Privacy policy

Who we are

Ruu Choice Ltd, registered in England and Wales, company number 17190774. Registered with the Information Commissioner’s Office under registration number ZB000000. Contact us about privacy at privacy@ruuchoice.com.

What we collect

• Account data: your name, email address, phone number and postcode.
• Booking data: the provider and service you booked, your preferred date and time, your booking reference, and any notes you choose to add.
• Payment data: the amount, status and reference of payments you make. Card details are collected and stored by Stripe, not by us – we never see or hold your full card number.
• Reviews you submit, and any response the provider publishes.
• Technical data: IP address, device and browser information, and server logs, used to keep the service secure and working.

Please do not put clinical details in the free-text notes field. Ruu Choice is a booking service – anything you need your clinician to know is best given to them directly at your appointment.

Health data

The fact that you booked a particular service can imply something about your health, so we treat booking data as special category data under Article 9 UK GDPR. We rely on your explicit consent, given when you make the booking, and we share it only with the provider you chose so they can deliver your appointment.

Why we use it, and our lawful basis

• To provide the service – creating your account, taking your booking, taking payment, and passing your details to your chosen provider. Basis: performance of a contract.
• To verify providers and keep patients safe – checking regulator registrations, moderating reviews, investigating disputes and preventing fraud. Basis: legitimate interests.
• To meet legal duties – accounting records, tax, and responding to lawful requests. Basis: legal obligation.
• To send marketing – only if you opt in, and you can withdraw at any time. Basis: consent.

Who we share it with

• The provider you book with – your name, contact details, chosen service and preferences. They are a separate data controller once they receive it.
• Stripe – payment processing, fraud prevention and payouts.
• Supabase – database and authentication hosting (UK/EU region).
• Resend – sending transactional email such as booking confirmations and receipts.
• Render – application hosting.

We never sell your personal data. Where a supplier processes data outside the UK, that transfer is covered by the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

• Account data – while your account is open, then 12 months.
• Booking and payment records – 7 years, to meet accounting and tax requirements.
• Reviews – until you ask us to remove them, or the listing is removed.
• Server logs – 90 days.

Your rights

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or transfer it to another service. You can object to processing based on legitimate interests, and withdraw consent at any time. Email privacy@ruuchoice.com and we will respond within one month.

If you are unhappy with our response you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.

Cookies

See our cookie policy for what we store on your device and how to change your choices.