Privacy policy
- This policy covers our website, the people we do business with, and our marketing and advertising.
- Patient data that clinics handle through iTENTi is covered by each clinic's own privacy notice. We process it for the clinic, never use it for advertising, and never use it to train AI.
- Analytics and advertising only run if you say yes in the cookie banner. You can change your mind at any time from .
- We don't sell your personal data.
- You can ask to see, correct or delete your data by emailing privacy@itenti.com.
1. Who we are
iTENTi is run by Itenti Ltd, a company registered in England and Wales under company number 17377009, with its registered office at 33 Holders Hill Drive, London, NW4 1NL.
For the personal data described in this policy we are the controller, which means we decide how and why it is used.
Contact us about privacy at privacy@itenti.com or by post to the address above.
2. What this policy covers
This policy explains how we handle personal data about:
- people who visit itenti.com;
- people who contact us, ask for a demo, or work at clinics and organisations that are, or might become, our customers;
- people who see or interact with our adverts on other websites and apps;
- suppliers and partners we work with.
3. What we collect
What you give us
- Contact form and emails: your name, clinic or organisation name, work email, and anything you write to us.
- Demos and meetings: your name, job title, work phone number, and notes about your clinic's systems and needs.
- Customers: account users' names, work email addresses, roles and sign-in details, plus billing contacts and invoice details.
- Marketing choices: whether you agreed to receive product news, when, and the wording you agreed to.
Please don't send us any patient information through the website or by email.
What we collect automatically
- Always, to run the site securely: your IP address, browser type, the pages requested and the time, held briefly in server logs by our hosting provider, and your cookie choice.
- Only if you allow analytics: how you use the site (pages viewed, time on page, the website that sent you, approximate location to city level, device type) through Google Analytics.
- Only if you allow advertising: identifiers set by advertising cookies and pixels, advert click IDs (such as gclid, fbclid and li_fat_id), and events such as viewing a page or sending the contact form. See section 5.
What we get from others
- Advertising platforms (Google, Meta, LinkedIn): reports on how our adverts performed. These are usually aggregated. If you fill in a lead form inside one of their platforms, they pass us the details you entered.
- Public and professional sources: names, job titles and work contact details that clinic staff have made public, for example on LinkedIn, their clinic's website or professional online communities, and details of people we already know. We use these to tell clinics about iTENTi (see below).
4. How we use it and our legal basis
UK and EU data protection law (the UK GDPR, the Data Protection Act 2018 and the EU GDPR) require a legal basis for each use of personal data. These are ours:
| What we do | Data used | Legal basis |
|---|---|---|
| Reply to your enquiry and arrange a demo | Contact and enquiry details | Legitimate interests (responding to people who contact us), or steps you ask for before a contract (Art. 6(1)(f) and (b)) |
| Provide the service to customers, manage accounts and billing | Customer contact, account and billing details | Contract (Art. 6(1)(b)) |
| Keep financial and tax records | Billing details | Legal obligation (Art. 6(1)(c)) |
| Send product news by email | Name, email, your marketing choice | Consent (Art. 6(1)(a); UK PECR reg. 22) |
| Measure how the website is used | Analytics data | Consent (Art. 6(1)(a); UK PECR reg. 6) |
| Show you our adverts on other sites, measure whether our adverts work, and build advertising audiences | Advertising identifiers, click IDs, site events | Consent (Art. 6(1)(a); UK PECR reg. 6) |
| Match our customer or subscriber list with an ad platform (custom audiences) | Hashed email address | Consent. We only include people who agreed to marketing. |
| Contact clinic owners and staff about iTENTi (direct outreach) | Name, job title, clinic, work email or professional profile | Legitimate interests (telling clinics about a relevant service). You can object at any time and we will stop. |
| Keep the site and our systems secure, and block spam and abuse | Server logs, form data | Legitimate interests (security) |
| Deal with legal claims and comply with the law | Any relevant data | Legal obligation, or legitimate interests (defending our rights) |
Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can ask us for details of that assessment.
Direct outreach to clinics
We sometimes contact clinic owners and staff we know, or whose work details are public, to tell them about iTENTi. In our first message we say who we are, why we are getting in touch and where to find this policy. If you tell us you don't want to hear from us, we stop straight away and add you to our suppression list so we don't contact you again. We never buy contact lists, and we don't use personal email addresses for outreach without consent.
You don't have to give us your personal data. If you don't give us your name, clinic and email, though, we can't reply to your enquiry.
5. Advertising and measurement
We advertise iTENTi on Google (Search, YouTube and partner sites), Meta (Facebook and Instagram) and LinkedIn. None of this runs unless you choose "Accept all", or switch advertising on under "Choose what to allow". If your browser sends a Global Privacy Control signal, we treat it as a refusal of advertising unless you switch it on yourself.
What happens if you allow advertising
- The Google tag, Meta Pixel and LinkedIn Insight Tag load on our pages and set cookies (listed in our cookie policy).
- They tell those platforms that you visited our site, which pages you viewed, and whether you sent the contact form. We do not send them what you typed into the form.
- We use this to see which adverts lead to enquiries, and to show iTENTi adverts to people who have visited our site ("retargeting") or who are similar to them.
- The platforms may link this information to your account with them and use it under their own privacy policies. For collecting and sending this data, Meta and LinkedIn act as joint controllers with us. We have agreed with them who does what (the Meta Controller Addendum and LinkedIn's joint controller terms), and they handle your rights for the data they hold. Google acts as an independent controller for its own purposes.
What we never do
- Use patient data, or any data from inside the iTENTi service, for advertising.
- Target adverts on the basis of health or other special category data.
- Sell your personal data.
- Make decisions about you with legal or similarly significant effects using automated means alone. Choosing which advert to show is profiling, but it does not have that kind of effect.
How to turn it off
- On this site: . When you switch something off we delete its cookies from our domain.
- On the platforms: Google ad settings, Meta ad preferences, LinkedIn ad settings.
6. Email marketing
We only send product news by email if you ticked the box on our contact form or otherwise told us you want it. Every email has an unsubscribe link, and you can also reply "unsubscribe" or write to privacy@itenti.com. We keep a record of your consent so that we can show you agreed, and after you unsubscribe we keep your email on a suppression list so that we don't contact you again.
7. Who we share it with
We share personal data only with:
- Service providers acting for us (processors), under contracts that require them to protect it and use it only on our instructions:
- website hosting: Vercel Inc. (USA)
- email and calendar: [e.g. Google Workspace / Microsoft 365]
- contact-form delivery and CRM: [provider]
- email marketing: [provider]
- analytics: Google Ireland Ltd (Google Analytics)
- Advertising platforms, only with your consent: Google Ireland Ltd, Meta Platforms Ireland Ltd, LinkedIn Ireland Unlimited Company.
- Professional advisers such as lawyers, accountants and insurers.
- Authorities such as courts, regulators or the police, where the law requires it.
- A buyer or investor, if our business is sold or restructured, under confidentiality terms.
8. International transfers
Some providers, or their parent companies, are in the United States or other countries outside the UK and EEA. When personal data is transferred there, we rely on one of the following:
- UK or EU adequacy regulations, including the EU–US Data Privacy Framework and its UK Extension, where the recipient is certified;
- the EU Standard Contractual Clauses with the UK Addendum, or the UK International Data Transfer Agreement, together with a transfer risk assessment.
You can ask us for a copy of the safeguards that apply.
9. How long we keep it
| Data | How long |
|---|---|
| Enquiries that don't lead to a contract | 24 months after our last contact with you |
| Outreach contacts who don't become customers | 12 months after our last contact with you, or straight away if you ask us to stop (we keep only what we need for the suppression list) |
| Customer account and contract records | For the contract, plus 6 years (the UK limitation period) |
| Invoices and financial records | 6 years from the end of the financial year they relate to (UK tax law) |
| Marketing consent records | While you are subscribed, plus 2 years after you unsubscribe to show the consent was valid |
| Unsubscribe suppression list | For as long as we send marketing email |
| Your cookie choice | 180 days, then we ask again |
| Google Analytics data | 14 months |
| Advertising cookies | The periods listed in our cookie policy |
| Server security logs | No longer than 30 days |
After these periods we delete the data or make it anonymous.
10. Your rights
You have the right to:
- access the personal data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- erase your data in certain cases;
- restrict how we use it in certain cases;
- port data you gave us to another organisation, where we use it on the basis of consent or a contract;
- object to our use of it on the basis of legitimate interests; you can object to direct marketing at any time, and we will always stop;
- withdraw consent at any time, for example through Cookie settings or an unsubscribe link. This doesn't affect what we did before you withdrew.
To use any of these rights, email privacy@itenti.com. It is free. We will reply within one month, or tell you within that month if we need up to two more months because the request is complex. We may ask you to confirm your identity first.
You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. If you are in the EU, you can complain to the data protection authority where you live or work. We would appreciate the chance to put things right first, so please contact us.
11. Security
We protect personal data with encryption in transit and at rest, access limited by role, two-factor sign-in for staff, audit logging, and contracts with every provider that handles it. If a breach puts your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay where the law requires it.
12. Other things you should know
- Children: this website and our service are for businesses. We don't knowingly collect data about children through this website.
- Links: other websites we link to have their own privacy policies. We are not responsible for them.
13. US state privacy rights
If you live in a US state with a consumer privacy law (such as California), you can ask to know, correct or delete your personal information. We don't sell personal information. Allowing advertising cookies may count as "sharing" for cross-context behavioural advertising. You can opt out of that at any time through , and we honour Global Privacy Control signals as an opt-out. We won't treat you differently for using these rights.
14. Changes to this policy
If we make an important change, we will update the date at the top of this page and, where the change affects your consent, ask for your choice again. Earlier versions are available on request.