Privacy notice

Who we are

Done Virtually ("we", "us") is a practice management and business support service based in Worcester, United Kingdom, operating remotely with clients across the UK. We are the data controller for the personal data described below. For any question about this notice, or to request our registered postal address, contact rachel@donevirtually.co.uk or call 07752 060201.

Two different roles

It matters which hat we are wearing when we handle personal data:

• As a data controller — for the personal data of our own clients and enquirers: your name, practice, contact details and the content of our correspondence.
• As a data processor — for the patient data held in your practice management system. Your practice remains the controller of that data. We act only on your documented instructions under a written data processing agreement.

What we collect and why

• Enquiry details — your name, your practice or business name, your email address, your telephone number where you provide it, and anything you choose to tell us about the support you need. Used solely to respond to your enquiry and, if you become a client, to deliver the service.
• Practice Efficiency Calculator — the figures you enter stay in your browser unless you ask us for a personalised report. If you do request one, we receive your name, practice name, email address, telephone number where provided, the details you entered and the results calculated from them, so that we can send the report and respond to you.
• Client records — correspondence, agreements, time records and invoices, kept to deliver the service and meet our legal and accounting obligations.
• Website usage — see the section on cookies and analytics below.

Lawful basis

We rely on consent for enquiries submitted through the website, contract for work delivered to clients, legal obligation for records we are required to retain, and legitimate interests for ordinary business administration and security.

Cookies and analytics

This website sets no cookies of its own and runs no analytics or advertising scripts, so we do not measure your visit or build a profile of you. Fonts are served from our own domain rather than a third-party font service, so your browsing is not shared with an external provider simply by loading a page.

The one exception is our booking calendar, which is provided by Calendly and embedded on the contact page. Loading that page contacts Calendly, and Calendly may set its own cookies, under their privacy notice. No other page on this site loads third-party content.

If privacy-respecting analytics are introduced, this notice will be updated to say which service is used and what it records before any such measurement begins.

Who we share data with

We do not sell personal data. We share it only with service providers who help us operate — website hosting, email, form handling, time tracking and accounting — each acting under contract and only as needed. Where a provider processes data outside the UK, appropriate safeguards such as the UK International Data Transfer Addendum apply.

How long we keep it

• Unsuccessful enquiries — up to 12 months, then deleted.
• Client records — for the duration of the engagement and then as required for tax and legal purposes, ordinarily six full financial years.
• Client system access — revoked at the end of an engagement and confirmed in writing.

Security

We use access controls, multi-factor authentication and encrypted storage, and we work within your systems under your account permissions wherever possible rather than taking copies of data. We carry professional indemnity insurance and will sign non-disclosure and data processing agreements on request.

Your rights

Under UK GDPR you have the right to access your data, have inaccurate data corrected, request erasure, restrict or object to processing, request portability, and withdraw consent at any time. To exercise any of these, email rachel@donevirtually.co.uk. We respond within one month.

If you are a patient of a practice we support, your rights sit with that practice as the data controller — please contact them directly and they will involve us if needed.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

We may update this notice from time to time. The date at the top shows when it was last revised.