Privacy policy

Who we are

Pulosa Ltd provides Pulosa, software that service businesses use to run their website, bookings, client records, consent forms, emails and finances. Registered in England and Wales, company number 17536570. Registered office: 182-184 High Street North, East Ham, London, E6 2JA. You can contact us at privacy@pulosa.com.

Two different roles

• Businesses and their teams. For the details of businesses that sign up and the people who log in, we decide how the information is used. We are the controller.
• A business’s clients and website visitors. When a business keeps client records, takes bookings or receives enquiries in Pulosa, that business is the controller and we act only on its instructions as its processor. If you are a client of a business, please contact that business about your information. Their own privacy policy is on their website.

What we collect about businesses and their teams

• Account details: names, email addresses, business name, business type, phone number and town.
• Subscription and billing records. Card details are handled by our payment provider and never stored by us.
• How the service is used: sign-ins, an audit log of actions in the app, and technical logs such as IP address, browser and errors, used to keep the service secure and working.
• Messages you send us, such as support requests and demo bookings.

How client records are protected

Client records, consent forms, health questionnaires, clinical notes and photos are encrypted on the business’s own device before they are saved, using a key derived from the business’s PIN or passphrase. We store only the encrypted data and cannot read it. If a business turns on recovery by email, we also keep half of a recovery code, which can’t open anything on its own: the other half is emailed to the business, and we only release ours after checking it’s really them. Every change is recorded in a tamper-evident audit log.

Some details have to be readable by our servers to work: online booking requests until the business imports them, website enquiries, and the name, service, date and price used in appointment emails. Email details are deleted from the sending queue once the email has been sent. Health information is never included in emails.

Why we use information, and our legal basis

• To provide the service a business has signed up for: performance of our contract (UK GDPR Article 6(1)(b)).
• To keep the service secure, prevent misuse and improve it: our legitimate interests (Article 6(1)(f)).
• To keep accounts and tax records: legal obligation (Article 6(1)(c)).
• To send product news to businesses: legitimate interests, and you can opt out at any time.
• As a processor, we handle client information only to provide the service, under our agreement with the business (Article 28).

The assistant on our website

The Ask a question chat on pulosa.com is written by AI. What you type is sent to the AI model through OpenRouter to write the answer, and isn’t used to identify you. To stop overuse we count how many questions each visitor asks in a day, using a scrambled code made from your connection that changes every day; your IP address isn’t stored. We may keep the questions themselves (not the answers) for 30 days to improve what it knows. Please don’t type personal or health details into it.

Who we share it with

We do not sell personal information. We use carefully chosen suppliers to run the service, each under a contract that protects your information:

• Supabase: database, sign-in and server functions.
• Vercel: website and app hosting.
• Resend: sending emails on behalf of businesses.
• OpenRouter: AI writing for businesses, and the assistant on our website.
• Our payment provider, for subscription payments.

Where information is transferred outside the UK, we rely on safeguards approved under UK law, such as adequacy regulations or the International Data Transfer Addendum. We may also share information where the law requires it.

How long we keep it

Business account details are kept while the account is open and for up to 6 years after it closes, for legal and accounting reasons. Client records belong to the business: they are kept for as long as the business keeps them, and the business can export or delete them. When a business leaves, its data is deleted from our systems within 90 days, except backups, which expire on their normal cycle.

Cookies and storage

The Pulosa app uses only what it needs to work: sign-in session storage and settings such as your chosen calendar view, kept in your browser. Our homepage counts visits with Google Analytics, without advertising features, so we can see how it’s used; it’s on unless you switch off visitor statistics in Cookie settings, or choose Reject non-essential. Business websites ask before loading maps, and those that use Google Analytics say so in their cookie banner, with the same way to switch it off.

Your rights

You can ask to see, correct or delete your information, to restrict or object to how it is used, and to receive a copy to take elsewhere. For a business’s client records, contact the business directly and we will help them respond. For anything else, email privacy@pulosa.com. We reply within one month.

Complaints

If you are unhappy with how we have used your information, please tell us first. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes

We will update this policy when the service changes, and tell businesses by email about anything significant.