Privacy

Taaya is a patient concierge for aesthetics clinics, built by Avedd Limited. This page explains what we do with personal data, in two parts: the data we hold as a business, and the patient conversations we handle on behalf of clinics. Those are different roles under UK data protection law and it matters which is which.

Who we are

Avedd Limited is the company behind Taaya, registered with the Information Commissioner's Office as a data controller, reference ZC202793. Write to hello@taaya.io for anything on this page, including a request to exercise your rights.

Two different roles

For our own business data we are the controller. That means people who contact us, clinics we talk to, and visitors to this website.

For patient conversations we are a processor. When a clinic uses Taaya, the clinic decides why and how patient data is used. They are the controller; we act on their documented instructions under a written data processing agreement. If you are a patient and want your data removed, ask the clinic. If they ask us, we act.

This website

This site sets no cookies, runs no analytics, and makes no third-party requests. We do not track you, profile you, or build an advertising audience. Our hosting provider, Cloudflare, processes your IP address transiently to serve the page and protect against abuse.

If you contact us

We keep your name, email address and what you wrote, so that we can reply and keep track of a conversation. Our lawful basis is legitimate interests: you contacted us and expect an answer. We keep it while the conversation is live and for up to two years after, then delete it.

Patient conversations, handled for clinics

When a clinic runs Taaya, patients may share their name, contact details, the treatment they are asking about, when they are free for an appointment, and sometimes information about their health. Health information is special category data under UK GDPR and we treat it that way.

Where a clinic has asked us to, we also hold whether a patient agreed to aftercare messages and whether they agreed to be contacted again later. Those are recorded separately and honoured separately: someone can want a safety check after treatment without wanting to hear from the clinic six months on.

We use it only to answer the enquiry in the clinic's voice, to pass a conversation to clinic staff when it needs a person, to send aftercare messages the clinic has approved, and to give the clinic a summary of what happened. Where a patient says unprompted that they are happy with a completed treatment, Taaya may offer the clinic's review link once. It is never offered after a complaint. We do not sell it, share it for advertising, or use it to train any model outside that clinic's own setup.

Taaya never makes a clinical judgement. It does not decide whether a treatment suits anyone, interpret symptoms, or give medical advice. When a conversation touches those things it stops and hands over to the clinic.

No decision about anyone is made automatically. Taaya drafts replies and flags conversations for a person. It does not decide who is treated, what they are charged, or whether they are suitable for anything, so there is no automated decision-making with legal or similarly significant effects.

Who else processes data

We use these sub-processors. Clinics are told before we add or change one.

Patient conversations are stored in the United Kingdom. The database holding them sits in London and does not leave the UK. Replies are generated by a provider in the United States, so the words of a message travel there to be answered; nothing is stored there.

Where a provider is outside the UK, transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on adequacy where it applies. We have agreements in place that prohibit providers from using clinic or patient data to train their own models.

How long we keep things

Patient conversations are kept for as long as the clinic instructs, and no longer. Where a clinic gives no instruction the default is 12 months, after which conversations are deleted. Business contact data is kept for up to two years after our last exchange. When a clinic stops using Taaya we delete or return their data within 30 days of being asked.

Every conversation is written into a tamper-evident record, so a clinic can show what was said and prove it has not been altered. When a patient asks to be erased we remove their words; what remains is the fact that a conversation happened and could not be quietly rewritten. That is deliberate: a clinic still needs to answer for what its concierge said, and a record that can be silently edited protects nobody.

Your rights

You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. If we hold your data on behalf of a clinic, ask the clinic first and they will instruct us. We respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would rather you told us first so we can fix it.

Security

Data is encrypted in transit and at rest by our providers. Access is limited to those who need it. This site enforces HTTPS and a strict content security policy. We are a small company and do not pretend to hold certifications we do not have: we hold ICO registration, and we will say so plainly if and when that changes.

Changes

If we change anything material here we will tell clinics directly rather than relying on you noticing a new date at the top of this page.

Company details

Avedd Limited is a private limited company registered in England and Wales, company number 15399895. Our registered office address is available from Companies House.