Privacy
Privacy notice
How we use information about the people who contact us and the clinics we work for. And what we do, and do not do, with patient information when a clinic uses Baton.
Last updated 28 October 2026.
If you are a patient of a clinic that uses Baton, your clinic decides how your information is used, and its privacy notice tells you how. Please ask your clinic about your records. If you write to us instead, we will pass your request to your clinic the same working day and tell you we have done so. We do not decide what happens to your records, and we cannot release them to you ourselves.
1. Who we are
Baton is clinical software for private mental health clinics in the UK. It is sold by Baton Clinical Ltd, a company registered in England and Wales with company number 17548392. Our registered office is 1a Blunts Lane, Whittlesey, Peterborough PE7 1AH. In this notice, "we" and "us" mean that company.
For any question about this notice or your information, email hello@baton-clinical.com or write to us at the address above.
2. Our two roles
Data protection law gives an organisation one of two roles for each kind of information it holds.
- We are the controller of information about people who use this website or contact us, and about the staff at our customer clinics whom we deal with as a business: who signs the contract, who pays, who asks for support. We decide how that information is used, and this notice explains it.
- We are a processor of the information that a clinic puts into Baton about its patients and its own staff. The clinic is the controller. We use that information only to run Baton for the clinic, on the clinic's written instructions, under a contract that UK data protection law requires. Section 9 says more.
3. When you use this website
The trial request form
When you send the form, we receive your name, your email address, and anything else you choose to give: your clinic's name, the plan you are looking at, how many clinicians you have, and your message. It is sent to us by email. We use it to reply to you and arrange a walkthrough, and for nothing else.
Please do not put any patient information in the form.
To stop the form being misused, the service that receives it keeps the internet address (IP address) it came from in its memory, never on disk, and refuses more than 3 enquiries from one address in 10 minutes. It forgets the addresses when it restarts. Its log records that an enquiry from your email address was sent, so that we can find one that went missing. That log is part of the server's system log, which deletes its oldest entries automatically as it fills.
Server records
Like every website, the server that sends you these pages records each request: your IP address, the date and time, the page asked for, the address of the page that linked to it, and the browser you used. We use these records only to keep the website running and secure, and to look into an attack. They are kept for 14 days and then deleted.
No cookies, and no tracking
This website does not set any cookies. It does not use analytics, advertising or social media tools, and it does not load anything from another company's servers: the fonts are served from this website. So it does not ask for your consent to cookies, because there are none.
If that changes, we will update this notice and ask for your consent first where the law requires it.
4. When your clinic is a customer
If your clinic takes a trial or buys Baton, we hold information about the people we deal with there:
- names, job titles, work email addresses and phone numbers
- the contract, and who agreed to it and when
- invoices, payments and billing contacts. Card payments are taken by Stripe; we never see the full card number.
- support requests and our replies
- a record of what our own staff do when they sign in to support your clinic.
We send you emails about the service: changes, planned maintenance, security notices and invoices. We do not send marketing emails unless you have asked for them, and every one tells you how to stop them.
5. Why we use it, and the law that allows it
| What we do | The lawful basis (UK GDPR Article 6) |
|---|---|
| Answer your enquiry and arrange a trial | Our legitimate interests in answering people who ask about Baton, and steps you ask for before a contract (Article 6(1)(f) and 6(1)(b)) |
| Provide Baton, support and bill your clinic | The contract with your clinic, and our legitimate interests in dealing with the people who work there (6(1)(b) and 6(1)(f)) |
| Keep the website and Baton secure | Our legitimate interests, and our legal duty to keep personal data secure (6(1)(f) and 6(1)(c)) |
| Keep accounts and tax records | Legal obligation (6(1)(c)) |
| Send marketing emails, if you have asked for them | Your consent, which you can withdraw at any time (6(1)(a)) |
Where we rely on legitimate interests, we have weighed them against your rights. You can object, and we will stop unless we have a strong reason to carry on.
We do not use your information to make decisions about you by automated means alone.
6. Who we share it with
We do not sell personal information, and we do not share it for anyone else's marketing. We use these suppliers, who act on our instructions under contracts that protect it:
| Supplier | What they do for us | Where |
|---|---|---|
| IONOS | Host the servers for this website and for Baton | United Kingdom |
| Mailjet (Sinch) | Deliver the trial request form to our inbox, and Baton's emails | European Union |
| Microsoft 365 | Our email | United Kingdom |
| Stripe | Take card payments from customer clinics | United Kingdom, European Union and United States |
| Our accountant | Prepare our accounts and tax returns | United Kingdom |
We may also share information where the law requires it, for example with HM Revenue and Customs, a court or the police, and with professional advisers such as lawyers and insurers. If the company or Baton is sold, the buyer would take on this notice.
7. Where it is kept
This website and Baton run on servers in the United Kingdom. Where a supplier in the table above holds information outside the UK, it is in a country the UK has decided gives adequate protection, such as a country in the European Economic Area, or it is protected by the UK's International Data Transfer Agreement or Addendum. Ask us if you would like a copy of the safeguard.
8. How long we keep it
| Information | How long |
|---|---|
| An enquiry that does not lead to a trial | 12 months from our last contact, then deleted |
| Server records | 14 days |
| Contracts and contacts at a customer clinic | While the clinic is a customer, and 6 years after the contract ends, in case of a dispute |
| Invoices and payment records | 6 years from the end of the financial year they relate to, as company tax law requires |
| Marketing preferences | Until you ask us to stop. We then keep your email address on a list of people not to contact. |
9. Patient and staff information in Baton
A clinic that uses Baton records information about its patients in it, including health information, and about its own staff. The clinic is the controller of all of it. We are its processor. This means:
- We use it only to provide Baton to that clinic, as the clinic instructs us in writing. We never use it for our own purposes, never sell it, and never use it to market to anyone.
- We do not use patient information to train artificial intelligence.
- It is stored on servers in the United Kingdom.
- Everyone who works on Baton is bound to keep it confidential. Our staff see a clinic's records only when the clinic asks for help, or to keep Baton working and safe. Baton records every time anyone, including us, opens or changes a record.
- We help the clinic answer requests from patients and staff who want to use their rights, and help it deal with any breach. We tell the clinic without undue delay if we become aware of a breach affecting its information.
- We use other companies (sub-processors) only with the clinic's agreement, under contracts that give the same protection. They are listed in our data processing agreement.
- When the clinic leaves, we give it a full copy of its records, and then delete them from Baton as the contract sets out.
The terms are in the data processing agreement that every clinic signs with us, as UK GDPR Article 28 requires. You can read it here: data processing agreement.
If your clinic turns on Baton's optional report drafting, Baton sends the material for that report, encrypted, to Anthropic in the United States, using the clinic's own account with Anthropic, to produce a first draft. Anthropic may not use it to train its AI, and deletes it within 30 days. The clinic's agreement with Anthropic, its data processing addendum, includes the UK Addendum to the standard contractual clauses, which binds Anthropic to UK standards. Anthropic lists the companies it uses in its list of subprocessors. A clinician reads, corrects and signs every report.
10. Your rights
For the information we control, you have the right to:
- ask for a copy of the information we hold about you
- ask us to correct it if it is wrong
- ask us to delete it
- ask us to limit how we use it
- object to how we use it, including to any marketing, at any time
- ask for it in a form you can take to someone else, where we hold it because of a contract or your consent
- withdraw your consent, where that is why we hold it.
Some of these rights depend on the reason we hold the information. To use any of them, email hello@baton-clinical.com. We will reply within one month. There is no charge.
For information a clinic holds in Baton about you, ask the clinic. See the box at the top of this page.
11. Complaints
If you are unhappy with how we have used your information, please tell us first at hello@baton-clinical.com. The law requires us to acknowledge your complaint within 30 days. We will look into it without delay, keep you told how it is going, and tell you the outcome.
You can also complain to the Information Commission, which is still known as the ICO:
- online at ico.org.uk/make-a-complaint
- by phone on 0303 123 1113
- by post to the address on the ICO's contact page.
12. Changes to this notice
We will update this notice when what we do changes. The date at the top says when it last changed. If a change affects our customer clinics, we will also tell them by email.