Privacy Notice
Last updated: 13 October 2026
This notice explains how Heedly collects and uses personal data about the people it deals with: customers and users of the Heedly platform, people who contact us, visitors to heedly.co, and contacts in the veterinary industry.
Who we are
Heedly is a trading name of Matt Madden Photography Ltd, a company registered in England and Wales (company number 14664197), of 32 New Street, Leamington Spa, CV31 1HP. We are the controller of the personal data described in this notice under the UK GDPR and, where it applies, the EU GDPR.
Contact: Matt Madden, Director, [email protected].
What this notice does not cover
When a clinic uses the Heedly website platform, we also handle personal data about the clinic's own clients, such as pet owners who send an enquiry through the clinic's website. For that data the clinic is the controller and we act on its instructions under our Data Processing Agreement. If you are a clinic's client, please read the clinic's own privacy notice and contact the clinic to use your rights.
What we collect, why, and how long we keep it
| Who you are | What we collect | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|---|
| Customers, platform users and their staff | Names, job roles, work email addresses, phone numbers, login details, practice membership and account settings, records of sign-ins and security events, the Terms you accepted (including the version, date, time and IP address), invoices and payment records, and messages with our support team | To set up and run your account, keep it secure, give support, provide the AI features you use, bill you and keep our records | Contract; legal obligation (accounting and tax records); legitimate interests (running and securing the service, and giving the authorised users of our business customers access to the features they request) | While you are a customer, then 6 years for invoices and accounting records. Other account data is deleted within 24 months. |
| Visitors to heedly.co | IP address, device and browser details, pages viewed, how you arrived, and advertising click data. Our hosting also records server logs. | To keep the site working and secure, diagnose problems, measure what works and measure and retarget our advertising | Consent for analytics and advertising cookies; legitimate interests for security and server logs | Analytics data for 24 months. Server logs for up to 12 months. |
| People who download the playbook, request early access or send an enquiry | Name, email address, clinic name, website address, a phone number if you give one, and what you tell us. Where a form asks for consent, we also record your choice, the time and the wording shown to you. | To send what you asked for, reply to your enquiry, tell you when website builds open and, where you agreed, follow up with related emails | Legitimate interests (replying to you); steps you ask us to take before a contract; consent (follow-up emails to individuals, agreed on the form) | 24 months after our last contact, or until you ask us to stop. Correspondence about a contract is kept for up to 6 years after the contract ends. |
| Prospects and industry contacts | Name, job title, clinic, work email address and phone number, public details about the practice's website, and notes of our conversations | To contact vet practices about our services by phone and email, and to work with partners, journalists and event organisers | Legitimate interests (telling businesses that may need them about our services) | 24 months after our last contact, or until you ask us to stop |
We also use personal data where we need to comply with the law (for example accounting rules or a lawful request from an authority) and to establish, exercise or defend legal claims. Where we rely on legitimate interests, we have balanced those interests against your rights and concluded they are not overridden. You can ask us for details of that balancing.
Where prospect data comes from. We research practices online and collect business contact details from public sources, such as practice websites.
Calls and emails. We check call lists against the TPS and CTPS and stop contacting anyone who asks us to. We email individuals with their consent. We may email people at limited companies in their work capacity on the basis of legitimate interests. Every marketing email has an unsubscribe link, and you can also opt out by emailing [email protected]. When you opt out we keep a minimal suppression record so we do not contact you again. We transcribe meetings using Granola, and we take notes of calls.
Special category data. We do not ask for special category data, such as health information, and ask that you do not send it to us.
Who we share it with
We do not sell or rent personal data. We use these providers to run our business, and they handle data on our instructions under contracts that meet the requirements of data protection law:
| Provider | What we use it for |
|---|---|
| Cloudflare | Hosting and security for heedly.co |
| Email and files (Workspace), website analytics and advertising | |
| Meta | Measuring our advertising and building retargeting audiences through the Meta Pixel, where you have consented |
| TikTok | Measuring our advertising and retargeting through the TikTok Pixel, where you have consented |
| OpenAI | AI features in the Heedly platform. When a platform user uses an AI feature, we send the prompt and the relevant context, which can include messages, files, images, audio and information held in Heedly, through OpenAI's API to generate the response. |
| Postmark | Delivering emails we send, including the playbook and follow-up emails |
| DigitalOcean | Hosting for our own systems and databases |
| Stripe | Taking customer payments |
| Xero | Invoicing and accounting |
| Slack | Internal notifications, for example when a new customer signs up (owner name, email address and phone number) |
| Granola | Transcribing meetings and keeping notes of calls |
For building retargeting audiences through the Meta Pixel, we and Meta act as joint controllers for collecting and sending the data. Google, Meta and TikTok otherwise process advertising and analytics data under their own privacy policies, which are linked from our Cookie Policy.
We also share data with our accountants, insurers and legal advisers, where the law requires it, and with a buyer if our business is sold, in which case this notice will continue to apply to your data.
Google user data
Some features of the Heedly platform work by connecting to a veterinary practice's Google account. A practice chooses whether to grant this access when it sets up the relevant feature in its Heedly dashboard, and each connection asks only for the permissions that feature needs.
What we access and why
When a practice connects its Google account, Heedly may access the following, depending on the features the practice enables:
- Google Business Profile: the practice's business listing and its Google reviews, used to display those reviews on the practice's website and keep listing details current.
- Google Analytics: the practice's analytics property, which Heedly may create on the practice's behalf and read from, used to show website traffic inside the practice's Heedly dashboard.
- Google Search Console: the practice's search data, used to verify the practice's domain and show its search performance in the dashboard.
- Google Ads: campaign data for advertising run for the practice, used to report on those campaigns in the dashboard.
How we use it
Google user data is used only to provide these features to the practice that granted access, inside that practice's own Heedly dashboard and website. We do not use Google user data to build advertising profiles, we do not sell it, and we do not use it for purposes unrelated to the features described above. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Who can see it
Google user data is visible to the practice that connected the account and to authorised members of the Heedly team who support that practice. We do not share it with third parties, except with service providers that host our infrastructure and process data on our instructions, or where the law requires it. People at Heedly do not read this data except with the practice's permission, where necessary for security or to resolve a support issue, or to comply with the law.
Storage and retention
Google user data is stored on our secured servers and kept only for as long as it is needed to provide the connected feature. When a practice disconnects a Google integration or closes its account, we delete the associated Google data from our systems within 30 days, except where we must keep it to meet a legal obligation.
Revoking access
A practice can disconnect a Google integration at any time from its Heedly dashboard settings. Access can also be revoked directly from a Google account at myaccount.google.com/permissions. To ask us to delete Google data we hold, email [email protected].
Transfers outside the UK
We are based in the UK and some of our work is done from Spain. Several providers above are based in the US. Where your data is sent outside the UK or the EEA, we rely on an adequacy decision or the UK-US data bridge where the provider is certified, or otherwise on standard contractual clauses with the UK addendum or the UK International Data Transfer Agreement. You can ask us for details or a copy of the relevant safeguards.
Cookies
heedly.co uses cookies for analytics and advertising. We set them only after you accept them in the cookie banner. You can read more, and change your choice, in our Cookie Policy.
Your rights
You can ask us to show you the data we hold about you, correct it, delete it, restrict how we use it, or send it to you or another provider in a usable format. You can object to our use of your data, and we will always stop using it for direct marketing if you ask. Where we rely on your consent, you can withdraw it at any time. This does not affect what we did before you withdrew it.
To use any of these rights, email [email protected]. We reply within one month. For complex requests we may extend this by up to two further months, and we will tell you if we do. We may need to confirm who you are first. Using your rights is free unless a request is clearly unfounded or excessive.
If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113), or to the data protection authority where you live or work, for example the AEPD in Spain or Datatilsynet in Norway. We would appreciate the chance to put things right first.
Security
We limit access to personal data to the people who need it and use providers with appropriate security, including encrypted connections (HTTPS) and access controls. No transmission over the internet is completely secure. If a personal data breach is likely to put your rights at risk, we will tell the relevant supervisory authority and, where required, the people affected without undue delay.
Other things to know
We do not use your data to make decisions about you by automated means that have legal or similarly significant effects. Our services are for businesses, not children, and we do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
heedly.co links to other websites, such as our social media profiles. We do not control those websites and are not responsible for their privacy practices, so please read their privacy policies.
We will update this notice when our practices change, and the date at the top shows the latest version. If we make material changes, we will take reasonable steps to bring them to your attention.