collect

From our website enquiry form

• Your name and email address
• The service you're interested in
• Anything you choose to write in your message

When you submit the form, these details are sent by email to hello@praxisassist.co.uk. Please don't include patient or medical details in the form.

To protect the form from spam and abuse, we keep an anonymised, one-way scrambled version of your IP address for up to one hour, so we can limit how many messages can be sent. It cannot be used to identify you and is deleted automatically.

From our clients

• Contact details for you and your team
• Business, billing and invoicing details
• Our emails, call notes and records of the work we do for you

Cookies

Our website uses only cookies that are strictly necessary for it to work. We don't use advertising or tracking cookies. If we add analytics in future, we'll ask for your consent first and update this policy.

4. How we use it, and our lawful basis

• To reply to your enquiry and arrange a call: to take steps at your request before entering a contract, and our legitimate interest in responding to people who contact us.
• To deliver our services: performance of our contract with you.
• To invoice and keep financial records: legal obligation.
• To send occasional news or offers: only with your consent, which you can withdraw at any time.

5. Patient and client data we work on

Medical information is special category data under the UK GDPR, and we treat it with particular care.

• No data is stored with us. We work inside your own systems (for example your practice management software, email and cloud document tools). We don't keep copies of your patient or business data on our own systems.
• You always own your data. We only work on it to carry out the tasks you give us, and never for our own purposes.
• Every team member is bound by strict confidentiality and trained in data protection.
• Access is limited to the people working on your account, and it ends when our work together ends.
• If we ever become aware of a personal data breach affecting your data, we will tell you without undue delay so you can meet your own reporting duties.

6. Who we share data with

We never sell personal data. We share it only:

• with trusted service providers who help us run our business (such as email hosting and accounting software), under contracts that protect your data;
• when you have instructed us to (for example, sending a clinic letter to a GP); or
• when the law requires us to.

7. International transfers

Our team is based in India, which the UK has not yet recognised as providing an adequate level of data protection. Whenever personal data is accessed from or transferred to India, we protect it with the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. You can ask us for a copy of these safeguards.

8. How we keep data secure

• Encrypted devices and secure, access-controlled cloud systems
• Multi-factor authentication on all accounts
• Access only on a need-to-know basis
• Regular data protection training for every team member

9. How long we keep it

• Enquiries that don't lead to work with us: deleted after 12 months.
• Client business and invoicing records: kept for as long as tax and company law requires, then deleted.
• Patient and client data we work on: not stored by us. Our access is removed when our engagement ends.

10. Your rights

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to how we use it;
• receive your data in a portable format; and
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email hello@praxisassist.co.uk. We'll respond within one month. There's no charge in most cases.

If your request is about patient data we work on for a clinician, we'll pass it to them promptly, as they are the controller.

11. Complaints

If you're unhappy with how we've handled your data, please contact us first and we'll do our best to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113.

12. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top.