PRIVACY POLICY

September 2026

PRIVACY POLICY

1. Introduction

This Privacy Policy is provided by Upnovia Ltd (company number 17405061) (trading as Upnovia), ('we', 'our' or 'us') for use of our products and services including our AI-powered patient reactivation platform, website (upnovia.com), and related automation tools (Services).

We take your privacy, and that of your clients very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you and your clients (personal data).

It also explains your rights in relation to personal data and how to contact us or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of personal data is regulated by law, including under the UK General Data Protection Regulation (UK GDPR). Upnovia Ltd is registered with the Information Commissioner's Office (ICO) under registration number ZC229399.

We are the controller of personal data obtained via the Services, meaning we are the organisation legally responsible for deciding how and for what purposes it is used. Where we process patient data on behalf of clinic clients, we act as a data processor on their instructions. This policy covers both our controller activities (website visitors and enquiries) and our processor activities (clinic patient data).

All patients in clinic databases provided to us must be adults (aged 18 or over). We do not knowingly process personal data relating to minors. If you believe personal data of a minor has been provided to us, please contact us immediately.

2. What this policy applies to

This privacy policy relates to your use of the Services only.

The Services may link to or rely on other apps, websites, APIs or services owned and operated by us or by certain trusted third parties to enable us to provide you with Services. These other apps, websites, APIs or services may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to these other apps, websites or services, please consult their privacy policies as appropriate. For more information see the section 'Who we share your personal data with' below.

We share personal data with the following categories of third parties and sub-processors. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (typically EU Standard Contractual Clauses (2021) supplemented by the ICO UK Addendum).

Sub-processors used in processing patient data on behalf of clinic clients (Upnovia as Data Processor):

Sub-Processor	Purpose	Country	Transfer Mechanism
GoHighLevel (GHL)	CRM, funnel pages, lead routing, patient data storage	USA	EU SCCs (2021) + ICO UK Addendum; Data Privacy Framework certified
Twilio	SMS and WhatsApp message delivery	USA	EU SCCs (2021) + ICO UK Addendum; Data Privacy Framework certified
CloseBot	AI agent for 1:1 SMS and WhatsApp patient conversations	USA	EU SCCs (2021) + ICO UK Addendum
Retell	Voice AI - inbound/outbound calls and appointment bookings	USA	EU SCCs (2021) + ICO UK Addendum
Make.com	Workflow automation connecting all tools	USA / EU	EU SCCs (2021) + ICO UK Addendum
WalletPush	Mobile voucher passes (Apple/Android wallets)	UK (servers confirmed UK-based)	No transfer mechanism required for UK-based processing.
myCRMsim	Messaging relay infrastructure. Routes campaign messages from our CRM to a physical SIM card for SMS/WhatsApp delivery. Processes patient phone numbers and message content in transit only; does not store patient data.	Australia	Data processing addendum under discussion with provider.
WhatsApp Business	Patient communication channel (delivery layer)	USA	EU SCCs (2021) + ICO UK Addendum; Meta Data Privacy Framework
Google Sheets	Live sales and response tracker per campaign	USA	EU SCCs (2021) + ICO UK Addendum
Claude (Anthropic)	AI model used for campaign setup and content generation. No identifiable patient data is inputted into Claude prompts.	USA	EU SCCs (2021) + ICO UK Addendum; Anthropic DPA available. Upnovia does not input patient personal data into Claude.

Third-party tools used for Upnovia's own website and business operations (Upnovia as Data Controller):

Sub-Processor / Tool	Purpose	Country	Transfer Mechanism / Notes
Google Analytics	Tracks website conversion events and user behaviour	USA	EU SCCs (2021) + ICO UK Addendum; website visitors only - no patient data
Google Tag Manager	Script management, link-click and booking tracking	USA	EU SCCs (2021) + ICO UK Addendum; website visitors only
CrazyEgg	Heatmapping and session tracking on website	USA	EU SCCs (2021) + ICO UK Addendum; website visitors only
Microsoft Clarity	Analytics and heatmapping on website	USA	EU SCCs (2021) + ICO UK Addendum; website visitors only
Claude (Anthropic)	AI assistance for campaign setup and content generation	USA	Anthropic Privacy Policy; EU SCCs available. Upnovia does not input identifiable patient data into Claude prompts
Typeform	Landing page qualification form (non-personal business data only: revenue, database size)	USA / EU	EU SCCs (2021) + ICO UK Addendum

3. Personal data we collect

The personal data, other than the above that we collect about you depends on the particular activities carried out through the Services. We will collect and use the following personal data about you:

Category of data	In more detail
Identify and account data you input into the Services Registration is mandatory in order to use the Services	Your name and email address Your age and date of birth Your phone number Your residential and postal address Your account details, such as username and password
Data collected when you use specific functions in the Services	Data you store online with us using the Services including your usage history or preferences (while such data may not always be personal data as defined at law in all cases we will assume it is and treat it in accordance with this policy as if it were)
Other data the Services collects automatically when you use it	Your activities on, and use of, the Services which reveal your preferences, interests or manner of use of the Services and the times of use Your device type, IMEI numbers, MAC address of networks, other unique device identification, device operating system, mobile network information, app version number, storage usage, data usage, time zone settings

If you do not provide personal data we ask for where it is required, it may prevent us from providing services and/or the Services to you.

We collect and use this personal data for the purposes described in the section 'How and why we use your personal data' below.

4. SPECIAL CATEGORY PERSONAL DATA OR Sensitive Data

Certain Personal Data we collect is treated as a 'special category' to which additional protections apply under data protection law. This is also known as 'Sensitive Data'. Where we process such Sensitive Data, we will also ensure we are permitted to do so under data protection laws, and any such data will be collected on the basis of your consent, and where you are a clinic providing Sensitive Data of your clients, you warrant that you have permission to share such information with us. Where we act as data processor for clinic clients, patient data (including Sensitive Data) is processed using AI-powered tools, including automated text messaging (via CloseBot), outbound and inbound voice AI calls (via Retell), and workflow automation (via Make.com). This includes AI-generated voice calls made to patients on behalf of the clinic: calls are initiated, managed and responded to by an AI agent without a human operator. These tools process data solely to perform the patient reactivation campaign on the clinic's instructions. No patient data is used to train AI models. Automated processing and your rights: the AI outreach described above constitutes automated processing under the UK GDPR. However, it does not constitute solely automated decision-making that produces legal effects or similarly significant effects on patients within the meaning of Article 22 UK GDPR. The AI communications are marketing communications only; no decisions are made about patients on an automated basis. Patients who receive AI-generated voice calls or messages may opt out at any time by responding "STOP" to any message or by informing the AI agent during a call. The clinic is responsible for honouring all opt-out requests promptly. Upnovia will cease processing that patient's data on receipt of any opt-out notification from the clinic.

Sensitive Data we collect in respect of clinic clients, may include:

1. Aesthetic and dental treatment history (e.g. treatments received, treatment types and dates)

2. Appointment history (dates and types of appointments at the clinic)

3. Patient status within the clinic (active, dormant, treatment preferences)

If you do not provide Personal Data we ask for where it is required, it will prevent us from providing the Services.

We collect and use this Personal Data for the purposes described in the section 'How and why we use your Personal Data' below.

5. How your personal data is collected

We collect Personal Data from you:

1. directly, when you enquire about our services via our website (upnovia.com) or landing page, submit a Typeform qualification form, or correspond with us by email or telephone;

2. indirectly, such as via website analytics tools (Google Analytics, Microsoft Clarity) and heatmapping tools (CrazyEgg) when you visit our website. We also receive patient data from clinic clients (as data processor) in the form of a CSV patient database - this data is used solely to perform the reactivation campaign on behalf of the clinic.

6. How and why we use personal data

Under data protection law, we can only use personal data if we have a proper reason, e.g.:

1. where consent is given

2. to comply with our legal and regulatory obligations

3. for the performance of a contract with you or to take steps at your request before entering into a contract, or

4. for our legitimate interests or those of a third party

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see 'How to contact us' below).

Other than as otherwise set out herein, the table below explains what we use your personal data for and why.

What we use your personal data for	Our reasons
Create and manage your account	For our legitimate interests, i.e. to be as efficient as we can so we can deliver the best service to you. To perform our contract with you or to take steps at your request before entering into a contract
Providing services and/or the functionalities of the Services to you	To perform our contract with you or to take steps at your request before entering into a contract.
Conducting checks to identify you and verify your identity or to help prevent and detect fraud against you or us	To comply with our legal and regulatory obligations For our legitimate interests, ie to minimise fraud that could be damaging for you and/or us
To enforce legal rights or defend or undertake legal proceedings	Depending on the circumstances: to comply with our legal and regulatory obligations in other cases, for our legitimate interests or those of a third party, i.e. to protect our business, interests and rights or those of others
Communications with you not related to marketing, including about changes to our terms or policies or changes to the Services or service or other important notices	Depending on the circumstances: to comply with our legal and regulatory obligations in other cases, for our legitimate interests or those of a third party, i.e., to provide the best service to you
Protect the security of systems and data	To comply with our legal and regulatory obligations we may also use your personal data to ensure the security of systems and data to a standard that goes beyond our legal obligations, and in those cases our reasons are for our legitimate interests or those of a third party, i.e., to protect systems and data and to prevent and detect criminal activity that could be damaging for you and/or us
Operational reasons, such as improving efficiency, training, and quality control or to provide support to you	For our legitimate interests or those of a third party, i.e., to be as efficient as we can so we can deliver the best service to you
Statistical analysis to help us manage our business, e.g., in relation to our performance, customer base, app and functionalities and offerings or other efficiency measures	For our legitimate interests or those of a third party, i.e. to be as efficient as we can so we can deliver the best service to you and improve and develop our app
Updating and enhancing your records	Depending on the circumstances: to perform our contract with you or to take steps at your request before entering into a contract. to comply with our legal and regulatory obligations where neither of the above apply, for our legitimate interests or those of a third party, eg making sure that we can keep in touch with your customers about their accounts and new products or functionalities related to the Services and your services
Marketing your services to existing and former patients of yours	For your legitimate interests, ie to promote your business to existing and former patients
Disclosures and other activities necessary to comply with legal and regulatory obligations that apply to our business	To comply with our legal and regulatory obligations
The audit of our accounts and business	For our legitimate interests, ie to maintain any accreditations so we can demonstrate we operate at the highest standards
To comply with our legal and regulatory obligations	Depending on the circumstances: to perform our contract with you or to take steps at your request before entering into a contract to comply with our legal and regulatory obligations where neither of the above apply, for our legitimate interests or those of a third party, e.g. making sure that we can keep in touch with our customers about their accounts and new products or functionalities related to the Services and our services
To share your personal data with members of our group and third parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency. In such cases information will be anonymised where possible and only shared where necessary	Depending on the circumstances: to comply with our legal and regulatory obligations in other cases, for our legitimate interests or those of a third party, i.e., to protect, realise or grow the value in our business and assets

See 'Who we share your personal data with' for further information on the steps we will take to protect your personal data where we need to share it with others.

7. Marketing

Where we act as data processor for clinic clients, we send marketing communications to patients on behalf of the clinic by text message (SMS and WhatsApp) and voice AI call. These communications promote the clinic's services, including exclusive offers, packages, and appointment reminders, as part of a patient reactivation campaign. The clinic is responsible for ensuring valid patient consent exists for such marketing before providing us with patient data.

We may also send you updates by email about our own services, including promotions or new features. We will ask for your consent before sending you marketing communications about our own services, except where you have explicitly opted-in to receiving email marketing from us in the past or were given the option to opt-out when you initially signed up for your account with us and did not do so.

You will have the right to opt out of receiving marketing communications at any time by:

1. contacting us on: [email protected]

2. using the 'unsubscribe' link included in all marketing emails you may receive from us

We will always treat your personal data with the utmost respect and never sell or share it with other organisations for marketing purposes.

For more information on your right to object at any time to your personal data being used for marketing purposes, see 'Your rights' below.

8. Who we share your personal data with

We routinely share personal data with service providers we use to help us run our business or provide the services or functionalities in the Services, including:

1. third parties we use to help deliver our services to you, eg, third party service providers (such as website developers or payment providers, or providers of security infrastructure)

2. other third parties we use to help us run our business, eg platform hosts and platform analytics providers

3. Third-party AI and automation sub-processors assisting us in delivering the reactivation campaign services, as listed in section 2 above.

We only allow those organisations/individuals/service providers to handle your personal data if we are satisfied they take appropriate measures to protect your personal data, and that of any clinic clients. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you.

We or the third parties mentioned above may occasionally also need to share your personal data with:

1. external auditors, e.g. in relation to the audit of our accounts and our company -the recipient of the information will be bound by confidentiality obligations

4. professional advisors (such as lawyers and other advisors)-the recipient of the information will be bound by confidentiality obligations

5. law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations

6. other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency-usually, information will be anonymised but this may not always be possible, however, the recipient of the information will be bound by confidentiality obligations

If you would like more information about who we share our data with and why, please contact us (see 'How to contact us' below).

We will not share your personal data with any other third party.

9. How long your personal data will be kept

We will keep your personal data for as long as you have an active account with us and for a period of up to 6 years thereafter to comply with any accounting or legal obligations including in the event of the pursuit or defence of legal claims. Once you have closed your account with us, we will move your personal data to a separate database so that only key stakeholders in our business on a 'need to know basis' have access to such data.

Where we process patient data on behalf of a clinic client (as data processor), we will delete all patient personal data from our systems and sub-processors within 30 days of the end of the relevant service agreement, unless the clinic instructs us otherwise in writing.

Following the end of the aforementioned retention period, we will delete or anonymise your personal data.

10. Transferring your personal data out of the UK

We transfer personal data outside of the UK to sub-processors located in the United States and the EU, as set out in the sub-processor tables in section 2 above. We comply with applicable UK data protection laws to ensure the continued protection and privacy of your personal data when making such transfers.

Furthermore, under UK data protection laws, we can only transfer your personal data to a country outside the UK where: the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an 'adequacy regulation') further to Article 45 of the UK GDPR; there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you; or a specific exception applies under relevant data protection law. Accordingly, when we transfer your personal data from the UK to:

• The EEA: we would rely on the adequacy finding granted by the UK to the EU under the Withdrawal Agreement to do so; for any transfers from the EU to the UK, we would rely on the adequacy regulation granted to the UK under the Adequacy Decision.

• Any country located outside the UK/EEA: we would rely on appropriate safeguards under the UK GDPR, such as by including the relevant Standard Contractual Clauses in our data processing agreements

In the event we could not or choose not to continue to rely on either of those mechanisms at any time we would not transfer your personal data outside the UK unless we could do so on the basis of an alternative mechanism or exception provided by UK data protection law.

11. Your rights

You generally have the following rights, which you can usually exercise free of charge. For more information regarding these rights, please visit the ICO website here.

Access to a copy of your personal data	The right to be provided with a copy of your personal data.
Correction (also known as rectification)	The right to require us to correct any mistakes in your personal data.
Erasure (also known as the right to be forgotten)	The right to require us to delete your personal data-in certain situations.
Restriction of use	The right to require us to restrict use of your personal data in certain circumstances, e.g. if you contest the accuracy of the data.
Data portability	The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party-in certain situations.
To object to use	The right to object: at any time to your personal data being used for direct marketing (including profiling) in certain other situations to our continued use of your personal data, e.g. where we use your personal data for our legitimate interests.
Not to be subject to decisions without human involvement	The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you We use AI tools to send automated messages and make calls to patients on behalf of clinic clients as part of reactivation campaigns. These communications do not produce legal effects or similarly significantly affect individuals. No decisions about access to healthcare services are made solely by automated means. A patient may opt out of automated communications at any time by replying STOP or contacting the clinic directly.

For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see 'How to contact us' below). You may also find it helpful to refer to the guidance from the UK's Information Commissioner on your rights under the UK GDPR.

If you would like to exercise any of those rights, please complete a request form-available on our website at https://upnovia.com/ai-saas-agency-contact-us or email [email protected], call or write to us-see below: 'How to contact us'. When contacting us please:

1. provide enough information to identify yourself (e.g., your full name and username) and any additional identity information we may reasonably request from you, and

2. let us know which right(s) you want to exercise and the information to which your request relates

12. Keeping your personal data secure

We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit [www.getsafeonline.org](https://www.getsafeonline.org). Get Safe Online is supported by HM Government and leading businesses.

13. How to complain

Please contact us if you have any queries or concerns about our use of your information (see below 'How to contact us'). We hope we will be able to resolve any issues you may have.

You also have the right to lodge a complaint with the Information Commissioner.

The Information Commissioner can be contacted at https://ico.org.uk/make-a-complaint or telephone: 0303 123 1113. Our ICO registration number is ZC229399.

14. Changes to this privacy policy

We may change this privacy policy from time to time. When we make significant changes we will take steps to inform you, for example via the Services or by other means, such as email.

15. How to contact us

You can contact us by post, email or telephone if you have any questions about this privacy policy or the information we hold about you, to exercise a right under data protection law or to make a complaint.

Our contact details are shown below:

• 66 Paul Street, London, EC2A 4NA

• [email protected]

• +44 7833383864