Privacy Notice

Last updated 5 May 2026

This Privacy Notice for 19 Years Technologies Limited (doing business as 19 Years) ("we", "us", or "our") describes how and why we access, collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you:

visit our marketing website at https://www.nineteenyears.com or our practice management platform at https://app.19years.com, or any website of ours that links to this notice;
create an account or use the 19 Years platform; or
engage with us in any other related way, including marketing or events.

Questions or concerns? Reading this notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have questions, please contact us at privacy@19years.com.

Summary of key points

This summary covers the key points from our Privacy Notice. You can find more detail by following the link after each point or by using the table of contents.

Our role. For data we collect from visitors to our marketing website and from people who create an account with us, we are a data controller. For information about patients that our healthcare-professional customers enter into the 19 Years platform, we act as a data processor on the customer's instructions; if you are a patient, please direct privacy queries to your healthcare provider in the first instance. Learn more about our role.

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us, the choices you make, and the features you use. Learn more about personal information you disclose to us.

Do we process any special-category data? We process special-category data — most commonly health and financial information — only where a condition under Article 9(2) UK GDPR applies. For patient data this is normally Article 9(2)(h) (provision of health or social care). Learn more about special-category data.

How do we process your information? To provide, improve, and administer our Services, communicate with you, ensure security and prevent fraud, and comply with law. We process your information only when we have a valid legal basis. Learn more about how we process your information.

Who do we share information with? A short list of service providers (sub-processors) — including hosting, email delivery, payments and AI tooling — and parties involved in business transfers. Learn more.

International transfers. Some of our service providers are based outside the UK. We rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses for those transfers. Learn more.

How do we keep your information safe? We have appropriate organisational and technical measures in place. No system is perfectly secure, however, so we cannot guarantee that information will never be improperly accessed. Learn more.

What are your rights? Under UK GDPR you have rights including access, rectification, erasure, restriction, portability and objection. Learn more about your privacy rights.

How do you exercise your rights? Email privacy@19years.com. We will consider and act on each request in accordance with applicable data protection law.

Our role (controller / processor)
What information do we collect?
How do we process your information?
What legal bases do we rely on?
When and with whom do we share information?
International transfers
Cookies and tracking technologies
AI-based products
How long do we keep your information?
How do we keep your information safe?
Information from children
Your privacy rights
Do-Not-Track
Updates to this notice
How to contact us
Reviewing, updating or deleting your data

1. Our role (controller / processor)

In short: we are the controller of marketing-site and account data, and a processor of patient data on behalf of our healthcare-professional customers.

For information collected from visitors to our marketing website and from individuals who create an account with us, we are a data controller and decide how that information is used.

For information about patients that our healthcare-professional customers enter into the 19 Years platform, we are a data processor. The healthcare professional (or their practice) is the controller of that data and decides what is collected and why; we process it on their documented instructions under a Data Processing Agreement. If you are a patient, please direct privacy queries to your healthcare provider in the first instance — they are best placed to answer them.

2. What information do we collect?

Personal information you disclose to us

In short: we collect personal information that you provide to us.

We collect personal information that you voluntarily provide when you register for the Services, request information about us or our products, take part in activities on the Services, or contact us. The personal information we collect may include:

names;
email addresses;
phone numbers;
postal and billing addresses;
contact preferences; and
account authentication data.

Special-category data

We process the following categories of special-category data only where a condition in Article 9(2) UK GDPR applies (most commonly Article 9(2)(h) — provision of health or social care — when our customers process patient data through our Services):

health data; and
financial data.

Payment data

If you make a purchase, we collect the payment information needed to process it. Card and bank details are handled and stored by our payments processor under PCI-DSS-compliant terms; we do not retain full card numbers ourselves.

All personal information you provide to us must be true, complete and accurate, and you must notify us of any changes.

Information automatically collected

In short: some technical information — such as your IP address and browser characteristics — is collected automatically when you visit our Services.

Like most websites, we automatically collect certain information when you visit, use or navigate the Services. This information does not directly identify you but may include device and usage information such as IP address, browser and device characteristics, operating system, language preferences, referring URLs, country, information about how and when you use our Services, and other technical information. This is needed to maintain the security and operation of our Services and for our internal analytics and reporting.

Specifically, we may collect:

Log and usage data — service-related, diagnostic, usage and performance information that our servers automatically record (e.g. timestamps, pages viewed, error reports).
Device data — information about the device you use to access the Services (e.g. IP address, device identifiers, browser type, operating system).

3. How do we process your information?

In short: we process your information to provide and improve our Services, communicate with you, ensure security and fraud prevention, and comply with law.

We process your personal information for the following reasons:

To create and manage your account — so you can register, sign in and keep your account in working order.
To deliver the Services — to provide the products and features you have asked for.
To respond to your inquiries — to answer questions and resolve any issues you raise.
To send administrative information — about changes to our terms, policies and product, and other operational messages.
To request feedback — when relevant, to improve the Services.
To protect our Services — including fraud monitoring and prevention.
To identify usage trends — to understand how the Services are used so we can improve them.
To comply with legal obligations — including tax, accounting, regulatory and law-enforcement requests.
To protect vital interests — where necessary to prevent harm to a person.

4. What legal bases do we rely on?

In short: we only process your personal information when we have a valid lawful basis under UK GDPR.

We may rely on the following Article 6 UK GDPR bases:

Consent. Where you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time — see withdrawing your consent.
Performance of a contract. Where processing is necessary to provide the Services to you, or to take steps at your request before entering a contract.
Legitimate interests. Where processing is reasonably necessary for our legitimate business interests and your rights do not override them — for example, to keep the Services secure, diagnose problems, prevent fraud, and improve the user experience.
Legal obligations. Where processing is necessary to comply with a legal obligation, cooperate with a regulator or law-enforcement body, or exercise or defend legal rights.
Vital interests. Where processing is necessary to protect a person's life or physical safety.

Special-category data (health information). Where we process health information about patients of our healthcare-professional customers, we do so as a processor on the customer's documented instructions. The customer is the controller and relies on Article 9(2)(h) UK GDPR (provision of health or social care) together with the conditions in Schedule 1, Part 1 of the Data Protection Act 2018. Where we process health information as a controller (for example, about you in your capacity as a healthcare professional), we rely on Article 9(2)(h) on the same basis, or your explicit consent under Article 9(2)(a) where required.

5. When and with whom do we share information?

In short: we share information with vetted service providers who help us run the Services, and in limited other circumstances described below.

We may share your personal information in the following situations:

Service providers (sub-processors). We share personal information with third parties that process it on our behalf under written agreements. Current categories include hosting and infrastructure, transactional email delivery, payments processing, and AI text and speech providers. A current named list is available on request to privacy@19years.com.
Business transfers. We may share or transfer information in connection with a merger, sale of company assets, financing or acquisition of all or part of our business.
With your consent. Where you have asked us or agreed for us to.
Legal requirements. Where required by law, regulation or legal process, or to protect the rights, property or safety of any person.

6. International transfers of your information

In short: some of our service providers are based outside the UK; where personal information is transferred internationally we use the UK International Data Transfer Addendum to the EU SCCs.

We are based in the United Kingdom. Some of the service providers that help us deliver the Services process personal information outside the UK and the EEA, including:

our payments processor — United States and Ireland;
our AI text provider — United States;
our AI speech provider — United States;
our transactional email provider — United States;
our hosting and infrastructure provider — primarily within the UK and EEA.

Where personal information is transferred outside the UK we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses (or, for transfers from the EEA, the EU Standard Contractual Clauses). We carry out a transfer risk assessment for each recipient. A summary is available on request to privacy@19years.com.

7. Cookies and tracking technologies

In short: we use only strictly-necessary cookies. We do not use analytics or advertising cookies on this website.

Our website uses a small number of strictly-necessary cookies that are required for the site to function (for example, to remember security tokens and session state). We do not set analytics, advertising or social-media tracking cookies, so we do not display a cookie consent banner. If we introduce non-essential cookies in future, we will update this notice and ask for your consent first.

8. AI-based products

In short: parts of our Services use AI features delivered through specialist text and speech providers, under contracts that prohibit use of customer content for training and provide UK-compliant transfer terms.

As part of our Services we offer features powered by artificial intelligence, machine learning, and similar technologies (collectively, "AI Features"). The terms of this Privacy Notice govern your use of those features.

We provide AI Features through specialist third-party service providers (currently one provider for text features and one for speech features). When you use an AI Feature, your input and the resulting output may be shared with and processed by these providers solely to deliver the feature.

We use these providers under enterprise / API agreements that:

prohibit the use of our customer content for training their foundation models;
include the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; and
impose contractual confidentiality obligations.

We do not use AI to make decisions producing legal or similarly significant effects about you without human review (Article 22 UK GDPR).

9. How long do we keep your information?

In short: only for as long as we need it for the purposes set out in this notice, with specific periods below.

We retain personal information only for as long as necessary for the purposes set out in this notice, unless a longer retention period is required or permitted by law. Indicative periods:

Marketing-site enquiries (demo requests, contact forms): 24 months from last contact.
Account data for customers and authorised users: lifetime of the account, plus 30 days after closure.
Billing and tax records: 6 years after the end of the relevant accounting period (UK statutory minimum).
Patient clinical data: retained for the period instructed by our healthcare-professional customer (the controller). On termination of the customer's account we return or delete the data as set out in the Data Processing Agreement.
Backups: routinely overwritten on a 35-day rolling cycle.

When we no longer have an ongoing legitimate business need to process your personal information, we will either delete or anonymise it, or — if that is not immediately possible (for example because it is held in backup) — securely store it and isolate it from further processing until deletion is possible.

10. How do we keep your information safe?

In short: we use appropriate organisational and technical measures, but no system is perfectly secure.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the personal information we process. However, despite these safeguards, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Although we do our best to protect your personal information, transmission to and from our Services is at your own risk; you should only access the Services within a secure environment.

11. Information from children

In short: our marketing website is not directed at children under 13.

Our marketing website is not directed at children under 13, and we do not knowingly collect personal information from children through it. Healthcare professionals who use our platform may, in the course of providing care, enter information about patients of any age; that information is processed under the customer's instructions as controller, and the customer is responsible for the appropriate consent and lawful basis.

If you believe we have inadvertently collected information from a child via our marketing website, please contact us at privacy@19years.com and we will take reasonable steps to delete it.

12. Your privacy rights

In short: in the UK and the EEA you have rights including access, rectification, erasure, restriction, portability and objection.

Under UK GDPR (and in the EEA, the EU GDPR) you have certain rights regarding your personal information. These include the right to:

request access to and a copy of your personal information;
request rectification or erasure of inaccurate or no-longer-needed information;
restrict processing of your personal information in certain circumstances;
data portability where applicable;
object to processing based on legitimate interests; and
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

You can exercise any of these rights by emailing privacy@19years.com. We will consider and act on each request in accordance with applicable data protection law.

If you are located in the UK and believe we are unlawfully processing your personal information, you have the right to complain to the UK Information Commissioner's Office (ICO). If you are located in the EEA, you may complain to your national supervisory authority.

Withdrawing your consent. If we are relying on your consent to process your personal information, you can withdraw that consent at any time by contacting us at privacy@19years.com or by updating your account preferences. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, nor processing carried out on a basis other than consent.

Account information

If you would like to review or change your account information, or to terminate your account, you can:

On request to terminate your account, we will deactivate or delete your account and information from our active databases. We may retain limited information to prevent fraud, troubleshoot problems, assist with investigations, enforce our legal terms, or comply with legal obligations.

13. Controls for Do-Not-Track features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature you can activate. No uniform technology standard for recognising and implementing DNT signals has been finalised, so at present we do not respond to DNT signals. If a standard is adopted that we are required to follow, we will update this notice accordingly.

14. Updates to this notice

In short: yes, we will update this notice as needed.

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised "Last updated" date at the top of this notice. If we make material changes, we may notify you by prominently posting a notice on our website or by sending you a direct notification. We encourage you to review this notice periodically.

15. How to contact us

If you have questions or comments about this notice, you can reach our privacy team by email at privacy@19years.com, or by post at:

19 Years Technologies Limited
Privacy Contact
71-75 Shelton Street
London WC2H 9JQ
United Kingdom

Data Protection Officer. We have appointed a Data Protection Officer who you can contact about any aspect of this notice or how we handle personal information at dpo@19years.com.

19 Years Technologies Limited is registered in England and Wales (company number 15383116) and is registered with the UK Information Commissioner's Office under reference ZB756755.

16. How to review, update or delete the data we collect from you

You may have the right to request access to the personal information we hold about you, details of how we have processed it, correction of inaccuracies, or deletion of your personal information. You may also have the right to withdraw your consent to our processing. These rights may be limited in some circumstances by applicable law.

To make a request, email privacy@19years.com. We may need to verify your identity before acting on your request.