Legal

Data Protection Complaints

Last updated: June 2026 · Effective: June 2026

This page explains how to complain to Sanctum if you are unhappy with how we have handled your personal data, and how we will deal with your complaint. If your complaint is about the Sanctum software service itself - billing, availability, support or an account issue - please use our Service Complaints page instead. If it involves both, we will handle each part under the right procedure and tell you which is which.

Under the Data (Use and Access) Act 2025, alongside the UK GDPR and the Data Protection Act 2018, we will facilitate your complaint, acknowledge it within 30 days, and respond without undue delay.

1. Who can complain

Anyone whose personal data we process can complain, including:

Practitioner users (our customers) - we are the Data Controller for your account data and answer your complaint directly.
Patients and other individuals whose data flows through the platform - for this data your practitioner is usually the Data Controller and we act as their Data Processor. We will still log your complaint and put you in touch with the responsible practitioner so it reaches the right organisation.
Website visitors and enquirers whose data we collect directly.

The platform handles health information, which is special category data. We treat complaints involving health data as high priority and never discuss them over an unverified channel.

2. How to complain

Use whichever route suits you - we accept them all:

Email: [email protected] (preferred)
Form: complete and send the complaint form at the bottom of this page
Post: Data Protection Lead, Sanctum Technologies Ltd, 23 Warren Place, Brownhills, Walsall, WS8 6BY

You do not need to use a special form or the word "complaint" - if you tell us you are unhappy about how we handle your data, we treat it as a complaint.

3. What happens next

We log it and give your complaint a reference.
We acknowledge it in writing - within 5 working days where we can, and within 30 days at the latest.
We investigate, gathering the relevant records.
We respond in writing without undue delay - usually within one calendar month - explaining what we found, what we will do, and how to escalate. If a case is genuinely complex and needs longer, we tell you why and give a revised date.

4. Our timescales

Stage	We aim for	At the latest
Acknowledge your complaint	5 working days	30 days
Full written response	1 calendar month	Without undue delay; longer only if complex, with an explanation

5. If you are still not satisfied

You can complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator:

Online: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

The ICO may ask whether you have raised your complaint with us first, so please do give us the chance to put things right.

Data protection complaint form

Fill this in, then either print it (or save it as a PDF) to keep or post, or email the details to [email protected]. Printing prints only this form and keeps anything you have typed.

Your details

Full name

Email address

Phone (optional)

I am a… Practitioner (Sanctum customer) Patient Website visitor Other

If you are a patient: which practitioner / practice processes your data?

Your complaint

What has happened? (how do you believe your personal data was mishandled?)

When did it happen, or when did you become aware?

What personal data is involved? (e.g. contact details, health information)

What would you like us to do to put it right?

Declaration

I confirm the information above is accurate to the best of my knowledge.

Date

Questions about a complaint?

Email [email protected]. See also our Privacy Policy and our Service Complaints procedure.