Privacy Policy

What we collect

• Account data: your email address and password (handled by our authentication provider, Supabase).
• Referrer profile: name, workplace, profession type, and registration body/number if you provide one.
• PT profile: name, postcode (used to calculate approximate distance for search — we don't show your exact address to referrers), specialisms, qualification level, self-declared insurance status, and bio.
• Referral data: a client's name, age, a phone number and/or email address so the PT can contact them, and any notes a referrer chooses to include (e.g. goals or relevant context), the referral's status, and any update note a PT adds.

Client data and consent

Clients referred through Referloop do not have accounts. Once a PT accepts a referral, we email the client directly (using the contact details provided) to tell them who referred them, what we hold about them, and how to access, correct, or delete it — this is the one point we contact a client ourselves, rather than relying only on what the referrer has told them. A referrer must confirm, at the point of sending a referral, that the client has given informed consent to their name, age, contact details, and referral notes being shared with the specific named PT selected — not PTs in general — and that the client understands Referloop will store this data for a limited period (see “How long we keep it” below) and can ask to access, correct, or delete it at any time via our data request page, with no account required. The referrer is responsible for obtaining that consent before submitting a referral — we require explicit confirmation in the referral form, but we are not party to the conversation where that consent is actually given. A client's contact details are only ever shown to the PT once they've accepted the referral, not before, and are never included in email or push notifications sent to the PT — those only say a referral is waiting and link back into the app.

Why we process this data

To operate the core service: matching referrers to relevant PTs, transmitting referrals with the context needed to act on them, and tracking referral status. Where you've given consent (as with referral data), we rely on that; otherwise we rely on it being necessary to provide the service you've signed up for.

Who we share it with

A client's name, contact details, and referral notes are shared only with the specific PT a referrer selects. PT profile information (name, location, specialisms, qualification level, self-declared insurance, bio) is visible to referrers browsing the directory, but only once we've verified that PT and their subscription is active. We use Supabase to host our database and handle authentication, Netlify to host the website, and Resend to send transactional emails (sign-up confirmations, referral notifications) — all three process data on our behalf under their own data processing terms. We do not sell personal data to third parties.

How long we keep it

Account data is kept for as long as your account is active. Referral data is different: once a referral is declined, we automatically remove the client's name, age, contact details, and any clinical notes 90 days later (no relationship was ever formed, so there's no ongoing reason to keep it). Once a referral is closed (the engagement has concluded), we do the same after 365 days. The referral's status and dates are kept afterwards for our own record-keeping, but the client's personal details are gone. If you'd like data deleted sooner, use our data request page or contact us using the details below.

Your rights

Under UK GDPR you can ask us to access, correct, delete, or export your personal data, or object to how we use it — including if you're a client who was referred through Referloop and never created an account yourself. Use our data request page to make a request, no account needed. You can also complain to the Information Commissioner's Office if you think we've mishandled your data.

Cookies

We use only the essential cookies needed to keep you signed in. We don't use tracking or advertising cookies.

Changes to this policy

If we make material changes, we'll update the date at the top of this page.

Contact

Use our data request page for access/correction/deletion requests, or email us directly at referloopadmin@protonmail.com for anything else.