Privacy Notice

KAIRO is a CHRNX product operated by Safewaysuk LTD.

For account administration, platform security, support and our own service operations, Safewaysuk LTD acts as a data controller.

For booking information entered by customers into a particular business’s KAIRO booking page, that business will usually decide why that information is needed. In that situation, the business is normally the controller and KAIRO processes the information on its behalf.

• Account information: email address, account identifier, authentication information and account type.
• Business information: business name, type, contact details, address or service area, services, prices, opening hours, branding and booking rules.
• Staff information: name, role, email, services, working hours, breaks, time off, account link information and, where the business chooses to publish them, a staff photo and short public introduction.
• Booking information: customer name, email, phone number, appointment date/time, selected service, assigned staff member, notes and, where needed for a mobile service, customer address.
• Client forms: where a business enables consultation, consent or medical-history forms for a service, KAIRO may process the customer’s answers, declarations, typed signature, form version and completion time. Some answers may be health information and therefore special-category personal data.
• Business safety and booking controls: a business may keep a record that a customer is blocked from making new online bookings, including the contact details used to identify that customer and an optional private reason recorded by the business.
• Customer account information: name, email, phone number, booking preferences and booking history linked to the account.
• Technical and security information: session/authentication data, device/browser information made available by our infrastructure, security logs and information needed to diagnose faults or prevent misuse.
• Communications: support messages and transactional email records, including whether an email was submitted for sending.

• to create and administer business, staff and customer accounts;
• to provide booking pages, appointment management, availability and staff scheduling;
• to send confirmations, reminders, cancellations and service messages;
• to provide business-configured consultation, medical-history and consent forms for confirmed appointments and keep a record of the form version and electronic acknowledgement;
• to authenticate users and protect accounts and the platform;
• to let a business prevent a blocked customer from making new online bookings with that business;
• to respond to support requests and investigate faults;
• to comply with legal obligations, enforce our terms and protect legal rights;
• to improve the reliability and usability of KAIRO using information that is appropriate for that purpose.

Depending on the situation, we rely on one or more lawful bases under UK data protection law:

• Contract: where processing is needed to provide an account or KAIRO service requested by you.
• Legitimate interests: to secure, maintain and improve the service, prevent misuse and operate our business, where those interests are not overridden by your rights.
• Legal obligation: where we must keep or disclose information to comply with law.
• Consent: where the law requires consent, for example if we later introduce optional non-essential cookies or certain marketing communications.

When you book with a business through KAIRO, the business receives the information needed to provide and manage your appointment. This can include your name, email, phone number, booking details, notes and service address where relevant.

The business is responsible for how it uses that information for its own service, customer relationship and legal obligations. If the business requires a client form, it decides which questions to ask, why the information is needed, how long it should be kept and the lawful basis and, where health information is involved, the applicable special-category condition for processing. You should contact the business first about matters that relate specifically to its use of your appointment or form information.

We do not sell personal information to advertisers.

We may use service providers that help us operate KAIRO, such as application hosting and infrastructure, authentication, storage, transactional email, support and security providers. They may process information only for the services they provide to us and subject to appropriate contractual or legal safeguards.

If you choose Google sign-in, Google processes information under its own terms and privacy arrangements for that authentication service.

We may also disclose information where required by law, court order or a lawful request, or where necessary to establish, exercise or defend legal rights.

Some technology providers may process information outside the United Kingdom. Where UK data protection law requires safeguards for an international transfer, we will use an appropriate legal mechanism, such as an adequacy regulation or recognised contractual safeguards.

We keep personal information only for as long as reasonably necessary for the purpose it was collected, taking account of account status, the needs of the business using KAIRO, legal obligations, disputes, fraud/security prevention and backup cycles.

Business and customer account data is generally retained while the account is active. Booking records may be retained while the relevant business account is active because businesses use them to manage customer appointments and records. Information may be retained for longer where needed for legal claims, accounting, security or regulatory reasons.

Depending on the circumstances and lawful basis, you may have rights to ask for access to your personal information, correction, deletion, restriction, objection or portability. Where processing relies on consent, you can withdraw that consent.

If your request relates to booking information controlled by a particular business, we may direct you to that business or assist it in responding.

To exercise rights relating to Safewaysuk LTD’s own processing, contact contact@safewaysuk.co.uk.

Please contact us first if you have a privacy concern so we can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO). Information about making a complaint is available at ico.org.uk.

We use technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse or alteration. No internet service can guarantee absolute security, so users should also protect their passwords and devices.

KAIRO is not intended for children to create business accounts. Businesses are responsible for deciding whether their own services can be booked for or by children and for meeting any legal requirements that apply to those services.

KAIRO includes optional client forms that a business can use for consultation, treatment consent and relevant medical-history questions. Health information is special-category personal data under UK data protection law and requires additional protection.

The business controls the wording and use of its forms and is responsible for deciding whether each question is necessary, identifying an appropriate lawful basis and special-category condition, giving customers suitable privacy information, limiting access and setting an appropriate retention period. Businesses should not collect health information in ordinary free-text booking notes when the dedicated form feature can be used instead.

KAIRO keeps completed form answers out of ordinary booking emails, SMS and WhatsApp content. Completed responses are made available through restricted business access rather than being included in routine appointment notifications.

We may update this notice when KAIRO changes or when legal requirements change. The latest version will be published on this page with an updated date.