Privacy policy

Prakta is built and operated by Allied Health Media Ltd (“Allied Health Media”, “we”, “us”), a UK company. Prakta is a practice-management platform for private medical consultants and their teams — scheduling, patient records, results and referrals, letters, invoicing and growth tools in one place.

Questions about this policy or your data can be sent to privacy@alliedhealthmedia.co.uk.

This matters, so we’re upfront about it: for the staff accounts that sign up and log into Prakta (consultants, practice managers, secretaries), Allied Health Media is the data controller — we decide why and how that account data is used, as described in this policy.

For patient data a practice enters into Prakta — names, results, letters, appointments and so on — the practice is the data controller, and Allied Health Media acts as its data processor, handling that data only on the practice’s instructions. That processing relationship is additionally governed by a Data Processing Agreement between Allied Health Media and each practice. If you’re a patient, your treating practice — not Allied Health Media — is who to contact first about your own records; we’ll always help a practice fulfil a patient request made to us directly.

Prakta is in early access. New practices start in a trial state, and real patient records only flow through production use once a practice has actually started using Prakta for their clinic — at which point everything below applies in full. The Google and Microsoft integrations described below, and our use of AI, are real and active regardless of a practice’s trial status the moment that practice chooses to connect them.

Account data (practice staff): name, work email, practice name and role. Used to run the account — signing in, access control within the practice, and essential service communications.

Patient data (entered by a practice, as its processor): name, date of birth, contact details, postcode, funding/insurer information; appointments; clinical results, referrals, treatment plans and letters; invoices and payments; and any marketing enquiries a practice logs. This is the practice’s data — see “The two roles we play” above.

Data from connected accounts — only if a staff member chooses to connect one, from Settings → Connections:

• Google Mail: requested scope is Gmail’s metadata-only permission (gmail.metadata). We can see message subject lines, senders and timestamps to triage enquiries in your inbox — we cannot and do not access message bodies or attachments; Google’s own metadata scope makes that technically impossible.
• Google Calendar: read-only access (calendar.readonly) to show your real schedule inside Prakta. We never create, edit or delete events in your calendar.
• Microsoft Mail: Microsoft Graph has no metadata-only equivalent, so the permission granted (Mail.Read) technically allows message-body access — Prakta deliberately never requests or stores message bodies; we only ever fetch subject, sender, received time and a link back to the message in Outlook.

Access and refresh tokens for any connected account are encrypted at rest (AES-256-GCM) in addition to the database-level access controls described below, and are deleted the moment you disconnect that account.

Prakta uses Anthropic’s Claude for a small number of features — drafting clinical letters, drafting patient messages, and the in-app “Ask Prakta” assistant. We’re deliberately narrow about what reaches it:

• Letter and message drafting sends the patient’s name, date of birth and reference (because you’ve explicitly selected that patient to write to) along with only the key points a clinician actually typed in — never pulled automatically from the wider record, and the AI is instructed to never invent a fact it wasn’t given.
• Ask Prakta only ever receives practice-level aggregates — counts and totals — and your own SOP text, never individual patient names or clinical detail.
• Every AI draft is shown to you for review and edit before it’s ever sent — nothing goes out automatically.

We use a small number of specialist providers to run Prakta, each only processing what’s needed for their specific job, under their own data protection terms:

• Supabase — our database, authentication and file storage provider. All the data described above lives here.
• Anthropic — processes the specific, limited content described in “AI features” above, only when an AI feature is actually used.
• Google / Microsoft — only once a staff member actively connects an account, and only for the scopes described above.
• An email-delivery provider for transactional email we send on a practice’s behalf (invoice reminders, secure links to patient letters/messages, account notifications).
• Vercel — hosts the application itself.

We don’t sell personal data, and we don’t use it for advertising.

• Every table holding practice or patient data enforces row-level security, scoped to the signed-in user’s own practice — one practice’s staff cannot see another’s data.
• Two-factor authentication (TOTP) is available to every account and recommended for anyone handling patient data.
• OAuth tokens for connected Google/Microsoft accounts are encrypted at rest, separately from the database’s own access controls.
• Sensitive actions (exports, access requests, mailbox connections) are recorded in an audit log a practice can review and export.
• Patients can read a letter or secure message sent to them via a one-time link without needing an account — the content only unlocks after they confirm their own date of birth, and the link expires automatically.

Account data is kept for as long as your practice has an active Prakta account. Patient data is kept for as long as the practice instructs — as its processor, we don’t independently decide to delete a practice’s patient records; that request goes through the practice, or directly to us if the practice can’t be reached and the request is clearly from the patient concerned.

Under UK GDPR you have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. If you’re a practice staff member, contact us directly at the email above. If you’re a patient, we’d ask you to start with your treating practice since they’re the controller of your records, but you’re welcome to contact us directly and we’ll help route the request. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) at any time.

We’ll update the date at the top of this page whenever this policy changes, and for material changes we’ll tell practice staff directly inside the product.