Legal
Privacy notice
Last updated 28 July 2026
Two quite different things happen under the Bee-booked name, and the law treats them differently. This notice covers both. Start with whichever one is you.
I'm booking an appointment
Your details belong to the practice you book with. We only hold them on their behalf. Part 1 →
I'm looking at Bee-booked
Waitlist, guides, contact form. Here we are responsible for your details ourselves. Part 2 →
Part 1 — Booking an appointment with a practice
Who is responsible for your information
The practitioner or practice you book with. They decide what is collected and why, so in data-protection terms they are the controller. Bee-booked provides the booking software and holds the information on their instructions — we are their processor. We do not decide what happens to your details, we do not use them for our own purposes, and we never sell them.
So for anything about your own data — a copy of it, a correction, deletion — ask your practice. Their contact details are on their profile page and on your booking confirmation. If you cannot reach them, email hello@bee-booked.com and we will pass it on.
What is collected
- Your name and contact details — email address, and a phone number if you give one.
- Your bookings — the services and add-ons you choose, dates and times, and your history with that practice.
- Payment details — card details go straight to Stripe and are stored by Stripe. Neither your practice nor Bee-booked ever sees or stores your full card number.
- Consent records — whether you agreed to marketing emails, and whether you consented to give health information on a consultation form. We record when it was given and how, so that you and your practice can both check it later.
- Consultation answers — this depends on which kind of form your practice uses:
- A Bee-booked consultation form — your answers are held here, on your practice's behalf. Because they can include health information they are encrypted, stored under a reference rather than your name, kept only as long as your practice's retention setting allows, and every time they are opened it is logged.
- An outside form (Google Forms, for example) — your answers go to that provider and their privacy policy applies. Bee-booked records only that a form was submitted.
- Treatment notes — if your practitioner keeps clinical notes about your appointments, those are held here on their behalf. They are health information, so they are encrypted, access to them is logged, and they are deleted in line with your practice's retention setting.
Why, and the lawful basis
| What for | Lawful basis |
|---|---|
| Managing your booking — confirming, reminding, rescheduling, cancelling | Contract |
| Taking payment, holding a card on file, and charging a late-cancellation or no-show fee under the practice's stated policy | Contract / legitimate interests |
| Marketing emails from your practice | Consent — only if you opted in, and you can withdraw at any time |
| Health information on a consultation form, for your treatment | Explicit consent (UK GDPR Article 9) |
Who it is shared with
- Your practitioner — who provides your treatment.
- Stripe — payment processing and card storage.
- Amazon Web Services — hosting and database, London region (eu-west-2).
- Resend — sending your confirmation and reminder emails.
That is the whole list. Your details are not sold, and not shared for anyone else's marketing.
How long it is kept
Booking and client records are kept for as long as your practice needs them to provide the service and to meet legal, accounting and tax obligations, then deleted or anonymised. Consultation forms and treatment notes are deleted according to the retention period your practice sets. Marketing consent is kept until you withdraw it — and the record of the withdrawal is kept too, so that honouring it can be proved.
Your rights
You can ask for a copy of what is held about you, to have it corrected or deleted, to restrict or object to how it is used, to have it transferred, and to withdraw consent at any time. You can do some of this yourself in your account, including downloading your data. Otherwise ask your practice — they are the controller.
If you are unhappy with how it has been handled, you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies on the booking pages
The booking site uses only what it needs to work — chiefly keeping you signed in to your account. There are no advertising or tracking cookies. A practice's own website may offer analytics; if it does, that loads only after you accept it on their cookie banner.
Part 2 — Using bee-booked.com
This part covers this website — where you can join the waitlist, read the guides and send us a message. It is short because we collect little here, and here we are the controller.
Who we are
Bee-booked is operated by a UK partnership. For anything about this part of the notice, or to exercise any of the rights below, email hello@bee-booked.com — and we will give you our full registered details on request.
What we collect, and why
| What | Why | Our lawful basis |
|---|---|---|
| Waitlist signup — your email, and optionally your practice name and the booking tool you use now | To tell you when we open to new practices, and to understand who is asking | Consent — you asked us to get in touch |
| Contact message — your name, email and what you wrote | To reply to you | Legitimate interests — answering someone who contacted us |
That is the whole list. This site runs no analytics and no tracking — no Google Analytics, no tag manager, no advertising pixels. We do not know who you are unless you tell us. We do not buy contact lists, we do not sell or share your details for anyone else's marketing, and there is no automated decision-making here.
Cookies and other sites
We set no cookies on this site — which is why you have not been asked about any — and nothing on the page is fetched from anyone else: the fonts, images and code all come from us, so no other company sees that you visited. (Until 17 August 2026 the fonts came from Google, which meant Google saw your IP address; we now serve them ourselves.)
Some pages link to other websites. Once you follow a link you are on their site and their privacy notice applies, not ours.
How long we keep it
- Waitlist: until we launch and contact you, or until you ask us to remove you — whichever comes first. We should be straight with you: these entries do not expire on their own, so if you want to be taken off, email us and we will delete it.
- Contact messages: kept while we are dealing with your enquiry and for a reasonable period afterwards, then deleted.
Your rights
You can ask us for a copy of what we hold about you, to correct it, to delete it, or to stop using it — and where we rely on your consent, you can withdraw it at any time. Email hello@bee-booked.com and we will action it within a month. There is no charge. If you are not happy with how we have handled it you can complain to the ICO at ico.org.uk, though we would rather you told us first so we can put it right.
Applies to both
Where your information is held
On Amazon Web Services in London (eu-west-2), encrypted at rest. Email is sent through Resend and payments are handled by Stripe. All are suppliers acting on instructions, and data stays in the UK or the EEA.
Changes
If we change this notice we will update the date at the top. If the change is significant and we hold your email, we will tell you.
See also our provider terms and data processing agreement — the contract between Bee-booked and a practice.