Privacy Policy

LOSIC Booking app — Last updated 21 May 2026

1. Who we are

This Privacy Policy describes how Luton Osteopathic and Sports Injury Clinic Ltd ("LOSIC", "we", "us", or "our") collects, uses, and protects your personal data when you use the LOSIC Booking mobile app (the "App") and visit our website at losic.co.uk.

• Registered address: 577 Dunstable Road, Luton, Bedfordshire, LU4 8QW, United Kingdom.
• Contact email: lutonosteo@gmail.com
• Telephone: +44 1582 575045
• Company number: 04960474 (Companies House, England and Wales)

We are the data controller for the personal data described below. We are registered with the UK Information Commissioner's Office (ICO).

2. What data we collect

2.1 Data you give us. When you book through the App we collect: full name, email address, telephone number, selected treatment, appointment date and time, any free-form notes, and payment details — entered directly into Stripe's hosted checkout. We never see or store your card number.

2.2 Data collected automatically.

• Crash diagnostics (Firebase Crashlytics): stack traces, device model, OS version, app version. Production release builds only. Not linked to your identity. No personal data, no tracking identifiers.
• Network logs: our backend on Vercel keeps short-lived request logs (IP address, request path, timestamp) for up to 7 days to diagnose abuse and errors.

2.3 What we do NOT collect. No advertising or tracking identifiers, no contacts, no camera, microphone, location, or photo access, and no analytics events beyond Crashlytics stack traces.

3. How we use your data and the legal basis

Purpose	Legal basis (UK GDPR)
Processing your booking	Contract (Art 6(1)(b))
Sending your confirmation email	Contract (Art 6(1)(b))
Taking payment via Stripe	Contract (Art 6(1)(b))
Holding clinical notes about your care	Legitimate interests + legal obligation (healthcare record-keeping)
Diagnosing app crashes (Crashlytics)	Legitimate interests (product stability; no personal data)
Rate-limiting and abuse prevention	Legitimate interests

We never sell your data and we never use it for marketing without your explicit opt-in.

4. Who we share data with (our processors)

Processor	Purpose	Data received	Location
Stripe (Stripe Payments Europe Ltd / Stripe Inc)	Payment processing and financial record-keeping	Card details (collected directly by Stripe); plus your full name, email address, telephone number, and any booking notes — passed to Stripe in the checkout session so the receipt and any refund or dispute can be tied to your booking. Retained by Stripe for 6–7 years for legal and financial compliance.	UK / EEA / USA (SCCs)
Cliniko	Clinical and appointment record system	Name, email, telephone, appointment details, booking notes, clinical records.	UK (Amazon AWS eu-west-2)
Resend (Resend.com, Inc.)	Sending transactional emails on behalf of the clinic (booking confirmations and any refund or rebooking notifications)	Your name and email address, included in the message body and (where the email is a clinic-facing alert) in the subject line. Resend processes this only to deliver the message and holds short-lived delivery logs.	EU / USA (SCCs)
Vercel	Hosting the booking backend API	Request metadata (IP, path, timestamp).	EU / USA (SCCs)
Upstash Redis	Short-lived booking-slot lock cache	Slot identifier only — no personal data.	EU
Google Firebase (Crashlytics)	Crash diagnostics	Stack traces, device model, OS version. No personal data.	USA (SCCs)

Each processor is bound by a Data Processing Agreement. Where data leaves the UK we rely on the UK's Adequacy Regulations or Standard Contractual Clauses (SCCs). We do not share your data with anyone else and we do not sell data.

5. How long we keep your data

Data	Retention
Booking contact details	8 years (clinical record-keeping under GOsC / CSP guidelines)
Clinical notes	8 years after your last appointment, or until age 25 if treatment began as a child (NHS standard)
Payment records	7 years (HMRC requirement)
Server request logs (IP, timestamp)	7 days
Crashlytics reports	90 days
Backup copies	Up to 35 days after deletion from the primary system

After the retention period your data is deleted or irreversibly anonymised.

6. Your rights under UK GDPR

• Access your data — request a copy of what we hold.
• Rectify inaccurate data — tell us to correct it.
• Erasure ("right to be forgotten") — request deletion, subject to the retention obligations in §5.
• Restrict or object to certain processing.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent where processing is consent-based.
• Lodge a complaint with the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

To exercise any of these rights, email lutonosteo@gmail.com. We respond within one calendar month.

7. Children

The App is not directed at children under 13. We may hold clinical data for patients under 16 only when a parent or guardian has booked on their behalf or accompanied them. Parents and guardians may exercise the rights in §6 on behalf of a child.

8. Security

• All data in transit to our backend is encrypted with TLS 1.2+.
• Stripe and Cliniko are accessed only over HTTPS using server-side API keys held in Vercel's encrypted environment variables.
• No clinical or payment data is stored on your device beyond the current booking session.
• Our backend has no persistent database — bookings are pushed straight to Cliniko.

9. Cookies and in-app tracking

The App itself does not use cookies. The Stripe Checkout page opened during payment sets its own cookies under stripe.com's privacy policy (stripe.com/privacy).

10. Changes to this policy

We will post the revised version at this URL and update the "Last updated" date. Material changes (new processors, new purposes) will be notified on the home screen of the App at next launch.