Privacy and Cookie Policy
Practivation
Last updated: September 2026
1. Who we are
Practivation is a trading style of Swiftbridge Group Ltd, a company registered in the United Kingdom.
Company number: 15266461
Registered office: Willow Trees Alderley Road, Prestbury, Macclesfield, England, SK10 4RH
We provide practice management, membership transformation and outsourced non clinical services to independent private GP practices in the UK. In this policy, “we”, “us” and “our” mean Swiftbridge Group Ltd trading as Practivation.
We are committed to protecting your personal data and handling it in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you have any questions about this policy or how we use your data, contact us at privacy@practivation.co.uk or in writing at our registered office.
2. The two roles we play with personal data
Because of the nature of our business, we handle personal data in two distinct capacities, and your rights work differently in each.
As a controller
When you visit our website, make an enquiry, attend an event, or deal with us as a client, prospective client, supplier or professional contact, we decide how and why your data is used. For that data, we are the controller and this policy applies in full.
As a processor for client practices
When we deliver outsourced services to a GP practice, we handle personal data about that practice's patients, such as contact details, appointment bookings, membership and payment records and related correspondence, strictly on the practice's behalf and under its written instructions. For that data, the practice is the controller and we are a processor acting under a data processing agreement.
If you are a patient of a practice we work with and you wish to exercise your data protection rights or ask how your data is used, please contact your practice directly. We will support the practice in responding to you. We do not use patient data for our own purposes, we do not use it to market our services, and we never sell it.
3. The personal data we collect as a controller
- Identity and contact data: your name, role, practice or organisation name, email address, telephone number and postal address, typically provided when you complete our enquiry form, email us, call us or meet us.
- Business relationship data: correspondence, meeting notes, proposals, contracts and billing information relating to our work together.
- Technical and usage data: your IP address, browser type and version, device information, and information about how you use our website, collected through cookies and similar technologies described in section 9.
- Marketing preferences: your choices about receiving communications from us.
We do not intend to collect special category data, such as health information, through our website or marketing activity, and we ask that you do not include it in enquiry forms. Any patient health data we encounter in delivering services is handled solely as a processor as described in section 2.
4. How we use your data and our lawful bases
We only use your personal data where the law allows. Most commonly:
- To respond to your enquiry and arrange calls or meetings you have requested. Lawful basis: our legitimate interests in responding to people who contact us, or steps taken at your request prior to entering a contract.
- To provide our services to your practice and manage our relationship, including invoicing and account administration. Lawful basis: performance of a contract.
- To send you relevant information about our services, events and insights where you are a business contact. Lawful basis: our legitimate interests in marketing our services to businesses, always with a clear way to opt out. Where consent is required, we will ask for it.
- To operate, secure and improve our website. Lawful basis: our legitimate interests in running an effective and secure website.
- To comply with legal and regulatory obligations, including accounting and tax rules. Lawful basis: legal obligation.
We do not use your personal data for automated decision making that produces legal or similarly significant effects on you.
5. Who we share your data with
We share personal data only where necessary and with appropriate protections in place:
- Service providers who support our business, such as website hosting, customer relationship management, email, telephony and payment systems, acting under contracts that require them to protect your data.
- Professional advisers, including accountants, lawyers and insurers, where necessary.
- Authorities, regulators or courts where we are required to do so by law.
- A buyer or successor in the event of a sale, merger or reorganisation of our business, in which case this policy would continue to apply to your data.
We do not sell personal data to anyone, and we do not share it with third parties for their own marketing.
6. International transfers
Some of our service providers may process data outside the UK. Where that happens, we make sure an adequate level of protection applies, either because the destination country is covered by UK adequacy regulations or because we have put in place appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information about the safeguards we use.
7. How long we keep your data
We keep personal data only for as long as we need it for the purposes described in this policy, and then delete or anonymise it. In general:
- Enquiries that do not lead to a business relationship: up to two years from our last contact.
- Client and supplier records: for the duration of the relationship and for up to six years afterwards, reflecting limitation periods and accounting requirements.
- Marketing preferences: for as long as needed to respect your choices, including keeping a record of an opt out.
- Patient data processed on behalf of client practices: for the period instructed by the practice under our data processing agreement, after which it is returned or deleted in line with the practice's instructions.
8. How we protect your data
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include access controls and role based permissions, encryption in transit, staff confidentiality obligations and training, and contractual security requirements on our suppliers. Given the sensitivity of the healthcare environment we operate in, we treat data security as a core operational discipline, not an afterthought. No system is completely secure, but if we become aware of a personal data breach affecting you we will act in accordance with our legal obligations, including notifying the Information Commissioner's Office and affected individuals where required.
9. Cookies
This section is our cookie policy. Cookies are small text files placed on your device when you visit a website. We use them sparingly, and we do not use advertising or cross site tracking cookies.
The cookies we use
| Category | Purpose | Consent | Duration |
|---|---|---|---|
| Essential | Needed for the website to function, including security, load balancing and remembering your cookie choices. | Not required; these are exempt as strictly necessary. | Session, or up to 12 months for your cookie preference. |
| Analytics | Help us understand how visitors use the site, such as which pages are read and where visitors arrive from, so we can improve it. Data is aggregated and not used to identify you. | Set only if you accept them through the cookie banner. You can change your mind at any time through the cookie settings link on the site. | Up to 24 months. |
Managing cookies
When you first visit the site, the cookie banner lets you accept or decline non essential cookies before any are set, and a cookie settings link on the site lets you change your choice at any time. You can also control or delete cookies through your browser settings, though blocking essential cookies may affect how the site works.
Where our analytics provider processes data on our behalf, it does so under contract as described in section 5, and any transfers outside the UK are protected as described in section 6.
10. Your rights
Where we are the controller of your personal data, you have the following rights under UK data protection law:
- Access: to request a copy of the personal data we hold about you.
- Rectification: to have inaccurate or incomplete data corrected.
- Erasure: to ask us to delete your data in certain circumstances.
- Restriction: to ask us to limit how we use your data in certain circumstances.
- Portability: to receive certain data in a structured, commonly used, machine readable format.
- Objection: to object to processing based on our legitimate interests, and to object at any time to direct marketing, which we will always stop on request.
- Withdrawal of consent: where we rely on consent, to withdraw it at any time without affecting processing that took place before withdrawal.
To exercise any of these rights, contact us at privacy@practivation.co.uk. We will respond within one month, and we may need to verify your identity first. There is normally no fee.
If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to resolve your concern directly first.
11. Children
Our website and services are directed at businesses and healthcare professionals, not at children, and we do not knowingly collect personal data from children through our website.
12. Changes to this policy
We may update this policy from time to time. The current version will always be available on our website with the date it was last updated. If we make significant changes to how we use your data, we will take reasonable steps to bring them to your attention.
13. Contact
Swiftbridge Group Ltd trading as Practivation
Willow Trees Alderley Road, Prestbury, Macclesfield, England, SK10 4RH