Privacy Policy
Last updated 9 November 2026
1. Who we are and who is responsible for what
We hold only what we need to sell you The Consult Method and run your account, and we never receive your clients' information.
The Consult Method is provided by Demi Louise Miles-Kindon, trading as By Demi, of Middlemore Lane, Aldridge, Walsall, WS9 8SP. Contact us about privacy at demi@thebusinessconsultant.info. ICO registration number: [number].
This policy covers:
- practitioners who buy and use The Consult Method: we are the data controller for your account, purchase and support information
- your clients: their consultations, records, forms and photos are saved only on your own device. We never receive them, so we are neither their controller nor their processor. You, the practitioner, are the controller (see section 3)
2. What we hold about you, and why
| What | Examples | Why we hold it | Lawful basis |
|---|---|---|---|
| Purchase details | Name, email address, what you bought, date, amount | To give you access and keep tax records | Contract; legal obligation |
| Account details | Email address, password (stored encrypted by our login provider; we cannot see it), access code used | To let you sign in securely | Contract |
| Your library and settings | Clinic name, logo, brand colours, contact details, booking link, prices, the products and treatments you add or edit | So your builder is the same each time you sign in, on any device | Contract |
| Support messages | Emails or messages you send us | To answer you and fix problems | Legitimate interests |
| Technical information | IP address, browser type, error logs kept by our hosting and login providers | To keep the service secure and working | Legitimate interests |
Updates and news. We email you about your account, important changes and service notices. We send marketing emails only if you have opted in, and you can unsubscribe at any time.
We do not sell your information, use it for advertising, or use it to make automated decisions about you.
3. Your clients' information
Client information stays on your device. Client records, consultations, consultation and consent forms, signatures and progress photos are saved in the browser storage of the device you use. They are not uploaded to us or to any of our providers, and we cannot see, recover or delete them.
Client plan links. When you copy a client plan link, the client's first name, routine, product details and treatments are written into the link itself. Nothing is stored on our servers. When your client ticks off their routine, those ticks are saved on their own phone only. Anyone with the link can open the plan.
PDFs and images. Plans, forms and before-and-after images are made on your device and saved to your device. We do not receive copies.
Your responsibilities. As the controller for your clients' information, you need your own privacy notice for clients, their explicit consent for health details and photographs, secure devices and regular secure backups. Our Terms explain this in section 5.
4. Who processes data for us
We use these providers to run The Consult Method. Each one handles your information only to provide its service to us.
| Provider | What it does | Where |
|---|---|---|
| ThriveCart, and Stripe as its payment processor | Checkout and payment | United States |
| Google Firebase | Sign-in, and storing your library and settings | Settings stored in the London (europe-west2) region; sign-in may be processed in the United States |
| Netlify | Hosting the website | United States and global network |
| [Email provider, e.g. Flodesk] | Sending access details and updates | [Location] |
| Google Fonts and Cloudflare cdnjs | Loading the fonts and the PDF tool when you open the builder | Global network. They receive your IP address |
| Retailers' image servers (such as Boots) | Showing product photos in the library | United Kingdom. They receive your IP address |
International transfers. Where a provider processes data outside the UK, the transfer is covered by UK-approved safeguards, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum in the provider's terms.
Cookies and browser storage. We do not use advertising or tracking cookies. The builder uses your browser's storage to keep you signed in, remember your settings and save your client records on your device. This storage is essential for the builder to work, so we do not ask for consent to use it. Clearing your browser data removes it, including client records you have not backed up.
5. Keeping it, protecting it, and your rights
How long we keep it.
| Information | How long |
|---|---|
| Account, library and settings | While your account is open, and deleted within 90 days of you asking us to close it |
| Purchase records | 6 years from the end of the tax year of purchase, as UK tax law requires |
| Support messages | 2 years from our last reply |
| Technical logs | As set by our providers, usually 30 to 90 days |
Security. Your account is protected by a password and your library is stored with access limited to your account only. Information travels over encrypted connections. No system is completely secure, so use a strong password that you do not use anywhere else.
Your rights. You can ask us to:
- give you a copy of the information we hold about you
- correct anything that is wrong
- delete your information, where we do not need to keep it by law
- restrict or object to how we use it
- give you your information in a format you can move elsewhere
Email demi@thebusinessconsultant.info. We will reply within one month.
Complaints. If you are unhappy with how we have handled your information, please tell us first at demi@thebusinessconsultant.info. We will acknowledge your complaint within 30 days and tell you what we are doing about it. If you are still not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes. We will update this policy when how we handle information changes, and email you about important changes.