Privacy policy

1Who we are

Drawn is made by Hizmedia Ltd ("Hizmedia", "we", "us"). For the personal data this policy covers, we are the controller. You can reach us about anything in it at director@hizmedia.com.

2If you're a patient

If you booked a test, or have results, with a clinic that uses Drawn, that clinic is responsible for your data. We process it on their behalf, under a data processing agreement, and only to run their bookings and records.

The clinic's own privacy notice explains how they use your data, and is linked from their booking page. To see, correct or delete your data, contact the clinic. If you contact us, we'll pass your request to them.

3What this policy covers, and what we collect

This policy covers people who work at clinics that use Drawn, people who sign up for it, and visitors to www.bookdrawn.com.

Your account

• Your name, email address and role at your clinic.
• Your password, stored only as a secure hash, and the one-time codes we email you to sign in.
• Your clinic's details, such as its name, address, phone number and the terms you accepted.

Security and use

• Your sign-in sessions, which include your IP address and browser type, and sign-in attempts, so we can spot misuse.
• An audit log of actions on records in Drawn, such as viewing or exporting a record, which shows who did what by ID.
• Server logs kept by our hosting provider, which include IP addresses and the pages requested.

Billing

• Your clinic's plan, billing contact, billing address and any VAT number. Card details go straight to Stripe, our payment provider, and we never see or store them.

Contacting us

• What you tell us when you email us, and our replies.

Our website

• We don't use analytics, advertising or tracking tools. If you try the demo, the changes you make are kept in cookies on your own device, and nothing you enter is sent to us or stored by us.
• If you joined our launch list before Drawn opened, your email address and when you joined.

4Why we use it, and our lawful basis

5Cookies

Drawn uses only cookies that it needs to work. None of them track you, and none are shared with advertisers, so we don't ask for consent.

6Who we share it with

We don't sell personal data. We share it only with:

• the companies that help us run Drawn, such as our hosting, database, email and payment providers, listed on our sub-processors page. They may use it only to provide their service to us;
• professional advisers, such as accountants and lawyers, under a duty of confidentiality;
• authorities, courts or regulators, where the law requires it;
• a buyer of Drawn or of Hizmedia, if that ever happens, who would have to protect it as this policy does.

7Where your data is

Drawn runs in London, its database is in London, files are stored in Sweden and emails are sent from Ireland. Some of our providers are US companies, or may handle data in the United States, such as our hosting and payment providers. For those transfers we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the UK's International Data Transfer Addendum to the EU standard contractual clauses.

8How long we keep it

• Your account and your clinic's records: while your clinic uses Drawn. They're deleted 30 days after its subscription or trial ends, or straight away if it closes its account.
• Invoices and payment records: 6 years, as tax law requires.
• Sign-in sessions and codes: until they expire, then deleted the following night.
• The audit log: 24 months.
• Emails with us: as long as we need them to help you, and no more than 2 years after your clinic stops using Drawn.
• The launch list: until we've told you Drawn is open, then deleted.

9How we protect it

Connections to Drawn are encrypted, data is encrypted at rest by our providers, staff sign-in needs a password and a one-time code every time, and each clinic's data is kept apart from every other clinic's by the database itself. Our data processing agreement describes our security measures in full.

10Your rights

Under the UK GDPR you have the right to:

• get a copy of your personal data;
• have it corrected if it's wrong;
• have it deleted, where we no longer have a good reason to keep it;
• restrict how we use it, or object to our using it on the basis of legitimate interests;
• receive it in a machine-readable format, and have it sent to someone else;
• withdraw your consent, where we rely on consent.

Many of these you can do yourself in Settings > Your account, where you can change your name, email address and password, or delete your login. For anything else, email director@hizmedia.com. We'll reply within one month, and won't charge you.

11Complaints

If you're unhappy with how we've handled your data, please tell us first at director@hizmedia.com, so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

12Changes to this policy

We'll update this policy when the way we handle personal data changes. The date and version at the top show the latest. If a change matters to you, we'll email your clinic's admins before it takes effect.