Skip to main content
Subscribe

The details

Privacy Policy

How Numa Health collects, uses, stores and protects personal information.

Last updated: 17 August 2026

Privacy and security explained

1. Introduction

KESTRELPULSE LTD ("we", "us", or "our"), a company registered in England and Wales with company number 17232525 and its registered office at 60, Office 1335 Tottenham Court Road, London W1T 2EW, is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, and protect your information when you use our practice management platform.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller

KESTRELPULSE LTD is the data controller for the personal data we collect about you as a user of our platform. For patient data entered by practices, the practice is the data controller and KESTRELPULSE LTD acts as a data processor.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

  • Full name and email address
  • Practice name and contact details
  • Password (stored as a secure hash)

3.2 Technical Data

When you access our platform, we automatically collect:

  • IP address
  • Browser type and version
  • Device information
  • Pages visited and actions taken
  • Date and time of access

3.3 Patient Data (Special Category Data)

Practices enter patient data into the platform, which may include health data constituting special category data under UK GDPR. This data is processed under Article 9(2)(h) (health or social care purposes) and is subject to additional safeguards.

3.4 Communications & Messaging Data

Where a practice enables messaging features, we process communications between the practice and its patients. Depending on the channel, this may include:

  • Mobile / phone numbers and, for WhatsApp, the WhatsApp profile name
  • The content of messages (SMS, WhatsApp, email) sent or received
  • Media attachments sent over WhatsApp (e.g. images or documents)
  • Delivery, read and opt-out (e.g. STOP) status

For these features the practice is the data controller and KESTRELPULSE LTD acts as a data processor. Message content can itself reveal health information and is treated as special category data under the same Article 9(2)(h) basis and safeguards described in section 3.3. WhatsApp messaging is operated through Meta's WhatsApp Business Platform and our messaging provider (see section 8); using WhatsApp is also subject to WhatsApp's own terms and privacy policy.

4. How We Use Your Information

We use your information to:

  • Provide and maintain the Service
  • Process your trial registration and account management
  • Send transactional emails (verification codes, welcome emails, team invitations)
  • Detect and prevent fraud and abuse
  • Comply with legal obligations
  • Improve our Service based on anonymised, aggregated usage patterns
  • Where a practice enables it, send and receive administrative messages with patients (such as appointment confirmations, reminders and replies) over SMS, email and WhatsApp. Patients can opt out of a messaging channel at any time (for example, by replying STOP).

5. Legal Basis for Processing

We process your personal data on the following legal bases:

  • Contractual necessity — to provide the Service as agreed in our Terms of Service.
  • Legitimate interests — to improve our Service, detect fraud, and ensure security.
  • Legal obligations — to comply with applicable laws and regulations.
  • Consent — for optional marketing communications (you may withdraw consent at any time).

6. Data Security

We implement appropriate technical and organisational measures including:

  • Encryption of data in transit (TLS) and at rest
  • Multi-tenant data isolation with row-level security
  • Regular security assessments and penetration testing
  • Access controls and audit trails for all sensitive operations
  • Secure password hashing (bcrypt with appropriate cost factor)
  • Rate limiting and anti-abuse measures on all endpoints

7. Data Retention

We retain your data as follows:

  • Active accounts: Data is retained for the duration of your account.
  • Trial accounts (not converted): Data is retained for 30 days after trial expiry, then securely deleted.
  • Deleted accounts: Data is purged within 30 days of account deletion, except where retention is required by law.
  • Audit logs: Retained for 7 years for compliance purposes.

8. Data Sharing

We do not sell your personal data. We share data only with sub-processors who act on our documented instructions under written data-processing terms. These include:

  • Infrastructure providers — for hosting, database and cloud storage services (primarily within the UK/EEA).
  • Email service providers — for transactional email delivery.
  • Messaging providers — to deliver SMS and WhatsApp messages between practices and patients. Messaging data is handled by Twilio and, for WhatsApp, Meta Platforms (the WhatsApp Business Platform). Depending on the service and routing used, these providers may process data outside the UK/EEA.
  • Law enforcement — where required by law or valid legal process.

A current list of our sub-processors is available on request from privacy@kestrelpulse.co.uk.

9. Your Rights

Under UK GDPR, you have the right to:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — request correction of inaccurate personal data.
  • Erasure — request deletion of your personal data ("right to be forgotten").
  • Data portability — receive your data in a structured, commonly used format.
  • Restriction — request restriction of processing in certain circumstances.
  • Objection — object to processing based on legitimate interests.

To exercise any of these rights, please contact us at privacy@kestrelpulse.co.uk. We will respond within 30 days.

10. Cookies and Product Analytics

We use essential cookies to maintain your session and provide core functionality. We do not use advertising cookies.

With your consent, we use a product-analytics service (PostHog, hosted in the European Union) to understand how the Numa Health applications are used so we can improve them: pages visited, interface interactions, page performance, and — for practice staff only — anonymised session recordings in which all text, typed input, images and data-carrying labels are hidden before anything leaves your browser. Patient names, contact details, NHS numbers, clinical content and secure link tokens are stripped or masked at source and are never sent to the analytics service. Practice staff are identified only by an internal reference, role and practice; patients using the patient portal are never individually identified.

Nothing is collected until you choose "Accept analytics" in the application's consent banner, and you can decline without affecting any functionality. Analytics data is processed in the EU and client IP addresses are discarded on receipt. To withdraw consent or ask questions, contact privacy@kestrelpulse.co.uk.

11. International Transfers

We store and process structured core platform data (account and patient database records) within the United Kingdom. Encrypted files and media are stored in a Cloudflare R2 bucket restricted to the EU jurisdiction, and video consultations are pinned to the configured European processing region (London by default).

Some features rely on providers that may process limited data outside the UK. Our current messaging configuration does not guarantee EEA-only processing: Twilio and, for WhatsApp, Meta Platforms may process messaging data outside the UK/EEA (including in the United States). Where personal data is transferred outside the UK, we rely on the transfer safeguards required by UK GDPR — such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment — and we keep the categories of data transferred to the minimum necessary for the feature.

12. Children

Our Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The date of the last update is shown at the top of this page.

14. Complaints

If you are not satisfied with our handling of your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

15. Contact Us

For any questions about this Privacy Policy, please contact our Data Protection Officer at privacy@kestrelpulse.co.uk.