Privacy Policy

This policy explains what Halo Desk does with personal information — yours,
if you contact us or become a client, and patients’ information, which we handle on behalf of
the practices we work for.

Who we are

Halo Desk Ltd, registered in England & Wales, company number 17220887, at 25 Patcham Terrace,
London SW8 4EX. We provide medical secretarial and personal-assistant services to private
healthcare practices.

The two roles we act in

This distinction matters, because different rules apply to each.

• As a data controller — for information about you when you enquire through
  this website, speak to us about our services, or become a client. We decide what to collect and
  why.
• As a data processor — for patient information. When a consultant or
  practice engages us, they remain the data controller for their patients’ information. We act
  only on their documented instructions, under a written contract that meets Article 28 of the UK
  GDPR. We do not decide what happens to patient data, and we do not use it for our own purposes.

Information we collect

When you enquire or book a call: your name, email address, telephone number,
the practice you work in, and whatever you choose to tell us in your message. If you book a
discovery call, that form is hosted by our booking provider and may also collect an address.

When you become a client: contact and billing details for you and your practice,
and the records needed to run the service we have agreed.

Patient information, as a processor: depending on the service, this may include
patient names and contact details, appointment and clinic details, correspondence, clinical notes
dictated or scribed by the consultant, test results, and billing and insurance information. Health
information is special category data and is treated accordingly.

Why we are allowed to hold it

• Legitimate interests — responding to your enquiry and running our
  business, where that does not override your rights.
• Contract — providing the service you have engaged us for.
• Legal obligation — accounting, tax and record-keeping duties.
• For patient data — the lawful basis is the practice’s, not ours. We
  process it only under their instructions. For health data this is ordinarily Article 9(2)(h) of the
  UK GDPR, the provision of health care and management of health-care systems.

How we protect it

Halo Desk Ltd has completed the NHS Data Security and Protection Toolkit
self-assessment for 2025-26 and is published as Standards Met (organisation code
I6E5R, published 9 August 2026, valid to 30 June 2027). This can be checked on the public register
at dsptoolkit.nhs.uk.

Everyone working on your desk is healthcare-trained, works to confidentiality obligations
written into their contract, and has access only to what their work requires.

Who we share it with

We do not sell personal information and we do not share it for marketing. We share it only
with: the practice whose patients’ data we are handling; HighLevel (LeadConnector), who provide our booking form; our website and email providers; service providers who host our
systems, our booking form and our email, under contracts that require them to protect it; our
professional advisers; and anyone we are required to disclose to by law.

Where it is held and transfers outside the UK

Our booking form is provided by HighLevel (LeadConnector), a US company, so
information you enter there is processed outside the UK. The transfer mechanism and our contract
terms with them are being confirmed and this section will state them precisely; we have not
described hosting arrangements we have not verified.

How long we keep it

Enquiries that do not become clients: up to 12 months. Client records: for the life of the
contract and then as long as our legal and accounting duties require. Patient information: for the
period set in our contract with the practice, and returned or securely destroyed at the end of the
engagement as they instruct.

Your rights

You have the right to ask for a copy of the information we hold about you, to have it corrected
or erased, to object to or restrict how we use it, and to ask for it in a portable form. If your
request concerns patient information, the practice is the controller — please contact
them, and we will support them in answering you.

Write to us at Robbie@halo-desk.com. You can also complain to the Information
Commissioner’s Office at ico.org.uk, though
we would rather you came to us first.

Cookies and similar technologies

The site itself uses only what is needed to make it work. Our booking page embeds a form from
HighLevel (LeadConnector), a third party, which may set its own cookies or use
browser storage. We are testing exactly what it loads; until that is complete and any non-essential
technologies are blocked until you consent, we do not claim this site is free of third-party
tracking.

Changes

If we change this policy we will update the date below. Last updated: 11 August 2026.