Legal & Policies

Privacy Policy

Last updated 4 April 2026

1. Who We Are

VerifiedPractitioner is a service operated by Truly Empowered Ltd, a company registered in England and Wales.

  • Company No. 11904082
  • VAT No. 348808856
  • Registered Address: 71-75 Shelton Street, London, WC2H 9JQ
  • Contact Email: hello@verifiedpractitioner.com
  • Website: www.verifiedpractitioner.com

This Privacy Policy explains how we collect, use, store and protect personal data when you use our website and services. It applies to practitioners who subscribe to our platform and to reviewers who submit reviews.

We are the data controller for all personal data processed through VerifiedPractitioner. We take our responsibilities under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 seriously.

2. What Data We Collect

From Practitioners (Subscribers)

  • Full name
  • Email address
  • Business name and website URL
  • Business logo (if uploaded)
  • Professional bio
  • Google Reviews URL (if provided)
  • Payment information (processed securely by Stripe — we do not store card details)
  • IP address at login (for security and fraud detection)

From Reviewers

  • Name (or chosen display name)
  • Email address (encrypted at rest using AES-256 encryption)
  • Star rating and review text
  • IP address (for fraud prevention only)
  • Consent confirmation

Automatically Collected

  • IP addresses
  • Browser type and version
  • Pages visited and timestamps
  • Cookies (see our Cookies Policy)

We do not use any third-party analytics or tracking tools. We do not collect data beyond what is listed above.

3. How We Use Your Data

Practitioner Data

  • To create and manage your account
  • To process your subscription payments via Stripe
  • To send you service-related emails (welcome emails, review notifications, reminders)
  • To display your business information on your public review profile
  • To detect and prevent fraud (IP comparison between reviewer and practitioner)
  • To maintain audit logs for security and accountability

Reviewer Data

  • To send you a review request email on behalf of the practitioner
  • To publish your review (display name, star rating, review text and date only — never your email or IP address)
  • To send you a confirmation email with links to manage or delete your review
  • To send optional reminders if you have not yet submitted your review
  • To prevent duplicate or fraudulent submissions

4. Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR:

  • Contract: Processing practitioner data is necessary to provide the subscription service you have signed up for.
  • Legitimate Interest: Processing reviewer data to collect and display reviews on behalf of the practitioner. This is balanced against the reviewer’s rights — we minimise the data collected and provide full control over deletion.
  • Consent: Reviewers provide explicit consent when submitting a review. This consent can be withdrawn at any time.
  • Legal Obligation: We may process data where required by law, such as maintaining financial records.

5. How We Protect Your Data

  • Reviewer email addresses are encrypted at rest using AES-256 encryption
  • Encryption keys are stored securely on the server, separate from the database
  • Email addresses are hashed (SHA-256) for deduplication — the hash cannot be reversed to reveal the email
  • All data is transmitted over HTTPS/TLS encryption
  • Payment processing is handled entirely by Stripe, a PCI DSS Level 1 certified provider. We never see, store or have access to your card details
  • Access to the database is restricted to authorised personnel only
  • All significant actions are logged in an audit trail for accountability

6. Data Sharing

We do not sell, rent or trade your personal data. We share data only with the following third parties, strictly as needed to provide our service:

  • Stripe (payment processing) — Stripe Privacy Policy
  • 20i (web hosting) — your data is stored on servers managed by 20i, a UK-based hosting provider
  • Email delivery — emails are sent via our hosting provider’s SMTP servers. We do not use third-party email marketing platforms

We will disclose personal data if required to do so by law or in response to a valid legal request from a public authority.

7. Data Retention

  • Practitioner accounts: Retained for the duration of your subscription plus 12 months after cancellation, then permanently deleted
  • Reviews: Retained for as long as the practitioner’s account is active. If a practitioner’s account is deleted, all associated reviews are also permanently deleted
  • Reviewer email addresses: Retained in encrypted form for as long as the review exists. Deleted when the review is deleted
  • Review request tokens: Expire automatically after 30 days
  • Audit logs: Retained for 24 months, then automatically purged
  • Payment records: Retained for 7 years as required by UK tax law

8. Your Rights

Under UK GDPR, you have the following rights:

  • Right of access: Request a copy of the personal data we hold about you
  • Right to rectification: Request correction of inaccurate data
  • Right to erasure: Request deletion of your data (subject to legal retention requirements)
  • Right to restrict processing: Request that we limit how we use your data
  • Right to data portability: Request your data in a structured, machine-readable format
  • Right to object: Object to processing based on legitimate interests
  • Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time

For reviewers: Every review confirmation email includes a link to delete your review and all associated personal data. You can also email us at hello@verifiedpractitioner.com to make any data request.

For practitioners: You can update your personal information through your dashboard at any time. To request deletion of your account and all associated data, email us at hello@verifiedpractitioner.com.

We will respond to all data requests within 30 days.

9. International Data Transfers

Your data is stored on servers located in the United Kingdom. We do not transfer personal data outside the UK, except where our third-party processors (such as Stripe) may process data in countries with adequate data protection agreements in place.

10. Children’s Privacy

VerifiedPractitioner is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last Updated” date. If we make significant changes that affect how your data is used, we will notify practitioners by email.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have a complaint about how we handle your data, please contact us:

Email: hello@verifiedpractitioner.com
Post: Truly Empowered Ltd, 71-75 Shelton Street, London, WC2H 9JQ

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Last Updated: 4 April 2026