Forumly's role
When Forumly builds and manages a CRM system for a client — for example, a clinic's patient management system — the client organisation remains the data controller for the personal data held within that system. Forumly acts on the client's behalf as a data processor, following the client's instructions for how that data is used, retained and deleted.
Special-category data
Healthcare CRM systems commonly involve special-category data, such as health information, which UK GDPR treats with additional care. Systems are designed with this in mind: access is restricted by role, and information is structured so that only relevant staff — such as an assigned doctor — can see clinical detail, while administrative staff such as reception see only what their role requires.
Core principles applied
Data Minimisation
Systems are designed to capture the data a client's workflow actually requires, not more.
Purpose Limitation
Data structures are built around the specific purpose the client has defined.
Access Control
Role-based permissions restrict data access according to the least privilege required.
Retention
Retention and deletion approaches are agreed with each client according to their own policies.
Privacy by Design
Privacy considerations are built into architecture decisions from the outset.
Confidentiality
Staff access is limited to what is needed to perform their specific role.
UK and international access
Forumly has a UK head office and an India branch. Where staff in either location need access to a system in order to build or support it, that access is controlled by the same role-based permissions applied throughout, and is limited to what is necessary for the work being carried out. Organisations with specific requirements about where their data is stored or accessed from should discuss this directly with Forumly before a project begins.
UK-based hosting
Forumly can provide UK-based data hosting options for organisations that require UK data storage, and CRM systems can be deployed using UK-based infrastructure where required. This is agreed on a client-by-client basis rather than assumed by default.
Data processing agreements
Clients who require a data processing agreement covering Forumly's handling of their data as a processor can request one directly — contact uk@forumly.uk.
Your organisation's own obligations
This page describes Forumly's general approach to data protection. It is not legal advice. As the data controller for their own patient or customer data, client organisations remain responsible for determining their own obligations under UK GDPR, the Data Protection Act 2018, and any sector-specific regulation that applies to them, and should seek independent legal advice where required.