Privacy policy

Virtual Assist X Ltd is a company registered in England and Wales, at 61 Bridge Street, Kington, Herefordshire, HR5 3DJ. For the personal data described in this policy we act as the data controller, except where we handle materials on behalf of a client, which is covered in the section on client case materials below.

Questions about this policy or about your data: [email protected].

When you complete a form on this site we collect your name, work email address, practice or firm, professional credential, and your phone number where you choose to give it. We record which consents you gave and when.

When you book a call we collect the time you selected, your time zone, and anything you write in the booking notes.

Our website host records standard technical information such as IP address, browser type, and pages visited, for security and for keeping the site running.

To respond to your enquiry, send the non-disclosure agreement, release the work sample, and hold the call you booked. Our lawful basis is the steps taken at your request before entering a contract, and our legitimate interest in replying to professional enquiries.

To send you occasional service messages about an engagement. Our lawful basis is legitimate interest, or your consent where the message is sent by SMS.

To keep records of confidentiality acknowledgements and consents. Our lawful basis is our legitimate interest in being able to evidence them, and our legal obligations.

We send SMS only where you have ticked the relevant box. Consent to receive messages is never a condition of receiving the work sample or of booking a call. You can withdraw consent at any time by replying STOP, or by emailing us. Message frequency varies and message and data rates may apply.

Where a client engages us, any case file, medical record, or billing record they send is handled on their instructions and under a confidentiality agreement signed with that client. For those materials the client is the controller and we act as a processor. We are not a HIPAA covered entity and we do not hold ourselves out as one; the materials are handled under the confidentiality terms agreed with the client, and we will enter into a data processing agreement, or a business associate agreement where a client requires one.

We do not use client case materials for any purpose other than the engagement they were sent for, and we do not use them to train any system.

We do not sell personal data and we do not share it with third parties for their own marketing.

We use a small number of service providers to run the business — customer relationship and website hosting, email, calendar and scheduling, and electronic signature. They process data on our instructions and under contract. We also disclose information where the law requires it.

Some of our service providers are based outside the United Kingdom. Where personal data is transferred outside the UK we rely on an adequacy decision, or on the International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, together with appropriate safeguards.

Enquiry and booking records are kept for as long as we are in contact with you about the enquiry, and then for a further period while there is a reasonable prospect of working together.

Case materials received from a client are deleted 180 days after the engagement ends, unless the client instructs us in writing to return or delete them sooner, or a longer period is agreed.

Records of confidentiality acknowledgements and signed agreements are kept for as long as they may be needed to evidence the arrangement.

Access to files is limited to the people working on the engagement. Materials are held in access-controlled systems, transferred over encrypted connections, and deleted on the schedule above. No method of transmission or storage is impregnable; if a breach affects your rights we will notify you and the Information Commissioner’s Office as the law requires.

Under UK data protection law you have the right to ask for a copy of your personal data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we rely on it. To exercise any of these, email [email protected].

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to address it first.

This site uses only the cookies our website platform needs to serve pages and to remember details you have already entered. We do not run advertising pixels. If we add analytics in future, this policy will be updated before it goes live.

If we change this policy we will update the date at the top of this page. Material changes affecting how we use your information will be notified to you directly where we hold your contact details.