Privacy policy

MedFlow AI Limited trading as MedFlow AI · Last updated 2026-10-29

MedFlow AI is a trading name of MedFlow AI Limited ("we", "us"), a company registered in England and Wales, company number 17250952. We book quote visits for building companies: we run advertising to homeowners, check the enquiries that come in, and pass the qualifying ones to a building company so it can attend a visit and quote. This policy explains what personal data we handle while doing that, why, and what your rights are.

We are the data controller for the enquiry data we collect through our ads and forms, for the business contact data of the trade customers we work with, and for data about visitors to this website. Once we pass an enquiry to a building company, that company becomes a separate controller for how it uses your details.

1. Who this policy covers

• Homeowners who respond to one of our ads or fill in one of our enquiry forms.
• Trade customers: owners and staff of building companies we work with or speak to.
• Website visitors and people who book a call or contact us.

2. Homeowners: what we collect and why

What we collect

• Your name, phone number and email address.
• Your postcode or address.
• The job you want done, your budget band, when you want to start, and whether you own the property.
• Anything else you choose to tell us in a form, message or call.

Where it comes from

From the enquiry form you fill in, which may be hosted by us or by Meta (Facebook and Instagram lead forms), and from any follow-up conversation with you.

Why we use it

• To check whether your job fits a building company we work with (job type, budget band, area, timescale, ownership).
• To contact you about your enquiry and arrange a quote visit.
• To pass your details to the building company that will attend the visit.
• To keep basic records of enquiries handled, so we can run and improve the service.

Lawful basis

We rely on your consent, given when you submit the form, to contact you about your enquiry and to pass it on; and on our legitimate interests in running a lead-qualification service, which we have balanced against your interests. You can withdraw consent at any time by contacting us, and we will stop processing your enquiry.

Who receives it

If your enquiry qualifies, we pass your contact details, postcode and job details to one building company so it can attend the visit. We do not sell enquiries, we do not pass the same enquiry to several companies, and we do not add you to marketing lists. If your enquiry does not qualify, it is not passed to anyone.

3. Trade customers

If you run or work for a building company we deal with, we hold your business contact details, notes from our calls, details of the area, trades and job sizes you want, and the diary information you give us so we can book visits (for example a shared calendar). We use this to deliver and bill for the service and to communicate with you. Our lawful basis is performance of a contract (or steps you ask us to take before one) and our legitimate interests in running the business.

4. Website visitors and people who contact us

• Server logs. Our hosting provider records technical data such as IP address, browser type and the pages requested, to keep the site secure and running. Lawful basis: legitimate interests.
• Cookies and similar technologies. See our cookie policy. Analytics and advertising measurement run only if you accept them in the cookie banner.
• Booking a call. If you book through our booking calendar, HighLevel (LeadConnector) processes your name, email address and the time you choose on our behalf and under its own privacy notice.
• Phone, text and email. If you call, text or email us, we keep the correspondence for as long as needed to deal with it.

5. Who we share data with

We may also share data where the law requires it, or with professional advisers under a duty of confidentiality. We do not sell personal data.

6. International transfers

Some of the providers above process data outside the UK, including in the United States. Where they do, the transfer is protected by safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum or an adequacy decision.

7. How long we keep data

• Enquiries that do not qualify are deleted within 30 days of being received.
• Enquiries that are passed to a building company are kept for 12 months after the visit date, so we can deal with queries about the visit, then deleted.
• Trade customer records are kept for the life of the relationship and then for up to six years, as required for tax and accounting.
• Website logs are kept by our hosting provider for a short rolling period.

8. Security

Data is encrypted in transit. Access is limited to the people who need it to deliver the service. We use reputable providers and review how we handle data as the service grows.

9. Your rights

Under UK data protection law you can ask us to: give you a copy of your data; correct it; delete it; restrict how we use it; object to processing based on legitimate interests; and, where processing is based on consent or a contract, give you a copy in a portable format. You can also withdraw consent at any time. To exercise any of these, contact us using the details below. We aim to respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

10. Changes

We will update this page when the way we handle data changes, and update the date at the top.

11. Contact

MedFlow AI Limited trading as MedFlow AI
Company number 17250952, registered in England and Wales
Email: hamza@medflowai.io