Legal

Provider terms of service

Version 1.1 · Effective 10 August 2026 · Includes the Data Processing Addendum (Schedule 1)

Changed in 1.1: S4 (sub-processors) — the previous wording promised 30 days’ notice with no exception, which we could not keep if a sub-processor failed or had to be replaced for security. It now separates planned changes (30 days) from urgent ones (as much notice as the circumstances allow, and never later than the change), and Annex C is dated so it can be checked directly. Your right to object and terminate is unchanged.

1. Who we are, and what these terms cover

Bee-booked (“we”, “us”) is operated as a United Kingdom partnership trading as Bee-booked; the partners’ names and service address are available on request at the contact address in section 14. When the business incorporates, we will update this page with the company’s registered details; your agreement will continue with that company on the same terms.

These terms govern your use of Bee-booked as a practice — the booking tools, the practice website, the client records features, and the dashboard (together, “the service”). By creating a practice account or using the service you accept these terms, including the Data Processing Addendum in Schedule 1. These are business terms: you confirm you are using Bee-booked for your business, not as a consumer. Your clients’ use of your booking page is between you and them.

2. The service

Bee-booked gives your practice online booking, a simple practice website, appointment reminders and client management, with optional features you can switch on — such as deposits and card-on-file via Stripe, gift cards, loyalty, and (where enabled for your practice) encrypted consultation forms and treatment notes. We improve the service continuously; features may change, and we will not materially reduce what your plan includes without the notice described in section 12.

3. Your account

• Keep your login details secure. You are responsible for activity under your account, including team members you invite.
• Registration details must be accurate and kept up to date — clients rely on them.
• You must be at least 18 and able to enter contracts for your business.
• We may suspend an account for serious or persistent breach of these terms; we will tell you why and, where the breach is fixable, give you a chance to fix it.

4. Subscriptions and payment

• The subscription price is the price shown when you sign up, billed monthly through Stripe. The price you join on is the price you keep for as long as your subscription stays active.
• Where a free trial or free tier is offered, its scope is as described at signup.
• You can cancel any time from your billing settings. Cancellation takes effect at the end of the paid period; we don’t refund part-months.
• If a payment fails we will retry and email you before restricting the account.
• Optional paid extras (for example a custom domain) are priced separately and shown before you buy them.

5. Payments from your clients

• Client payments (deposits, no-show fees, gift cards and similar) run through your own Stripe account, connected via Stripe Connect. That money flows between you and your clients — Bee-booked does not hold client funds and takes no commission on your bookings.
• Your relationship with Stripe is governed by Stripe’s terms. Refunds to your clients, and your cancellation/no-show policies, are yours to set and honour.
• Card details are handled by Stripe; Bee-booked never stores card numbers.

6. Acceptable use

Don’t use the service to:

• break the law, or infringe anyone’s rights (including uploading content you don’t have rights to);
• publish unlawful, deceptive or harmful content on your practice website;
• attempt to breach the security of the service, other tenants’ data, or rate limits;
• resell or white-label the service without our written agreement.

We may remove content that breaks these rules (uploaded images are also automatically screened) and will tell you when we do, unless the law prevents it.

7. Your content and your clients’ data

• You own your content and your client records. You grant us the licence needed to host and operate them — nothing more. We don’t sell data, and we don’t use your clients’ personal data to train models or for our own marketing.
• For your clients’ personal data, you are the controller and we are your processor. Schedule 1 (the Data Processing Addendum) governs that processing and is part of these terms.
• You are responsible for having a lawful basis for the client data you collect — including, where you enable consultation forms or treatment notes, meeting the UK GDPR conditions for health information. The product captures your clients’ explicit consent with each form submission and keeps a record of the wording and time; which basis is right for your practice remains your decision.
• Health information: your duty of confidentiality. If you enable consultation forms or treatment notes, you confirm that you owe your clients a duty of confidentiality about what they tell you — under a professional body’s code of conduct, a written agreement with your clients, or the common-law duty of confidence. This is not a formality. Health information may be processed under the UK GDPR’s health-and-treatment condition where the processing is carried out by someone who owes such a duty, even if they are not a registered health professional (Data Protection Act 2018, section 11(1)(b)). That duty is what makes your clinical records lawful, and it is yours, not ours — we hold the records for you, we are not a party to your professional relationship with your client. If you cannot confirm this, do not turn these features on.
• Consultation forms and treatment notes are for adult clients (18+). Please don’t use them to record health information about anyone under 18. This is a limit of the product, not of your practice: holding children’s health data brings extra duties — around who can consent, how long records are kept and how they are explained — and Bee-booked has no separate handling for any of it. You can still book a client of any age; it is the clinical records that are 18+. If you treat under-18s, keep those records outside Bee-booked until we tell you otherwise.
• You are responsible for your own regulatory duties as a practice, including registering with the ICO (the data protection fee) where required.

8. Our intellectual property

We own the service, the software and the Bee-booked brand. You get the right to use the service while subscribed; no other rights transfer.

9. Availability

We run the service on reputable cloud infrastructure and aim for it to be available around the clock, but it is provided “as available”: brief maintenance windows and faults happen. If the service is materially unavailable for a sustained period, your remedy is a fair pro-rata credit or the right to cancel — not damages beyond section 10.

10. Liability

• Nothing in these terms excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded.
• Subject to that, neither of us is liable to the other for indirect or consequential loss, or loss of profits, revenue or goodwill.
• Our total liability to you in any 12-month period is capped at the subscription fees you paid us in that period (or £120 if greater).
• You remain responsible to your clients for the services your practice provides. Bee-booked is a booking and records tool, not a party to your client relationships.

11. Term and ending the agreement

• You can stop using the service and cancel at any time (section 4).
• We can end the agreement for serious unremedied breach, or discontinue the service on at least 60 days’ notice with a pro-rata refund of anything prepaid.
• On termination you can export your data beforehand using the built-in tools, and Schedule 1 governs deletion of your clients’ personal data afterwards.

12. Changes to these terms

We may update these terms as the service evolves. For material changes we will email the account owner at least 30 days before they take effect; if you don’t accept a material change, you may cancel before it applies. The current version always lives at this page.

13. General

These terms (with Schedule 1) are the whole agreement between us about the service. They are governed by the law of England and Wales, and the courts of England and Wales have jurisdiction. If any clause is found unenforceable, the rest stand. If something goes wrong, talk to us first — most things are fixable quickly.

14. Contact

hello@bee-booked.com

Schedule 1 — Data Processing Addendum

This Addendum applies whenever we process personal data on your behalf and forms part of the provider terms. “UK GDPR”, “controller”, “processor”, “personal data”, “processing” and “data subject” have the meanings in UK data protection law.

S1. Roles and scope

For your clients’ and team’s personal data handled through the service, you are the controller and Bee-booked is your processor. The subject matter, duration, nature and purpose of processing, and the categories of data and data subjects, are set out in Annex A.

S2. Your instructions

We process personal data only on your documented instructions, which are: these terms, your configuration of the service (services, policies, features you enable, retention settings), and the actions you and your team take in the dashboard. We will tell you if, in our view, an instruction breaches data protection law, and we may suspend that instruction until it is resolved. If the law requires us to process outside your instructions we will tell you first, unless the law prevents it.

S3. Our commitments

• Everyone processing personal data for us is bound by confidentiality obligations.
• We apply the technical and organisational measures in Annex B, and keep them under review as good practice evolves.
• We do not sell personal data, and we process it for no purpose of our own.
• We assist you, taking into account the nature of the processing, with data subject requests, security, breach notification, and data protection impact assessments (S5–S7).
• We maintain records of our processing activities as a processor.

S4. Sub-processors

You give general authorisation for the sub-processors listed in Annex C. That list is the current one, it is published on this page, and it is dated — so you can check it at any time rather than relying on having kept an email.

Before a new or replacement sub-processor starts processing your clients’ personal data, we will update Annex C and email the account owner at the address registered on the account. We will do that at least 30 days beforehand where the change is one we plan. Where we have to replace a sub-processor at short notice — because it fails, stops providing the service, or has to be changed to keep the platform secure — we will give as much notice as the circumstances allow and email you no later than the change itself, explaining what happened and why.

In either case your rights are the same: if you reasonably object on data-protection grounds and we cannot accommodate the objection, you may terminate and we will refund anything prepaid for the unused period. We remain responsible to you for our sub-processors, and impose data protection obligations on them equivalent to this Addendum.

S5. Helping with data subject rights

The service includes self-service tools for the most common requests: your clients can export everything held about them and exercise erasure directly from their account, and your dashboard gives you access to the records you control. Where a request needs more than the tools provide, we will assist within a reasonable time at no charge unless the requests are excessive.

S6. Personal data breaches

If we become aware of a personal data breach affecting your data, we will notify the account owner’s email without undue delay, and give you what we know about the nature of the breach, the data and data subjects affected, the likely consequences and the measures taken — updating you as we learn more. Notifying your clients or the ICO, where required, is your decision as controller; we will help.

S7. International transfers

Personal data at rest is stored in AWS’s London region (eu-west-2). Where a sub-processor listed in Annex C processes limited data outside the UK (for example, email delivery or payment processing), the transfer relies on UK adequacy regulations or that provider’s approved transfer mechanism (IDTA or Addendum to the EU SCCs), as identified in its own data processing terms.

S8. Deletion and return

• During the subscription you can export your data at any time from the dashboard, and your clients from their accounts.
• Records with a retention clock you configure (for example clinical records, which default to 7 years from the appointment) delete automatically when their period ends.
• After termination, we will delete your clients’ personal data within 30 days of your written request, except what the law requires us to keep. Clinical records (consultation forms and treatment notes) also delete automatically at the end of their retention period; other records — bookings, orders, gift cards, loyalty and profiles — are kept until you ask us to delete them, so that you can meet your own record-keeping duties.

S9. Audit

We will answer reasonable written questions about our processing and share summaries of our security measures and our infrastructure providers’ certifications (for example AWS compliance reports). If that genuinely isn’t enough, you may audit once in any 12-month period, on at least 30 days’ notice, during business hours, at your cost, and without access to other practices’ data.

S10. Liability

Liability under this Addendum is subject to the caps and exclusions in section 10 of the provider terms, except where data protection law does not allow them to apply.

Annex A — details of processing

Annex B — security measures

• All data encrypted in transit (TLS). Our primary database — holding every client record, booking, message and clinical entry — is encrypted at rest under a customer-managed key with rotation enabled. (Public marketing images a practice uploads, such as logos and gallery photos, use standard server-side encryption.)
• Clinical records (consultation forms, treatment notes) additionally envelope-encrypted with a dedicated key. Practitioner access through the dashboard is access-logged; the client whose records they are can also view and export their own via their account.
• Client identities pseudonymised at rest: operational records reference a random identifier; names and contact details live only in an encrypted vault.
• Sessions carried in httpOnly cookies (not readable by page scripts); tenant isolation enforced on every request; least-privilege infrastructure roles; secrets held in a managed parameter store, not code or configuration files.
• Automated retention: records with a configured retention period delete themselves when it ends.
• Tested self-service export and erasure tooling for data subjects.

Annex C — sub-processors

Last updated: 10 August 2026

Questions about this document: hello@bee-booked.com