Who we are
Visyt is operated by Visyt Ltd, based at Suite 1, First Floor, Caroline House, 125 Bradshawgate, Bolton BL2 1BJ, United Kingdom. Our privacy contact is info@visyt.ai. Visyt helps businesses manage customer communications, appointments and home visits, including communications through WhatsApp and automated assistants.
When a business uses Visyt to handle its customers’ information, that business generally determines why the information is used. We process that information on its instructions. We are responsible for information we use for our own account administration, support and service security. Contact the business you communicated with about its customer records, or contact us for help identifying the responsible business.
Information we process
- Business and staff account information, including names, work contact details, roles and account settings.
- Customer telephone numbers, WhatsApp identifiers, names supplied in conversations, messages, attachments and message delivery information.
- Appointment details and information supplied to arrange a service, such as addresses, postcodes and communication preferences.
- Connected WhatsApp Business account identifiers, business phone number identifiers and authorisation credentials needed to operate the connection.
- Call audio and transcripts where calling or recording features are enabled, and technical records needed to operate, troubleshoot and secure the service.
- Health or other sensitive information where a business enables relevant features or a person includes it in a conversation. Please avoid sending information unnecessary for your request.
How we use information
We use information to deliver and route messages, provide replies, arrange and manage appointments, assist staff, maintain conversation history, provide support, prevent misuse and maintain service security. A business may enable AI to draft or send replies and perform supported appointment tasks on its behalf. Contact the business if you need a person to handle your request.
WhatsApp and Meta
Businesses connect their own WhatsApp Business accounts to Visyt. We use the authorised connection to send and receive messages for that business. Meta also processes information needed to provide WhatsApp under its own terms and privacy notices. Disconnecting an account stops future authorised use of the connection; deletion of existing records is handled separately as described below.
AI and service providers
To provide an AI response, relevant messages, conversation context and business information may be sent to the AI provider configured for that business. Depending on enabled features, speech, telephony, hosting and messaging providers may also process relevant information.
We use the following types of provider. Each one is bound by a written data processing agreement that meets Article 28 of the UK GDPR:
- Cloud hosting and storage: to run the Visyt platform and store records securely, in UK data centres wherever available.
- AI language and speech services: to understand messages and calls, draft replies and produce transcripts. We only use AI providers whose contracts do not allow them to use your information to train their own models.
- Telephony and voice providers: to connect calls to the AI assistant and, where enabled, record them.
- Messaging providers: to send and receive WhatsApp messages (through Meta), SMS and email notifications.
- Form delivery: FormSubmit, to deliver messages sent through our website contact form.
Providers may only use information to deliver their service to us. They may not use it for their own purposes or keep it longer than their contract allows. Where any provider processes information outside the UK, the safeguards described under “Legal grounds and international processing” apply. A current list of our providers and their processing locations is available on request from info@visyt.ai.
We may disclose information when required by applicable law or where necessary to protect the service and the rights of its users.
We do not sell personal information, and we do not share it with third parties for advertising, marketing, revenue or business growth. We do not use customer records to build advertising profiles. We share information only with the service providers who help us run Visyt, under written contracts that require them to protect it and use it only on our instructions, or where the law requires it.
Legal grounds and international processing
We process personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
When we act for a business (processor)
For customer and patient records handled in Visyt, the business using Visyt is the controller and decides the legal basis for its processing. We act as its processor under a written agreement that meets Article 28 of the UK GDPR. We only process those records on the business’s documented instructions, keep them confidential, help it respond to your rights requests and return or delete the records when our service ends.
When we decide how information is used (controller)
- Contract (Article 6(1)(b)): to set up and run business and staff accounts, and to provide the service a business has signed up for.
- Legal obligation (Article 6(1)(c)): to keep financial and tax records, and to respond to lawful requests from regulators, courts or law enforcement.
- Legitimate interests (Article 6(1)(f)): to keep Visyt secure, prevent misuse and fraud, provide support, fix faults, and reply to enquiries sent through our website. We balance these interests against your rights, and you can object at any time.
- Consent (Article 6(1)(a)): only where we ask for it, for example optional cookies. You can withdraw consent at any time.
Health information
Health information is special category data. Where a care provider uses Visyt to arrange or deliver care, the processing normally relies on Article 9(2)(h) of the UK GDPR (the provision of health or social care), together with the condition in Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. That information is handled by, or under the responsibility of, professionals who owe a duty of confidentiality, and we respect the common law duty of confidentiality. Where no other condition applies, the business may rely on your explicit consent (Article 9(2)(a)).
International processing
We aim to store and process information in the United Kingdom. If a provider processes information outside the UK, we only allow it where the destination has UK adequacy regulations (including the UK–US Data Bridge for certified US organisations) or where we use an approved safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Contact us for details of the safeguards that apply.
Retention and security
We restrict access to information according to account permissions and use technical protections for stored credentials and sensitive records, including encryption in transit and at rest. No service can guarantee absolute security. If a personal data breach occurs, we will inform the affected business without undue delay so that it can meet its duties, including reporting to the Information Commissioner’s Office (ICO) within 72 hours where required.
How long we keep information
We keep information only for as long as needed. For customer and patient records, the business using Visyt sets the retention period, as controller. Our default periods follow the NHS Records Management Code of Practice and UK law. Businesses can apply longer periods where their own legal or professional obligations require it, for example professional body guidance for optical records.
| Record | Default retention |
|---|---|
| Appointment, visit and care-related records for adults | 8 years after the last contact or the end of care |
| Appointment, visit and care-related records for children and young people | Until the patient’s 25th birthday, or 26th if they were 17 when care ended, or 8 years after death if the patient dies before then |
| Messages and attachments that form part of a care record | As for the care record above |
| Other messages and conversation history | 2 years after the last message |
| Call recordings and transcripts | 12 months, unless the business adds them to the care record |
| Business and staff account records | For the life of the account, then 6 years (the limitation period for contract claims) |
| Invoices and financial records | 6 years from the end of the financial year they relate to |
| Website enquiries through our contact form | 2 years after our last contact, unless you become a customer |
| Security and system logs | 12 months |
| Backups | Overwritten on a rolling cycle of up to 90 days |
When a business closes its account, we return or delete its customer records within 90 days, unless the law requires us to keep them. We may keep records for longer where they are needed for a complaint, legal claim or investigation. Once that is resolved, we delete them.
Access, correction and deletion requests
To ask about access, correction or deletion, contact the business you communicated with or email info@visyt.ai with the subject “Visyt data request”. Identify the business and the WhatsApp number or account involved. Do not send passwords, access tokens or unnecessary identity documents. We may ask for proportionate verification before acting.
We will handle the request, or assist the responsible business, according to applicable law. Some records may need to be retained for legal obligations or to resolve disputes; we will explain applicable exceptions. Deleting information from Visyt does not automatically delete copies held independently by Meta, the business or other recipients.
Website and account storage
We follow the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, and ICO guidance on cookies and similar technologies.
This website
This website does not set cookies or use analytics or advertising trackers. If you use the contact form, the name, email address and message you enter are sent to our inbox through FormSubmit, a form-delivery service, so that we can reply to your enquiry.
The Visyt staff portal and apps
The Visyt staff portal and apps use only cookies and device storage that are strictly necessary. Under PECR these do not need consent, because the service cannot work without them. They are used to:
- keep staff signed in securely and protect accounts against misuse;
- remember settings such as the selected store; and
- let the optician app keep the day’s visits and updates on the device when there is no signal, then send them when it reconnects.
We do not use advertising or cross-site tracking cookies. If we introduce analytics or other optional storage, we will update this page and give you a clear choice before it is used, as PECR requires. Information stored offline on a device is removed when the user signs out. Staff should use devices protected with a passcode, in line with their employer’s policies.
Updates and contact
We will update this page when our practices change and revise the date above. For privacy questions or complaints, contact Visyt Ltd at info@visyt.ai or write to us at Suite 1, First Floor, Caroline House, 125 Bradshawgate, Bolton BL2 1BJ. Please let us try to resolve your concern first.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Your rights
Under UK data protection law you can ask to access, correct or delete your information, restrict or object to how it is used, and receive a copy in a portable format. You also have rights about decisions made solely by automated means. Our AI assistant does not make decisions about your care, and you can always ask for a person to handle your request.