Carebit Pay is Carebit’s payment system, provided by Carebit Health Limited, 63 Bermondsey Street, London, England, SE1 3XF (“Carebit”). Carebit Pay is powered by Stripe Payments Europe Limited, 3 Dublin Landings, North Wall Quay, Dublin, D01 C4E0, Ireland (“Stripe”).

By providing your payment method details and agreeing to store your payment methods with the Practice, you confirm that you have read, understood, and agree to this policy and any other relevant terms and conditions of the Practice.

1. What you are agreeing to

By saving your payment method details, you agree and acknowledge that:

• Stripe will securely store your full payment method details for the purposes of processing payments
• your payment method may be charged for services, appointments, products, and fees (“Charges”), including the use of pre-authorisation or reservation of funds to ensure sufficient funds are available
• Such Charges may be applied automatically to your stored payment method without further authorisation at the time of each charge, provided they are in line with this policy and any other relevant terms and conditions of the Practice
• Carebit is authorised to facilitate the secure storage and use of your payment method through its payment service
• withdrawing consent to store a payment method may require payment upfront for future services and may restrict access to certain products or services
• this agreement continues to apply following any change in the Practice’s name or ownership, where services remain substantially the same and patient data continues to be processed in accordance with applicable law

2. What is Carebit Pay and how your payment method is stored

• Your payment method details are encrypted and securely stored by Stripe, a PCI DSS–compliant payment service provider
• Your full, unencrypted payment method details (including full card number and CVC) are not stored by, and are never visible to, Carebit or the Practice
• Stripe converts your payment method details into a secure payment method token (for example, pm_28hdm56anmjh83)
• The Practice can only charge this token using Carebit and cannot access your unencrypted payment method details

This approach complies with PCI DSS requirements and industry best practice.

3. Who processes your payment information

For the purposes of data protection law:

• the Practice is the data controller in relation to Charges and patient billing
• Carebit acts as a data processor, providing the practice management system and Carebit Pay
• Stripe acts as an independent data controller for the payment method data it processes in order to provide payment services

4. Lawful basis for processing

Your payment information is processed on the following lawful bases:

• performance of a contract, where processing is necessary to charge for services you receive or have contractually agreed to pay for; and
• your explicit consent, where you choose to store a payment method for future use or automatic charging beyond a single transaction

Where consent is withdrawn, this does not affect processing necessary to complete Charges already incurred or contractually owed.

5. Types of charges you authorise

By saving a payment method, you authorise the Practice to charge or reserve funds on your stored payment method for:

• consultation, procedure, and medical service fees
• pre-payment for scheduled appointments or services
• outstanding balances following an appointment or service, including insurance excesses, shortfalls, or declined claims
• cancellation, late cancellation, or no-show fees, in accordance with the Practice’s published terms
• products, devices, or other items purchased from the Practice

Pre-authorisations

Pre-authorisations are temporary reservations of funds placed on your payment method, and are not completed charges. They may reduce your available balance for several days. The final amount charged may be lower or higher than the pre-authorised amount, in accordance with the Practice’s fees and services provided.

Charges may be applied automatically where appropriate.

You will receive confirmation of each completed charge and retain the right to dispute any charge with the Practice and/or your payment method issuer.

6. Timing of charges and receipts

Charges may be applied before, on the day of, or after a service is provided, depending on the nature of the service and the Practice’s billing processes.

You will receive a receipt for every successful charge via your registered email address or other preferred contact method.

7. Withdrawing consent

You may withdraw your consent to store your payment method at any time by contacting the Practice.

Withdrawing consent does not affect Charges already incurred or contractually owed. Once consent is withdrawn, the Practice may require payment upfront for future services and certain products or services may no longer be available. You can withdraw your consent to charge your payment method at any time by contacting the Practice. If you have outstanding Charges which arose prior to your consent being withdrawn, the Practice reserves the right to settle these Charges using your stored payment methods before your consent is withdrawn.

8. Retention and deletion of payment method details

• your stored payment method token will be retained while your patient account remains active or until you withdraw consent
• where no outstanding balance exists, your stored payment method tokens may be removed by the Practice when consent is withdrawn or your account is closed
• payment transaction records will be retained for legal, audit, accounting, and regulatory purposes even after payment methods are removed

All retention is carried out in accordance with the principles of data minimisation and storage limitation under local law.

9. Data sharing and international transfers

To process payments, your data may be shared between:

• the Practice
• Carebit
• Stripe, acquiring banks, and payment method networks

Stripe may process payment data outside the UK or EEA. Where this occurs, appropriate safeguards are applied in accordance with local law, including the use of approved international transfer mechanisms.

10. Disputes and chargebacks

If you believe a charge has been made in error, you should contact the Practice in the first instance. This does not affect your right to raise a dispute or chargeback with your payment method issuer.

11. Complaints

If you have concerns about how your personal data is handled, you should contact the Practice directly. You also have the right to lodge a complaint with the Practice’s local data protection offices if you believe your data protection rights have been infringed.