Section 01Who we are
Verattia Ltd (Companies House 16396655), registered in England and Wales, operates www.verattia.com and provides doctor-led claim-risk review services.
Under the UK GDPR and the Data Protection Act 2018, Verattia Ltd is the data controller for personal data processed through this website and our engagements.
Contact: hello@verattia.com.
Section 02What data we collect
- Enquiry data: name, email, company, URLs submitted for review, message content and any documents you choose to upload.
- Anonymised analytics data: aggregated page views, sessions and engagement events, including review selections, calls to action and successful enquiry submissions. Our custom events contain the service selected and the site button or section used, not your name, email, message or uploaded file.
- Communications you send to us by email or through the site.
- Technical request data: request metadata, including IP addresses, may be processed to protect the enquiry service and apply submission limits.
- Outbound contact data: where we contact a business proactively, the name, professional role and business email of a decision-maker, and the name and website of their organisation. We contact corporate subscribers (limited companies and LLPs) at business addresses only.
We do not collect payment card data directly.
Verattia does not request or intentionally collect special category personal data (Article 9 UK GDPR) through the website. Please do not submit patient-identifiable or health information via the enquiry form.
Where we obtained outbound contact data (Article 14 UK GDPR): where we contact you proactively, we did not obtain your details from you directly. We obtain them from publicly available sources, including your organisation's website, public registers such as Companies House and relevant professional registers, and LinkedIn. We may also use a pre-existing verified business contact record held in Apollo.io.
Section 03How we use your data
- To respond to enquiries and deliver requested services.
- To improve the website using aggregated, anonymised usage data.
- To send limited, clearly identified and easy-to-decline business correspondence to organisations whose public advertising falls within our area of expertise.
We use rules-based automated screening to assess organisational fit, professional-role relevance, suppression status and whether the available evidence is strong enough for limited business correspondence. This screening does not use special category data and does not produce legal or similarly significant effects. We do not sell or share personal data with third parties for their own marketing.
Section 04Legal basis
- Contract performance (Article 6(1)(b) UK GDPR), for service delivery.
- Legitimate interests (Article 6(1)(f)), for enquiry handling and anonymised analytics.
- Legitimate interests (Article 6(1)(f)), for limited business-to-business outreach to corporate subscribers about advertising and claim-risk. A Legitimate Interests Assessment is held on file and you may object at any time.
- Consent, where required for electronic marketing to individual subscribers.
Section 05Data retention
Enquiry and client data is retained for up to 6 years from the end of an engagement, in line with UK limitation periods. Analytics data is retained per the provider's policy.
Unconverted enquiries are normally deleted within 12 months unless needed for follow-up, record-keeping or legal purposes.
Outbound prospect contact data is retained for no longer than 24 months from last contact, after which it is deleted or suppressed. Opt-outs are recorded on a permanent suppression list so we do not contact you again.
You may request deletion at any time by emailing hello@verattia.com.
Section 06Your rights
Under UK GDPR you have the rights of access, rectification, erasure, restriction, objection and portability. Email hello@verattia.com to exercise any of these rights.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Section 07Cookies
The site sets no non-essential cookies. Our analytics service (Plausible) is cookieless by design. See our Cookie Notice for full detail.
Section 08Third-party services
- Hosting: the site is hosted on Vercel (Vercel Inc., USA), which may process request metadata.
- Fonts: self-hosted on verattia.com. Loading this site makes no third-party font requests.
- Analytics: Plausible Analytics (Plausible Insights OÜ, EU-hosted), a privacy-first, cookieless service. It measures aggregated page views and the engagement events described above, without cookies or persistent identifiers. We do not send enquiry contents or attachments in custom analytics events. IP addresses are processed transiently and are not stored.
- Form delivery: enquiry-form submissions are dispatched to our inbox via Resend (Resend, Inc., USA), which processes the message content for delivery only.
- Outbound contact data: verified business contact records and outreach cohort state may be managed in Apollo.io (Apollo.io, USA), and outreach delivery and commercial outcomes may be checked against our CRM (HubSpot, HubSpot Inc., USA).
Section 09International transfers
Vercel infrastructure may involve servers located outside the UK, under appropriate transfer mechanisms (UK IDTA, Standard Contractual Clauses or equivalent). Enquiry-form delivery via Resend, and outbound contact data processed via Apollo.io and HubSpot, may involve processing in the USA under the same classes of safeguard.
Analytics data is processed and stored within the EU by Plausible; UK-to-EEA transfers are covered by the UK's adequacy arrangements.
Documents uploaded through the enquiry form are processed by the form-delivery services above. Any separate handling arrangements for commissioned audit work are agreed before you provide the material.
Section 10Changes
The current version is published at www.verattia.com/privacy with the last-updated date at the top of the page.
Section 11Contact
Verattia Ltd · hello@verattia.com · Companies House 16396655.