Last updated: November 2026 · Effective: November 2026
Sanctum ("we", "us", or "our") is committed to protecting your privacy and handling all personal data responsibly, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy explains how we collect and use the personal data of practitioner users (people who sign up for a Sanctum account). If you are a patient whose data is processed through the platform, your practitioner is the Data Controller responsible for your data - please contact them directly with any queries.
Sanctum is operated by Sanctum Technologies Ltd, a company registered in England and Wales (company number 17136722), whose registered address is 23 Warren Place, Brownhills, Walsall.
ICO Registration: ZC115837
Data protection contact: [email protected]
When you use Sanctum to manage patient communications, you are the Data Controller and we are the Data Processor acting on your instructions. The patient data we process on your behalf includes:
Our obligations as your Data Processor are set out in the Data Processing Agreement, which forms part of your contract with us.
| Purpose | Lawful basis |
|---|---|
| Providing and operating your Sanctum account | Performance of contract (Art. 6(1)(b)) |
| Sending account notifications and approval alerts | Performance of contract (Art. 6(1)(b)) |
| Billing and subscription management | Performance of contract (Art. 6(1)(b)) |
| Responding to support requests | Legitimate interests (Art. 6(1)(f)) |
| Improving and developing the platform | Legitimate interests (Art. 6(1)(f)) |
| Security monitoring and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
The platform uses Claude, an AI model developed by Anthropic, to process patient messages and generate draft responses. We run Claude through Amazon Bedrock, Amazon Web Services' AI service, in AWS's EU regions only (using EU-only inference). Message content is processed inside the EU by AWS and is not sent to Anthropic. Before any content reaches the AI model, we apply a technical layer that removes or pseudonymises directly identifying information (patient names and contact details).
Your patient data is not used to train AI models. Under AWS's terms for Amazon Bedrock, prompts and responses are not used to train any model and are not shared with the model provider.
If you choose to connect a Gmail mailbox, Sanctum asks Google for permission to access that mailbox (the https://mail.google.com/ scope). This is the only Google permission we request. We use it to:
Message content from Gmail is handled in the same way as any other patient message, including the AI processing described in section 5: identifying details are removed or pseudonymised before any content is sent to the AI model.
We do not use Gmail data for advertising, we do not sell it, and we do not use it to train AI models (ours or anyone else's). Nobody at Sanctum reads your messages unless you ask us to for support, unless it is needed for security or to comply with the law, or unless the data has been aggregated and anonymised for internal operations.
The access and refresh tokens Google gives us are stored encrypted. When you disconnect the mailbox in Settings, the connection and its tokens are deleted. You can also remove Sanctum's access at any time from your Google Account, under Security, then Third-party apps with account access.
Sanctum's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not sell your data or your patients' data to anyone. We share data only with the following sub-processors, each bound by a data processing agreement:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database hosting and storage | UK (London) |
| Fly.io | Runs the application and API | UK (London) |
| Cloudflare | Web security and traffic routing | Global, nearest the user |
| Sentry | Error monitoring, patient data stripped | EU (Germany) |
| Amazon Web Services | Encryption key management (AWS KMS) | UK / EU |
| Amazon Web Services (Amazon Bedrock) | AI message processing (Claude) | EU |
| Twilio | SMS delivery | United States |
| Stripe | Payment processing | United States |
| Brevo (Sendinblue SAS) | Transactional email delivery | EU (France) |
The full sub-processor list, including transfer mechanisms, is available at sanctum.support/sub-processors.
Some of our sub-processors are based in the United States, which does not have an automatic adequacy decision from the UK. For these transfers, we use the UK International Data Transfer Agreement (IDTA) - a standard contract approved by the ICO that requires the recipient to protect your data to UK GDPR standards.
Specifically:
We protect your data using:
| Data type | Retention period |
|---|---|
| Practitioner account data | Duration of subscription + 6 years |
| Patient clinical records and health notes | 8 years from last entry (UK health records minimum) |
| Patient message and conversation history | 3 years from last message |
| Patient satisfaction surveys | 3 years (aggregate anonymised statistics retained indefinitely) |
| Audit logs | Retained for the duration of the platform |
| Backups | Maximum 30 days behind live data |
When your account is closed, your account data and all patient data will be exported to you or deleted within 30 days, at your election.
Under UK GDPR you have the right to:
To exercise any of these rights, email [email protected]. We will respond within one calendar month.
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right - see our Data Protection Complaints procedure for how to complain and how we respond. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint (helpline 0303 123 1113).
Our marketing website uses no tracking or analytics cookies. The Sanctum application uses session cookies strictly necessary for authentication. We do not use advertising cookies or share data with ad networks.
We may update this policy from time to time. We will notify practitioner account holders of material changes by email with at least 14 days' notice before changes take effect. The current version is always available at this URL.
Email us at [email protected]. We aim to respond within 5 business days, and are required to respond within one calendar month for formal rights requests.