A plain summary of what personal data Omnera processes, on what basis, where it lives, how long it is kept, and how to ask for a record to be reviewed or removed. The privacy policy is the authoritative document.
The controller is Omnera Data Group Ltd, registered in England & Wales (company number 16317711) and with the Information Commissioner's Office under registration reference ZC047753.
Most of what Omnera holds is about clinics, not people. Where a record names a person, this is the basis for it.
Omnera lists the practitioners a clinic names on its own website, with the role or profession the site gives them, and where a name matches a UK professional register (GMC, GDC, GPhC) it records that match. The lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): accurate, verifiable business-to-business intelligence about commercially active clinics and the qualifications they publicly advertise. Only information already published in a business context is processed; no special category data is collected; a name an AI model suggests but the clinic's site does not show is discarded. Practitioners can ask for their record to be reviewed or removed at any time (below).
For the company matched to each clinic, Omnera holds what the Companies House public register publishes about its officers: name, role, appointment and resignation dates, and month and year of birth. It is used to record director changes as dated change events and to derive flags and bands on the clinic (founder-led, years trading, a retirement-window band) and, inside licensed deal-team workspaces, to show each company's directors as the register lists them: name, role and appointment dates, with a five-year age band in place of the month and year of birth. The lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): the register exists so that those dealing with a company can see who runs it, and that is the only use made of it. Month and year of birth are never shown, no officer is shown outside the context of the company, exports never carry an officer's name, and the licence terms prohibit using Omnera to contact an individual officer. An officer can ask for the record to be reviewed at any time (below).
Where a practitioner a clinic names on its own site has the same name as an officer of the company matched to that clinic, Omnera links the two. The link combines two public sources, so it is treated as its own processing activity: a match below 80% confidence is held for a person to review and is not used until confirmed, and the link surfaces only as a founder-led flag on the clinic, never as a personal record. Nothing is inferred about a person beyond what the clinic and the register each already publish.
When you upload a list, you are the controller and Omnera is the processor. A DPA is signed before the first upload. These are its load-bearing terms.
We notify you without undue delay, and in any event within 24 hours, of becoming aware of a personal data breach affecting your data.
That leaves you time to meet the 72-hour ICO notification deadline under Article 33 where it applies; we provide what you need for the notification.
Application, database, cache and backups run in Render's Frankfurt (EU) region, covered by the UK-EU adequacy decision. No customer list leaves it.
On termination, processing of your data stops and it is deleted within 30 days. Subprocessor changes are notified 30 days ahead; audits can be requested on 30 days' notice.
Your list is used only to match it to the record and to monitor the matched rows. It is never shared with, or visible to, another customer, and it is never used to improve the record itself. The full DPA, the subprocessor list, the security architecture overview and the incident response plan are supplied with every engagement. Business insurance, including cyber cover, is held with Hiscox Insurance Company Limited; a summary is available on request.
| Data | Kept for | Why |
|---|---|---|
| Customer lists (accounts, borrower books, merchant and customer lists you upload) | 30 days after the licence ends | Deleted by a scheduled job; a deletion confirmation is available on request. |
| Alert files delivered to you | 12 months | Kept so a past alert can be re-issued or audited. |
| Delivery log (what was delivered, to whom, when, with a checksum) | 6 years | Contractual record; contains no clinic data itself. |
| Observations of clinics (crawls, listings, register states) and their change history | Indefinitely | Public, business-context data. This history is what the drift report and every dated figure rest on. |
| Company officer data for companies matched to a clinic | While the company is matched to a clinic | Public register data, refreshed from Companies House; a resigned officer stays only as a dated resignation event. |
If you are a practitioner or a clinic owner and would like information about you reviewed, corrected or removed, email info@omnera.co.uk. We respond in line with your rights under UK GDPR and Data Protection Act 2018, as set out in the privacy policy.