Privacy policy

Emerge 21 Ltd
Effective date: 17 July 2026 • Replaces the policy dated 24 September 2024


Introduction
Emerge 21 Ltd ("Emerge 21", "we", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share personal information when you use our services.
Emerge 21 Ltd is a company registered in Northern Ireland (company number NI718071), with its registered office at Ground Floor, Gallery Building, 65-69 Dublin Road, Belfast, BT2 7HG.

We operate in two distinct capacities, and it is important to understand which applies to you:
As a data controller — for people who use our own websites, products and services directly. Here we decide what data is collected and why.
As a data processor — for our Recallist platform, which is used by optical practices. Here the practice decides what data is collected and why, and we act only on their instructions. If you are a patient of a practice that uses Recallist, your practice is the data controller of your information, not Emerge 21. See section 6.

1. Data we collect as a controller
Where we act as a data controller, we may collect the following types of personal data:
Contact details (for example, name and email address)
Payment information, where you purchase from us. For our Bitcoin-native products, this may include Bitcoin payment details
Information relating to your use of our services

2. Data we process on behalf of business clients (Recallist)
Emerge 21 Ltd operates Recallist, a patient recall and appointment booking platform used by optical practices. When a practice uses Recallist, we process personal data on their behalf and on their documented instructions. In these cases the practice is the data controller and Emerge 21 Ltd is the data processor.

2.1 What we process
The personal data we process on behalf of a practice may include:
Patient name
Patient contact details (mobile telephone number)
Appointment and recall due dates
Message history between the patient and the practice's automated assistant
Opt-out and communication preferences
We do not process patients' clinical records or optical prescriptions.

2.2 How we use it
Where we act as a processor, we use personal data only as instructed by the practice, and for no other purpose. Specifically:
We do not use patient data to train artificial intelligence models
We do not use patient data for our own marketing
We do not sell patient data, and we do not share it with any party other than the sub-processors listed in section 4.1
We do not combine patient data from one practice with that of another

2.3 Automated messaging
Recallist sends messages to patients on behalf of practices by SMS and WhatsApp, and uses an automated assistant to handle replies and arrange appointments. Messages sent through Recallist identify themselves as coming from an automated assistant. A patient can opt out at any time by replying STOP, and can ask to speak to practice staff instead.

2.4 Retention
Retention periods for patient data are set by each practice as data controller and recorded in our data processing agreement with them. We retain data only for as long as the practice instructs, and delete or return it on termination of the agreement. Opt-out records are retained for as long as necessary to ensure a patient who has opted out is not contacted again.

3. Use of data as a controller
Where we act as a data controller, we use your personal data for the following purposes:
To provide our services to you
To process payments and manage orders
To send marketing communications, with your consent
To comply with legal obligations

4. Data sharing
We will never sell your personal data. We may share your data with:
Third-party service providers, including for payment processing
Legal authorities, if required by law

4.1 Sub-processors (Recallist)
Where we process personal data on behalf of a practice, we use the following sub-processors:
Sub-processor
Purpose
Twilio
Message delivery by SMS and WhatsApp
Meta Platforms
WhatsApp Business Platform message delivery
Anthropic
AI processing of conversational messages
Railway
Application hosting


We maintain written agreements with each sub-processor requiring them to protect personal data to the same standard set out in this policy. We notify practices in advance of any intended change to our sub-processors.

5. Data storage and security
We store personal data securely and take appropriate technical and organisational measures to protect it from unauthorised access, alteration, or destruction. Where we act as a controller, we retain personal data only for as long as necessary to fulfil the purposes set out in this policy. Where we act as a processor, retention is governed by section 2.4.

6. Your rights

6.1 If you deal with us directly
Where we act as a data controller, you have the right to:
Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data (subject to legal requirements)
Withdraw your consent to marketing communications at any time
Lodge a complaint with the Information Commissioner's Office (ico.org.uk)

6.2 If you are a patient of a practice using Recallist
Your optical practice is the data controller for your information. To exercise your rights — including access, correction, deletion, or to stop receiving messages — please contact your practice directly.
You can also reply STOP to any message you receive to opt out immediately. We will act on any instruction we receive from your practice regarding your data, and we will pass on to your practice any request you send to us.

7. Cookies
We use cookies to improve user experience and analyse website traffic. You can adjust your browser settings to refuse cookies, though this may impact your experience.

8. Updates to this policy
We may update this policy periodically. Changes will be posted on our website, and continued use of our services indicates your acceptance of the updated policy. Where we act as a processor, material changes affecting practices will be notified to them directly under our data processing agreement.

9. Contact us
For questions or concerns regarding your data, please contact us at: support@emerge21.com
Emerge 21 Ltd, Ground Floor, Gallery Building, 65-69 Dublin Road, Belfast, BT2 7HG. Registered in Northern Ireland, company number NI718071.

If you are a patient of a practice that uses Recallist, please contact your practice in the first instance — they are the controller of your data.


​