Privacy Policy

This Privacy Policy applies to:

• Healthcare organisations using Jump EHR
• Authorised users such as clinicians and administrators
• Patients whose data is processed through Jump EHR
• Visitors to our websites and support services

For Clinical and Patient Data

• Data Controller: The healthcare organisation
• Data Processor: Jump

The healthcare organisation determines why and how patient data is processed. We process that data only on their instructions and under our Data Processing Agreement.

For Account, Usage and Support Data

• Data Controller: Jump
• We determine how we process data relating to customer accounts, users and system usage.

Healthcare organisations may input:

• Patient demographics
• Medical history, diagnoses, notes and observations
• Prescriptions and medication information
• Test and investigation results
• Appointment records
• Communications sent to patients
• Clinical documents and uploads
• Care plans, tasks and workflow data

The legal basis for this processing is determined by the healthcare organisation.

We collect:

• Organisation details
• User names, emails and job roles
• Authentication data
• Professional registration details
• Billing and subscription information

Legal basis: contract performance, legal obligations and legitimate interests.

We automatically collect:

• Feature usage and activity logs
• Device and browser information
• IP addresses
• Error logs and performance data
• Security and access logs
• Aggregated analytics data

Legal basis: legitimate interests and contract performance.

Support emails, feedback, surveys and service communications.

Marketing communications are only sent with consent.

We process this data only to:

• Store and retrieve patient records
• Support clinical documentation and workflows
• Enable scheduling and communications
• Provide AI-supported tools when enabled
• Support document and report generation
• Enable integrations chosen by the organisation

We do not sell, market, or use patient data for our own commercial purposes.

We use this to:

• Manage accounts and access
• Provide support
• Process payments
• Improve the system
• Maintain security
• Send service communications

We use service providers including:

• Vercel for application hosting (London region)
• Supabase, on AWS, for database, file storage and authentication (London region)
• Microsoft Azure OpenAI Service for optional AI features
• Deepgram for optional live consultation transcription
• First Databank UK Ltd for medicines decision support
• Whereby for video consultations
• Advanced Health & Care (OneAdvanced) Docman Connect for clinical document transfer
• Communication providers for email and SMS
• Monitoring and analytics providers
• Stripe for subscription billing

All sub-processors operate under contractual data protection obligations.

We advertise Jump on Facebook and Instagram, operated by Meta Platforms Ireland Limited, and on LinkedIn, operated by LinkedIn Ireland Unlimited Company. Two kinds of information reach these platforms as a result:

• Website activity, where you have accepted advertising cookies - see our Cookies Policy
• Business contact details, in hashed form, to build matched audiences (see section 13)
• A record that a demo was booked, with the booker's contact details in hashed form, so we can tell which adverts lead to bookings (see section 13.3)

No clinical or patient data is ever shared with an advertising platform. Each platform acts as an independent controller for its own platform data, not as our sub-processor.

When you enable integrations, those providers may act as independent controllers or processors under their own terms. You are responsible for appropriate agreements with them. Jump provides the technical connection but does not determine how those third parties process data.

We may disclose data where legally required to regulatory authorities, law enforcement or courts.

Retention is determined by the healthcare organisation according to applicable medical record retention guidance and professional standards.

Retained while subscription is active and for a limited period after termination.

Retained according to operational and security needs, with anonymisation where appropriate.

Marketing emails are optional, only sent with consent, and can be unsubscribed from at any time.

Where we hold business contact details for someone we have corresponded with - for example a practice that enquired about Jump - we may use those details to create a matched audience with Meta or LinkedIn, so that our adverts reach people they are relevant to and are not shown to people who have already spoken to us.

Contact details are sent hashed, for matching only. Neither platform receives them in readable form, and neither uses them for its own purposes. No clinical or patient information is ever used for advertising.

Legal basis: Legitimate interests - reaching UK private practices likely to need clinical software - balanced against the limited privacy impact of a hashed match with an existing business contact. This is a separate basis from the consent that governs marketing emails.

Your right to object. Email hello@usejump.co.uk and we will remove you from these audiences. You do not need to give a reason.

When you book a demo through our website, our server tells Meta that a booking was made, so we can see which of our Facebook and Instagram adverts lead to demos rather than just clicks. This is sent from our server, not your browser, and does not read or place anything on your device.

It includes the email address, name and mobile number you entered on the booking form, hashed so Meta can only match them against its own users, never read them. If you accepted advertising cookies, it also includes the identifier Meta added to the advert link you clicked. It never includes your answers to the booking questions, and no clinical or patient information is ever involved.

Legal basis: Legitimate interests - understanding which of our adverts reach practices that want to talk to us, so we spend on the ones that work - balanced against the limited privacy impact of a hashed match on business contact details you have just given us.

Your right to object. Email hello@usejump.co.uk and we will stop sending your bookings to Meta. You do not need to give a reason.