Privacy notice

Wellkit is run by Matt West, trading as Wellkit through West Media Limited (company number 15405002, VAT number GB511032558, registered office 29 Prospect Road, Southborough, Tunbridge Wells, England, TN4 0EN). In this notice "I" means Matt West acting for West Media Limited. My registration number with the Information Commissioner's Office is ZC079857.

Who is responsible depends on who you are.

If you sign in to Wellkit

You are a client of mine, or a member of a client's staff. For the details of your own account (your name, your email address, your sign-ins and what you do in the app) West Media Limited is the controller: I decide how that data is used and I am responsible for it.

If you are a customer of a business that uses Wellkit

The business you dealt with is the controller of your data. It decides what to collect about you, why, and how long to keep it, and its own privacy notice applies. West Media Limited is its processor: I hold and handle the data on that business's instructions, to provide the CRM to it, and for no purpose of my own.

You can send a request about your data to the business or to me. If it comes to me, I pass it to the business and help it reply.

About people who sign in

• Your name and email address, and a profile picture if your sign-in method supplies one.
• Which client accounts you can open and what your role allows you to do in each.
• Records of your sign-ins, including the device, browser and IP address, kept by the sign-in service.
• An audit log of significant actions, such as deleting records, exporting contacts or changing who has access.
• Anything you send me through the app, such as a feature request.

About a client's customers

What a client keeps in its account is up to that client. The CRM is built to hold:

• Contact details: name, email address, phone number, address, company, and the tags, notes and extra fields the client adds.
• Bookings: the service, the staff member, the time, the status, and whether a deposit was paid.
• Messages: the emails and texts exchanged with the business through the CRM, and whether each was delivered.
• Calls: when you ring a business number that the business has set up here, the number you rang from, the time, how long the call lasted and whether it was answered or missed. Calls are never recorded, and nothing said on them is kept.
• Enquiries and leads: the answers given on a form, a website enquiry or a Facebook lead form, and where the lead came from.
• Sales records: the opportunities, tasks and notes the business keeps about its dealings with you.
• Invoices and payments: what was billed, what was paid and when. Card details are never held in the CRM.
• Reviews: reviews of the business, the business's replies, and whether you were asked for a review.
• Marketing choices: whether you have unsubscribed from the business's emails.

About visitors to public pages

The booking, form, invoice and unsubscribe pages, and the pages you are reading now, can be opened without an account. They collect only what you type into them, with the additions described here. When you accept or decline an estimate, the time, the email address the estimate was sent to, and the IP address and browser type your browser reports are recorded with your answer, so the business has a record of what was agreed. When you sign a form by typing your name and ticking a box, the name you typed, the time, the wording beside the box, a fingerprint of the form as it was shown to you, and the browser type your browser reports are kept with your answer; the browser type is kept as reported and is not verified, and your IP address is not recorded. If a business emails you a link to a form, the link names you alone, and the address it was sent to is noted when you sign through it. When you attach a file to a form, it is checked for its type and size, kept privately for that business, and opened only by people the business has allowed, through a link that works for 5 minutes. A file can be up to 8 MB. When you pay through a payment link, your name, email address, phone number and any delivery address you give are kept with the order so the business can fulfil it; your card details go to Stripe and never reach Wellkit. The hosting provider keeps technical logs of requests, which include IP addresses. There is no analytics or advertising tracking on any page.

Telling people from automated programs

To stop automated programs filling a business's diary or sending it junk, the booking pages, forms, payment link pages, estimates and the chat window can run a check from Cloudflare called Turnstile before anything is sent. When it is switched on, your browser loads a script from Cloudflare (challenges.cloudflare.com), which runs in a small frame on the page. Most people see nothing; a few are asked to tick a box. Cloudflare receives your IP address, technical details of your browser and connection, and the address of the page the check ran on. It is not sent anything you type into the page. Cloudflare answers only whether the visitor looks like a person. I keep a note that a check was passed, with nothing about you in it, for no more than two hours. Cloudflare also uses what it receives to improve its own detection of automated programs, under its Turnstile privacy addendum. I rely on my legitimate interest, and my clients', in keeping these pages free of abuse.

Reports of errors in the app

If a page of Wellkit hits a script error in your browser, the page sends one short note to my own server, and to no one else: whether it was an error or an unhandled promise, and the browser's error message with web addresses, query strings, email addresses and long numbers taken out. It does not send the address of the page, what you typed, who you are, your browser details or a stack trace, and it stores and reads nothing on your device to do it. A note is added to a count the agency sees, no more than twenty are kept an hour for the whole service, and a count is cleared after sixty days. I rely on my legitimate interest in knowing that the service is broken.

About the chat button on a client's website

A client can put a chat button from Wellkit on its own website. It is not a live chat. If you send a message through it, I store the name, email address, phone number and message you give, for that business, so that it can reply to you later by email, phone or text. The button loads one small script from Wellkit, sets no cookies, keeps nothing in your browser and does not track you. When you open the chat, its window may also run the Cloudflare check described above. Nothing is recorded unless you send a message, and I do not record which page you were on, only which website the message came from. Sending a message is not agreement to marketing.

Where West Media Limited is the controller (people who sign in)

• To give you access to the right accounts and keep them secure. Lawful basis: performance of my contract with the client, and my legitimate interest in keeping the service secure.
• To keep an audit log, so that a client and I can see who did what. Lawful basis: legitimate interest in security and accountability.
• To tell you about changes to the service and answer your requests. Lawful basis: performance of the contract, and legitimate interest in supporting clients.
• To keep business and tax records. Lawful basis: legal obligation.

Where the client is the controller (its customers)

The client decides the purposes and the lawful basis, and must tell its customers about them in its own privacy notice. A client typically uses the CRM to take and manage bookings, answer enquiries, send confirmations and reminders, issue invoices, and send marketing to people who have agreed to it. I process that data only to provide the CRM to that client and on its instructions.

I do not use anyone's personal data for advertising of my own and I do not sell it. No decision with a legal or similarly significant effect is made about anyone by automated means.

A client can connect a Google account to Wellkit. The app asks Google only for the access each feature needs, the person connecting sees Google's own consent screen first, and nothing is read until they agree.

What is accessed

How it is used

• Reviews are shown to the business inside its own account so it can read and reply to them. A reply is sent to Google only when a person at the business writes and sends it.
• If a business chooses to show reviews on its own website, the review widget displays reviews from its Business Profile: the reviewer's name as it appears on Google, their star rating, the words of the review, its date and any reply from the business, with Google's own rating and review count. These are already public on Google. Unless the business sets it otherwise, the widget shows the business's reviews automatically, newest first, including new ones as they arrive; the business can set a lowest star rating, leave out reviews with no words and hide single reviews. A business can instead choose each review itself, confirming that its writer has agreed. A review edited or deleted on Google is changed or removed on the website at the next sync. If a review of yours is shown on a business's website and you want it taken off, ask the business or use the data deletion page.
• Posts are published to the business's Business Profile only when the business writes and schedules them.
• Phone numbers on a Business Profile are changed only when a person at the business, or I at its request, choose the new numbers and confirm them on a screen that shows the old and the new side by side. Only the phone numbers are sent to Google.
• Search, website and advertising figures are shown on the client's own Marketing screen, to the people the client has given access to its account. They are totals only. No personal data from Search Console, Analytics or Google Ads is stored, none of it is added to a customer's record, and I do not ask Google for anything about an individual visitor, or for search terms, keywords, devices or audiences. For a client who asks, I also read the advertising performance figures of its Meta (Facebook and Instagram) ad account in the same way: for each day and each campaign, the amount spent, clicks, impressions and the number of leads, through the Facebook connection the client has made. Nothing about the people who saw or answered an advert, and nothing from a lead form, is read for this. The figures are read only: nothing in a Google Ads or Meta advertising account is created, changed, paused or paid for through the platform.
• Busy times from a calendar stop customers booking a staff member when they are not free. Events on the person's own calendar are read only as busy times. They are never copied into a customer's record.
• Appointments made in the CRM are written to the calendar the staff member picks. The event shows the time of the appointment, the service and the customer's first name, or only the word "Appointment" if the staff member chooses to keep details private. No contact details, prices or notes are written to the calendar.
• Sign-in details identify you and match you to the accounts you were invited to.

How it is stored

• The access and refresh tokens Google issues are kept on the server so the connection keeps working. They are never shown in the app.
• A copy of the business's reviews (the reviewer's display name, star rating, comment, date and any reply) is kept in its account and read again from Google several times a day while the connection is working. No copy is kept for more than 30 days without being read from Google again: a daily clean-up deletes any that has gone 29 days. Every copy is deleted at once when the business removes the Google connection. The rating and review count shown for Google are Google's own figures for the location, kept and deleted on the same terms: nothing is worked out from the copies. Reviews the business types in itself are not Google data and stay until the business deletes them.
• For each review a business chooses for its website or hides from it, I keep Google's identifier for that review and, for a chosen one, the time the business confirmed the reviewer's agreement, so the choice survives a copy being deleted and read again. The review itself is kept only as described above. Where a business switches on a summary of its reviews, the summary is kept with the date it was written and shown beside the reviews it was written from. If the reviews shown then change, it stays on show marked with its date until a new one is written, and is taken down at once when none of the reviews it was written from is still shown. It is deleted when the business switches it off, when the Google connection is removed, when no copy is left of the reviews it was written from, and in any case before it is 30 days old; where the widget is still in use a new one is written first.
• Busy times are kept as a start and an end. Event titles are kept only where the staff member has switched that on.
• The Search Console, Analytics, Google Ads and Meta advertising totals above are the client's own website and advertising data and are kept as daily figures for as long as the client uses the feature, in the currency of the advertising account they came from and never converted. They are deleted when the client asks me to unlink the property or advertising account, or the account is closed. The phone numbers on a Business Profile are read when the screen is opened and are not stored; the only record kept is a line in the account's audit log saying that numbers were updated.
• All of it sits in the same database as the rest of the client's account, in Europe (Ireland).

How it is shared

Google user data is not sold, and is not transferred to anyone except the providers listed under who else handles the data, who host the app and its database so that these features can work. It is seen by the client's own staff in their account. I look at a client's account only to set it up or support it, with that client's agreement, or where needed for security or to comply with the law.

Limited use

Wellkit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• Google user data is used only to provide and improve the features described here, which are visible in the app.
• It is not used for advertising of any kind, including retargeting, personalised or interest-based advertising.
• It is not transferred or sold to advertising platforms, data brokers or information resellers.
• It is not used to develop, improve or train generalised artificial intelligence or machine learning models.
• It is not used to assess creditworthiness or for lending.

Removing access

A client can remove a connection at any time under Settings, Connections (or Settings, Calendars for a staff calendar). Removing it deletes the stored tokens. You can also remove Wellkit's access from your Google Account at myaccount.google.com/connections. To have data that was already copied deleted, see the data deletion page.

A staff member can connect an Outlook or Microsoft 365 calendar instead of, or as well as, a Google one. It works the same way and the same rules apply.

• What is requested: permission to read and write calendar events (Calendars.ReadWrite) and to keep the connection working without signing in again (offline_access).
• What is read: the names of the person's calendars, and when the events on the calendars they choose start and end. Those events are read only as busy times and are never copied into a customer's record. Titles are kept only if the staff member switches that on, and are shown only to them.
• What is written: each appointment, with its time, the service and the customer's first name, or only the word "Appointment" if the staff member chooses to keep details private.
• The tokens Microsoft issues are kept on the server and never shown in the app. Microsoft calendar data is not sold, not used for advertising and not used to train artificial intelligence models.
• Removing the calendar under Settings, Calendars deletes the tokens and the busy times read from it.

A staff member who uses Outlook, Apple Calendar or any other calendar app can use it without signing in to anything, by pasting the address their calendar app publishes (an ICS address). Nothing is installed in their calendar and no account is connected.

• What is read: the address is fetched every 15 minutes from the website it names, over https, and only when a staff member (or someone who manages the client's connections) has pasted it. Only the start and end of the events that mark the person as busy are kept, so that nobody can be booked at those times. Titles, other people on an event, notes, places and links are not kept, and are not even looked at. Cancelled events and events marked as free do not block time. None of it is copied into a customer's record.
• The published calendar address works like a password, because anyone who holds it can read that calendar. It is kept on the server, is never shown again, is never written to a log or to the audit trail, and is deleted together with the busy times when the staff member or the client removes it. If the address stops working, the last busy times stay in place and staff are told that they may be out of date.
• Going the other way, a staff member can switch on a private appointments feed to subscribe to in their calendar app. It shows each appointment's time, the service and the customer's first name (for a class, only how many are booked), and whether it was cancelled. It never holds contact details, notes, prices or meeting links. The feed address is private, can be replaced or switched off at any time, and then stops working at once. A calendar app collects it on its own schedule.
• Nothing is read or published for a paused or closed account.

A client can connect a Facebook account so that Wellkit can publish to its Facebook Page and, if the client switches it on, to the Instagram professional account linked to that Page, receive the leads from its lead ads and, if the client switches it on, receive and answer the messages people send the Page. The person connecting sees Facebook's own permission screen first and chooses which Page to connect.

What is accessed

The lead ads and messaging permissions are requested only when a client chooses to connect lead ads or to switch messaging on. Wellkit does not read the personal profile, friends, private messages or photos of the person who connects, and it does not create or change adverts.

How it is used, stored and shared

• Posts are published to the Page only when the business writes and schedules them.
• Each lead becomes a contact in the account of the business that ran the advert, so the business can reply to the person who asked. The lead is kept as it arrived, alongside the contact.
• The Page access token is kept on the server so the connection keeps working. It is never shown in the app.
• Meta data is used only to provide these features to the client who connected the Page. I do not sell it or use it for advertising of my own, it is not combined with another client's data, and it is not used to train artificial intelligence models.
• It is shared only with the providers listed under who else handles the data, who host the app and its database.

Messenger and Instagram messages

If a client switches on messaging for a Facebook Page, Wellkit receives the messages people send that Page on Messenger, and the direct messages people send the Instagram professional account linked to it, and sends the replies the client's staff write. For each person who writes I store the identifier Meta assigns them for that Page or account, the name or username Meta provides, the text of their messages and Meta's links to any pictures or files they send. The links are Meta's and stop working after a short time; I do not copy the files. I store nothing about the person's friends, posts or other conversations, and I never match them to an existing customer record by name: a member of the client's staff does that by hand. A reply is sent only when a member of the client's staff writes it. Nothing is sent automatically, and replies follow Meta's rules on how long after a person's last message a business may reply. If a message is deleted on Messenger or Instagram, Meta tells Wellkit and the stored text and links are removed. Messages that arrive while a client's account is paused or closed are not kept.

WhatsApp

If a client connects its WhatsApp Business number, Wellkit receives the messages people send that number and, once I have switched sending on for that client, sends the messages its staff write and the messages its own automations are set up to send. The messages pass through Meta, which runs WhatsApp. For each person who writes I store their phone number, the name they show on WhatsApp if they are new to the client, the text of their messages, when they last wrote, and Meta's reference for any picture, voice note or file they send. I do not fetch or copy those files. A person is matched to an existing customer record by phone number only, and an existing record is never changed by what arrives.

A client can connect a number that is already in use on the WhatsApp Business app and keep using the app beside Wellkit. Within 24 hours of connecting, Wellkit asks the app, once, for its contact names and up to six months of its chat history, which Meta sends only if the person connecting chooses to share it. The history is copied into closed, read conversations. For each person in it I store their phone number, the text of the messages and when they were sent, and Meta's reference for any picture, voice note or file, which I do not fetch. A person is matched to an existing customer record by phone number only, and an existing record is never changed. A person with no record gets a new one without starting any automation. The contact names are kept only to name those people, make no record on their own, and are deleted when the number is disconnected. Nothing in the history records that anyone agreed to WhatsApp messages and it does not start the 24 hours in which a free reply is allowed; if a person's last keyword in it was STOP, they are recorded as opted out. Afterwards, messages the client sends from its own app are recorded in the conversation as sent by the client and are never sent again, and a message that Meta says was edited or deleted is changed or removed here to match. Wellkit also reads the number's display name review, quality rating and daily limit from Meta to show them to the client and to tell the client when it needs attention, and keeps a number that does not stay on the app registered for sending and receiving.

WhatsApp allows a free reply only within 24 hours of a person's last message; after that only a message template WhatsApp has approved can be sent. A person who replies STOP, or asks the client not to message them, is sent nothing further on WhatsApp until they reply START, and that opt-out is kept against the phone number even if the customer record is deleted, so the number is not messaged again by mistake. Outside those 24 hours a template is sent only to a person whose agreement to WhatsApp messages the client has recorded, with how and when they agreed, and a marketing template needs that agreement at any time. Messages that arrive while a client's account is paused or closed are not kept.

An agreement to WhatsApp messages is recorded in one of three ways: a member of the client's staff records it and says how the person agreed; the person ticks a consent box on one of the client's forms here, which is never ticked for them; or the person comes through an enquiry form or lead advert that the client has told Wellkit asks for that agreement, in the client's own words. For a lead advert, that is only when the advert's own consent question or tick box was ticked. With each agreement I keep where it came from, the wording the person agreed to as it stood at the time, and when. An agreement is never recorded for a number that has opted out, and never by importing records or changing them in bulk. A template that carries a picture is sent with a picture the client hosts itself: I keep only its link, and WhatsApp fetches the picture.

Phone calls

If a client attaches a business phone number to its account, calls to that number come to Wellkit through Twilio, which runs the number. Wellkit tells Twilio to pass each call to the client's own phones, and, if a client has switched it on, to text the caller when nobody answers. For each call I store the phone number it came from, the number it was made to, when it began, how long the call lasted when it was answered, and whether it was answered or missed. I do not record calls, there is no voicemail, and nothing that is said is heard or kept by Wellkit. If a phone the call is passed to sends it to its own voicemail, the call is logged as answered, because the network cannot tell the difference. A caller who withholds their number is logged with no number and nothing else is done.

A call from a number the client already has is added to that person's record as a line in their conversation, saying it was answered or missed. A call from a number the client does not know creates a new contact with only that number, in the same way as a text from a stranger. A missed call can start one of the client's own automations. A missed-call text is sent only if the client has written it, to a UK mobile by default, and never to a number that has replied STOP; it is a reply to a call the person chose to make, not marketing, and only one goes to the same caller in an hour. Calls that arrive while a client's account is paused or closed are not forwarded or kept.

Sending conversions to Meta

Nothing is sent to Meta about a client's customers by default. A client that advertises with Meta can choose to add a step, "Send conversion to Meta", to one of its automations. The step tells that client's own Meta dataset that a lead arrived or a later stage was reached, using credentials the client supplies. The client does this as controller and on its own instruction: it is responsible for having a lawful basis and for telling its customers in its own privacy notice.

The step sends only:

• a standard, neutral event name, such as Lead, Schedule or Purchase;
• the time of the event and an identifier for it, and a value and currency where the client includes one;
• the Facebook lead identifier, where the person came from a Facebook lead form;
• these contact details, each hashed with SHA-256 before it leaves the CRM: email address, phone number, first and last name, town or city, postcode, country, and the contact's internal identifier;
• where the person enquired through the client's own website and that website passed them on: Meta's own browser identifiers for that visit (known as fbc and fbp), the browser's user agent, and the address of the website, without the page.

Hashing is pseudonymisation, not anonymisation: Meta can match a hash to an account it already holds, which is the purpose of sending it. The step never sends form or assessment answers, custom fields, tags, the name of a service or treatment, appointment details, notes or the text of messages. An event name that contains the name of a service or treatment is refused.

Removing access and deleting data

A client can remove the connection under Settings, Connections, which deletes the stored token. You can also remove Wellkit from your Facebook account under Settings and privacy, Settings, Business integrations. The data deletion page explains how to ask for data received from Facebook to be deleted.

Some of my clients are clinics. A booking for a treatment, an answer on an enquiry form or a note on a record can say something about a person's health, which the law treats as special category data.

• The clinic is the controller of that information. It needs its own lawful basis and condition for holding it, and must explain this to its customers.
• I handle it only to provide the CRM to that clinic. It stays inside that clinic's account, which only the people the clinic has given access to, and I when I am supporting the account, can open.
• I never sell it and never use it for advertising. By default nothing about a customer is sent to Google, Meta or any other advertising service.
• If a clinic switches on the "Send conversion to Meta" step described under Facebook and Meta data, Meta is told that an event such as a lead or a purchase happened, with hashed contact details. Form and assessment answers, service and treatment names, appointment details, notes and messages are never sent, and an event name that names a service or treatment is refused, because Meta's terms forbid sending health information. Meta can still learn that a person it recognises is a customer of that clinic, so the clinic must decide whether that is appropriate and tell its customers.
• An appointment written to a staff member's own Google or Microsoft calendar shows its time, the service and the customer's first name unless the staff member sets it to private, in which case it says only "Appointment".
• Emails and texts a clinic sends through the CRM pass through the email and text providers listed below in order to be delivered.
• A clinic or firm can mark a form as sensitive, for consent and intake forms that ask about health, legal or other private matters. The answers and any files attached to a sensitive form can be read only by the managers and owners of that client's account, and by the agency owners when they support it. They are kept out of notifications, emails, the activity log, automations, the assistant and API keys, and are never copied into the contact's own fields. Opening an attached file is recorded in the activity log, naming the form and nobody else. A file is checked for its type and size when it arrives but is not scanned for viruses, and it is never opened or run by the CRM: it can only be downloaded.

I use the providers below to run Wellkit. Each handles personal data only to provide its service to me. Some are used only when a client switches the feature on or connects the account.

A client can also create an API key for its own account and connect its own tools, such as an AI assistant. Those tools can then read and change that client's data. That is the client's choice and the client is responsible for the tools it connects.

I may also disclose data where the law requires it, or to professional advisers where needed to establish or defend a legal claim.

Client account data is stored in Ireland. Several of the providers above are based in the United States or use systems there, so some personal data, such as sign-in details and the contents of emails and texts being delivered, is handled outside the UK.

Where that happens, the transfer is covered by a safeguard that UK data protection law accepts: UK adequacy regulations for the country or scheme concerned, or the International Data Transfer Addendum in the provider's data processing terms. You can ask me for more detail about the safeguard used for a particular provider.

• A client's account data is kept for as long as that client uses Wellkit. Inside an account, the client decides how long to keep its customers' records and can delete them at any time.
• When a client stops using Wellkit, I delete its account and everything in it within 90 days, unless the client asks for a copy first.
• Tokens for a connected Google, Facebook or Microsoft account are deleted when the connection is removed. Removing a staff calendar, or a published calendar address, also deletes the busy times read from it and the address itself.
• Copies of Google reviews are deleted when the Google connection is removed, and no copy is kept for more than 30 days without being read from Google again.
• If you send a request through the form on the data deletion page, your name, email address and what you wrote are kept so that I can act on it and show that I did.
• A booking that is waiting for a deposit is held for 15 minutes and released if the payment is not made.
• A file attached to a form that is not then submitted is deleted within 2 hours. A file that was submitted is deleted with the customer's record, with the form, or with the client's account, whichever comes first.
• The record of a call (the number, time, length and outcome) is kept with the customer's record and deleted with it. There is no recording to keep.
• Your sign-in account is kept until your access is removed and you or the client ask for it to be deleted.
• Records I must keep by law, such as my own invoices to clients, are kept for the period the law requires.

• Every connection to the app is encrypted in transit.
• Access is by invitation to a verified email address, and each person has a role that limits what they can see and do.
• Every request to read or change data is checked on the server against the accounts the person is allowed to open, so one client cannot reach another client's data.
• Tokens and secrets for connected services are kept on the server and are never shown in the app.
• Card details are entered on Stripe's pages and never reach the CRM.
• Significant actions are recorded in an audit log the client can read.

Under UK data protection law you can ask to:

• see the personal data held about you and get a copy of it;
• have it corrected if it is wrong;
• have it deleted;
• have its use restricted, or object to its use;
• receive data you provided in a form you can take elsewhere;
• withdraw consent where consent is the basis, such as for marketing messages.

If you are a customer of a business that uses Wellkit, the quickest route is to ask that business, because it is the controller. You can also write to me at hello@wellkit.co.uk and I will pass your request to the business and help it respond. If you sign in to Wellkit, write to me directly. Requests are answered within one month, and there is no charge.

If you are unhappy with how your data has been handled, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

Wellkit uses only what is needed for the app to work. There are no analytics, advertising or social media cookies, so there is no cookie banner.

• Sign-in cookies, set by the sign-in service (Clerk), keep you signed in and protect the session. Their names start with __session, __client, __clerk or __refresh. The sign-in service may also set security cookies that tell people from automated traffic.
• Booking, form, invoice and unsubscribe pages, which a business's customers use without signing in, do not load the sign-in service and set none of its cookies.
• A review widget on a business's website sets no cookie, keeps nothing in your browser and does not track you. My server receives the request for the widget, as for any web page, and is told nothing about the page it is shown on.
• The chat button a client can put on its own website sets no cookies and keeps nothing in your browser.
• Where the Cloudflare check described under what is collected is switched on, it runs in a frame that belongs to Cloudflare, on booking pages, forms, payment link pages, estimates and in the chat window. Wellkit sets no cookie for it. Cloudflare's clearance cookie (cf_clearance) is not used. Cloudflare says its challenge system may set cookies of its own in that frame, named cf_chl_rc_i, cf_chl_rc_ni and cf_chl_rc_m, which it uses to find faults. They are used for security only, not for analytics or advertising.
• Your browser's local storage remembers display choices on that device, such as whether the sidebar is collapsed and which columns a list shows.
• On a booking page, your browser's session storage holds the reference of a booking while its deposit is being paid, and is cleared when you close the tab.
• Payment pages are Stripe's, and Stripe sets its own cookies there to process the payment and prevent fraud.

Wellkit is a tool for businesses. It is not directed at children and is not meant to be used by anyone under 18. A client may hold details of a customer who is under 18 where its own services allow it; the client is responsible for doing so lawfully.

If the way Wellkit handles personal data changes, this notice is updated before the change takes effect and the date at the top changes with it. If Wellkit is ever to use Google or Facebook data in a new way, the people who connected those accounts are told and asked to agree first.

Questions about this notice, and requests about your data, go to hello@wellkit.co.uk, or by post to Matt West, West Media Limited, 29 Prospect Road, Southborough, Tunbridge Wells, England, TN4 0EN.