Privacy Policy

Emerge 21 Ltd · Effective date: 17 July 2026 · Replaces the policy dated 24 September 2024

Introduction

Emerge 21 Ltd ("Emerge 21", "we", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share personal information when you use our services.

Emerge 21 Ltd is a company registered in Northern Ireland (company number NI718071), with its registered office at Ground Floor, Gallery Building, 65-69 Dublin Road, Belfast, BT2 7HG.

We operate in two distinct capacities, and it is important to understand which applies to you:

• As a data controller: for people who use our own websites, products and services directly. Here we decide what data is collected and why.
• As a data processor: for our Recallist platform, which is used by optical practices. Here the practice decides what data is collected and why, and we act only on their instructions. If you are a patient of a practice that uses Recallist, your practice is the data controller of your information, not Emerge 21. See section 6.

1. Data we collect as a controller

Where we act as a data controller, we may collect the following types of personal data:

• Contact details (for example, name and email address)
• Payment information, where you purchase from us. For our Bitcoin-native products, this may include Bitcoin payment details
• Information relating to your use of our services

2. Data we process on behalf of business clients (Recallist)

Emerge 21 Ltd operates Recallist, a patient recall and appointment booking platform used by optical practices. When a practice uses Recallist, we process personal data on their behalf and on their documented instructions. In these cases the practice is the data controller and Emerge 21 Ltd is the data processor.

2.1 What we process

The personal data we process on behalf of a practice may include:

• Patient name
• Patient contact details (mobile telephone number)
• Appointment and recall due dates
• Message history between the patient and the practice's automated assistant
• Opt-out and communication preferences

We do not process patients' clinical records or optical prescriptions.

2.2 How we use it

Where we act as a processor, we use personal data only as instructed by the practice, and for no other purpose. Specifically:

• We do not use patient data to train artificial intelligence models
• We do not use patient data for our own marketing
• We do not sell patient data, and we do not share it with any party other than the sub-processors listed in section 4.1
• We do not combine patient data from one practice with that of another

2.3 Automated messaging

Recallist sends messages to patients on behalf of practices by SMS and WhatsApp, and uses an automated assistant to handle replies and arrange appointments. Messages sent through Recallist identify themselves as coming from an automated assistant. A patient can opt out at any time by replying STOP, and can ask to speak to practice staff instead.

2.4 Retention

Retention periods for patient data are set by each practice as data controller and recorded in our data processing agreement with them. We retain data only for as long as the practice instructs, and delete or return it on termination of the agreement. Opt-out records are retained for as long as necessary to ensure a patient who has opted out is not contacted again.

3. Use of data as a controller

Where we act as a data controller, we use your personal data for the following purposes:

• To provide our services to you
• To process payments and manage orders
• To send marketing communications, with your consent
• To comply with legal obligations

4. Data sharing

We will never sell your personal data. We may share your data with:

• Third-party service providers, including for payment processing
• Legal authorities, if required by law

4.1 Sub-processors (Recallist)

Where we process personal data on behalf of a practice, we use the following sub-processors:

We maintain written agreements with each sub-processor requiring them to protect personal data to the same standard set out in this policy. We notify practices in advance of any intended change to our sub-processors.

5. Data storage and security

We store personal data securely and take appropriate technical and organisational measures to protect it from unauthorised access, alteration, or destruction. Where we act as a controller, we retain personal data only for as long as necessary to fulfil the purposes set out in this policy. Where we act as a processor, retention is governed by section 2.4.

6. Your rights

6.1 If you deal with us directly

Where we act as a data controller, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal requirements)
• Withdraw your consent to marketing communications at any time
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk)

6.2 If you are a patient of a practice using Recallist

Your optical practice is the data controller for your information. To exercise your rights, including access, correction, deletion, or stopping messages, please contact your practice directly.

You can also reply STOP to any message you receive to opt out immediately. We will act on any instruction we receive from your practice regarding your data, and we will pass on to your practice any request you send to us.

7. Cookies

We use cookies to improve user experience and analyse website traffic. You can adjust your browser settings to refuse cookies, though this may impact your experience.

8. Updates to this policy

We may update this policy periodically. Changes will be posted on our website, and continued use of our services indicates your acceptance of the updated policy. Where we act as a processor, material changes affecting practices will be notified to them directly under our data processing agreement.

9. Contact us

For questions or concerns regarding your data, please contact us at: support@emerge21.com

Emerge 21 Ltd, Ground Floor, Gallery Building, 65-69 Dublin Road, Belfast, BT2 7HG. Registered in Northern Ireland, company number NI718071.

If you are a patient of a practice that uses Recallist, please contact your practice in the first instance: they are the controller of your data.