Data Processing

Last updated: September 2026

When Kept processes personal information on behalf of a practice, the practice remains responsible for that information and Kept processes it only to provide the agreed service.

This page is a plain-language summary. Where a signed Data Processing Agreement applies, the signed DPA controls if there is any difference.

Roles

The practice is the controller of personal information it provides to Kept.

Kept acts as the processor where it processes that information on the practice’s behalf.

This may include information such as caller names, telephone numbers, reasons for contact, call records, booking information and other information needed to provide the agreed service.

Patient lists and other sensitive information are only processed where specifically agreed and appropriate safeguards are in place.

Business Associate Agreement

Where the service involves protected health information and a business-associate relationship is required, Kept will enter into a Business Associate Agreement before that processing begins.

Kept’s standard workflows are designed to minimise the collection of health information.

Protected health information should not be provided through the public Kept website, audit form or other channels unless the appropriate agreement is already in place.

What we process

Kept processes personal information only as needed to provide the services agreed with your practice.

Depending on your service, this may include:

• Answering calls
• Responding to enquiries
• Handling missed-call responses
• Appointment booking
• Callback requests
• Appointment reminders and no-show recovery
• Patient reactivation
• Review requests
• Reporting and service administration

We do not use customer data for our own unrelated purposes.

Instructions

Kept processes information according to the instructions agreed with the practice.

If we believe an instruction may conflict with applicable law, we will raise the issue with the practice before proceeding where appropriate.

Confidentiality

People who have access to customer data are required to keep it confidential.

Access is limited to what is reasonably required to provide and support the service.

Security

Kept applies reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or disclosure.

The specific safeguards used depend on the service, the information being processed and the systems involved.

Where third-party providers are used to provide the service, those providers may also process information on Kept’s behalf.

Sub-processors

Kept may use third-party providers for services such as:

• Telecommunications and messaging
• Voice and conversational services
• Scheduling and booking
• Hosting and infrastructure
• Email and operational communications

The applicable providers and processing arrangements may be identified in the signed DPA or related documentation.

We will provide information about material changes to sub-processors where required by the applicable agreement or law.

Patient privacy requests

Where Kept processes information on behalf of a practice, the practice remains responsible for responding to requests from its patients and other individuals exercising applicable privacy rights.

Kept will provide reasonable assistance where that information is held within Kept’s systems and the assistance is required under the applicable agreement or law.

Security incidents

If Kept becomes aware of a confirmed security incident affecting personal information processed on behalf of a practice, we will notify the practice without undue delay where required by the applicable agreement or law.

Where appropriate, we will provide information about the incident and the measures taken to investigate, contain and address it.

Returning and deleting data

When the service ends, Kept will return or delete personal information processed on behalf of the practice as required by the signed agreement and applicable law.

Information may remain temporarily in backups or where retention is required for legal, security or operational reasons. Where retained, it will remain subject to applicable protections.

Practice-specific wording, reports and exports remain available to the practice subject to the terms of the agreement.

Audits

Kept can provide reasonable information about its security and data-processing practices where required under the applicable agreement.

Any more extensive security review or audit will be handled according to the terms of the signed agreement.

International processing

Kept and its service providers may process information in countries where the relevant providers operate.

Where personal information is transferred internationally, Kept will use the safeguards required by applicable law and the signed agreement.

Precedence

This page is a plain-language summary.

Where a signed Data Processing Agreement applies, that agreement governs the processing relationship and takes precedence over this page.

Contact

Questions about data processing can be sent to:

hello@keptpractice.com