How DBX ONE handles information.

1. Who this notice applies to

This notice applies to people who visit the DBX ONE website, contact DBX ONE, apply for a report, send supplier invoice files or receive communications about a DBX ONE submission.

2. Controller and processor roles

For website enquiries, contact details, application details and direct communications, DBX ONE is responsible for how that information is used.

For invoice files submitted by a practice or clinic so that DBX ONE can prepare a requested report, the organisation normally decides what is submitted and why. In that situation, DBX ONE handles the invoice files on the organisation’s instructions and the Data Processing Agreement explains the processor terms in more detail.

3. Information DBX ONE may collect

• Contact details, such as name, organisation name, role, email address and message content.
• Application details, such as organisation type, notes, requested custom metrics and submission date.
• Supplier invoice files and related supplier emails sent for the report.
• Technical information needed to operate the website and upload process, such as timestamps, file names, file sizes and basic server logs.
• Report outputs, correspondence and operational notes needed to deliver the requested service.

4. Information DBX ONE does not need

DBX ONE does not need patient records, clinical documents, prescriptions, referrals, test results or patient-identifiable information. Supplier invoices can also contain unnecessary information, so practices are encouraged to remove or redact information that is not needed for the report, such as bank details, account numbers, staff names, handwritten notes or unrelated attachments where practical.

5. Why information is used

• To respond to enquiries and applications.
• To receive and organise supplier invoices.
• To prepare the requested DBX ONE report, including requested custom metrics where the invoice data supports them.
• To contact the submitting organisation about the report, file issues, clarification or follow-up questions.
• To keep basic records of submissions, deletion requests and service communications.
• To protect the website, storage, email account and report process from misuse or security incidents.

6. Lawful basis

For business enquiries, applications and report communications, DBX ONE generally relies on legitimate interests in responding to requests, operating the service and keeping appropriate business records. Where a report is requested or discussed as a service, processing may also be necessary to take steps before entering into a contract or to perform a contract.

Where DBX ONE processes invoice files on behalf of a practice or clinic, the submitting organisation is normally responsible for identifying its own lawful basis for the information it chooses to send. DBX ONE handles the files for the requested report and under the DPA terms.

7. AI and model training

Customer invoice data is not used to train shared or general AI models and is not reused for other clients. Any AI-assisted review is used to support the requested DBX ONE report only.

8. Sub-processors and suppliers

DBX ONE may use service providers for hosting, file storage, email delivery, security, AI-assisted processing or operational tools. The current sub-processor position is set out on the Confidentiality page and in the DPA. Sub-processors must be used only for the service and with appropriate confidentiality and security protections.

9. International transfers

DBX ONE aims to keep hosting and storage in UK/EU-aligned environments where practical. Some technology providers may process limited information outside the UK or EEA. Where this happens, DBX ONE expects appropriate safeguards to be in place through the relevant provider terms, data processing terms or transfer mechanisms.

10. Retention

Invoice files submitted for a free report are intended to be deleted within 30 days after report delivery unless a different period is agreed in writing or retention is required to resolve a query, security issue, legal issue or payment/service dispute.

Contact messages, application records and report correspondence may be kept for a reasonable period so DBX ONE can respond to enquiries, keep a record of what was requested, manage follow-up questions and maintain basic business records.

Deletion or return of invoice files can be requested by emailing [email protected].

11. Security

DBX ONE is designed to limit access to submitted files and use technical and organisational safeguards such as access controls, encrypted connections, protected cloud storage and retention limits. More detail is provided on the Confidentiality page.

12. Your rights

Depending on the situation and lawful basis, individuals may have rights to request access, correction, deletion, restriction, portability or objection to the use of their personal information. Requests can be sent to [email protected].

Right to object: where DBX ONE relies on legitimate interests, individuals can object to that processing. DBX ONE will consider the request and stop the processing unless there is a compelling reason to continue or another lawful basis applies.

13. Complaints

Please contact DBX ONE first at [email protected] so the issue can be reviewed. Individuals also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator.

14. Internal sign-off by practices

Before submitting invoice files, practices may wish to run the service past their DPO, IG lead, finance/procurement lead, practice partners or Caldicott Guardian equivalent where relevant, and record the processing in their own records if personal data is involved.

15. Changes to this notice

This notice may be updated as DBX ONE develops, for example if new storage, email, analytics or AI suppliers are added. The latest version will be published on this page.