1. Who We Are
CallidusOS Limited (Company No. 16902276) operates the CallidusOS® platform. Our registered Data Protection Officer is Luke Williamson, registered with the ICO under reference ZC066513. Contact: hello@callidusos.co.uk
2. Our Dual Role
CallidusOS operates in two distinct capacities under UK GDPR:
Data Controller: In respect of business contact data, billing data, marketing data, and usage analytics relating to clinic subscribers and their staff. In this capacity we determine the purposes and means of processing.
Data Processor: In respect of Clinical Data (patient data) uploaded to the Platform by subscribing clinics. In this capacity we process data only on the documented instructions of the clinic, which acts as the Data Controller for its patients' data.
3. Data We Collect and Process
3.1 As Data Controller
We collect: clinic business name and contact details; billing and payment metadata (via Stripe); staff login credentials; platform usage logs; IP addresses; cookie and analytics data.
3.2 As Data Processor
We process on behalf of clinics: patient names and contact details; medical history and treatment records; consent forms; and other clinical information uploaded by the clinic.
4. Lawful Bases
Contract: Processing necessary to provide the Platform service.
Legal obligation: Compliance with applicable law, including UK GDPR and tax obligations.
Legitimate interests: Platform improvement, security monitoring, fraud prevention.
Consent: Marketing communications (where obtained).
As Data Processor, we rely on the lawful basis established by the Clinic as Data Controller for Clinical Data.
5. Retention
We retain personal data in accordance with our Retention and Deletion Policy. Key periods: clinic account data, 7 years from contract end; Calia Copilot logs, 12 months; access logs, 12 months.
6. Your Rights
Where we act as Data Controller, you have the right to: access your data; rectify inaccurate data; erasure (subject to legal obligations); restrict processing; data portability; and object to processing based on legitimate interests.
To exercise these rights, contact our DPO at hello@callidusos.co.uk. Where we act as Processor, please contact your clinic directly.
7. Sub-Processors and Transfers
We use approved sub-processors to deliver the Platform service. Some sub-processors operate outside the UK. All transfers are governed by Standard Contractual Clauses or equivalent safeguards. A full sub-processor list is available on request.
8. Calia Copilot
Calia Copilot processes clinical data inputs to generate recommendations. It operates in a semi-automated advisory capacity only. No fully automated decision-making (as defined by UK GDPR Article 22) takes place without human review and sign-off.
9. Contact and Complaints
To exercise your rights or raise a concern, contact: hello@callidusos.co.uk
If you are not satisfied with our response, you may complain to the Information Commissioner's Office at ico.org.uk or by telephone on 0303 123 1113.
CallidusOS Limited · Company No. 16902276 · ICO Registration ZC066513
Questions about this document? Email hello@callidusos.co.uk.