Who operates VerifyInt
VerifyInt is operated by Exclusive Health Professionals Ltd (also referred to as EHP Ltd), company number 14225027, registered in England and Wales. Our registered office is 30 Churchill Place, Canary Wharf, London E14 5RE, United Kingdom. Contact [email protected] or +44 7983 549929 for privacy enquiries. This notice covers the VerifyInt website, institution workspace, public certificate lookup and service emails.
Our role and the institution’s role
We act as controller for account administration, enquiries, billing, fraud prevention and our own website measurement. An institution generally decides why participant information is collected, what its certificates say and which details are published; it is responsible for its lawful basis and participant notices. When we host or generate certificate records on its instructions, we generally act as processor. These roles depend on the particular processing, not simply the name of the product. Contact the issuing institution first about correcting or deleting its certificate content; contact us if you need help identifying it.
Information we use
Account information includes your name, work email, institution name, country, contact phone, address, website and registration details. Certificate data can include participant name, contact email, programme, member ID, certificate ID, issue and expiry dates, visibility choices, issuer and status. Service data includes authentication and security events, organisation activity, enquiries, delivery references and billing records. Stripe handles payment card details; the VerifyInt application does not store full card numbers or card security codes. Do not upload patient records, medical histories or unnecessary sensitive information into certificate fields.
Purposes and lawful bases
We use account and service information to create and perform our contract with institution customers; billing records also support legal accounting obligations. Security, abuse prevention, service support and managing business enquiries are based on our legitimate interests, balanced against your rights. Optional analytics and advertising storage rely on consent where required. Institutions must identify their own lawful basis for participant records. We do not treat account registration as consent to marketing, and service verification emails do not subscribe recipients to a marketing list.
Public certificate information
A certificate ID or QR link opens its issuer’s published record. The institution controls holder-name visibility; public PDF access is a separate setting. Participant email addresses are not included in the public verification result. Full-name searches require an issuing institution and return only eligible public records. A public record may be copied or shared by the person who views it, so institutions should review visibility before publishing.
Service providers and recipients
Hostinger supplies application hosting and the business mailbox. Supabase supplies database, authentication and private file storage. Resend supplies transactional email delivery. Stripe supplies checkout, recurring payments and payment-related invoices; it may process information as an independent controller for its own payment and regulatory responsibilities. Cloudflare supplies DNS, network security and Turnstile bot protection. Google Tag Manager and Google Analytics support optional measurement after the relevant consent. Access may also be provided to authorised support personnel, professional advisers and authorities where legally required. We do not sell certificate participant lists.
International processing
Using a UK company does not mean that every provider stores or processes information only in the UK. The providers above may process information internationally. Applicable UK GDPR transfer requirements must be considered, including adequacy decisions or appropriate contractual safeguards where required. Ask [email protected] for the processing locations and transfer arrangements relevant to your proposed use before uploading data subject to location restrictions. We do not claim UK-only hosting or a specific certification that has not been confirmed.
Retention and deletion
We retain account information for the service relationship and thereafter only where needed for legal obligations, legitimate disputes, security or an institution’s continuing instructions. Certificate records are retained when membership expires; verification can become inactive without deleting the record. Expiry or cancellation is not itself a deletion request. The issuing institution can ask us to review a record-retention or deletion request, subject to legal obligations and the integrity of existing records. Accounting records are generally retained for six years from the end of the financial year to which they relate, and longer where a legal hold applies. Enquiries, delivery data and security records are assessed by their purpose, age, unresolved issues and legal need rather than kept simply because storage is available. Backup copies may persist until their normal replacement cycle; deletion is not a promise of instant removal from every backup.
Your rights
Subject to applicable UK GDPR conditions and exemptions, you may ask for access, correction, erasure, restriction, portability or object to relevant processing. Where consent is the basis, you can withdraw it without affecting earlier lawful processing. Use Cookie settings to change optional storage choices. Send other requests to [email protected], identifying the relevant institution or certificate ID where possible. We may request proportionate identity information and will respond within the applicable legal time limit, normally one month; lawful extensions and clarification requests may apply. We do not make automated decisions that determine professional licensing or eligibility from certificate lookup results.
Security and complaints
We use authenticated accounts, organisation permissions, private storage controls, HTTPS and application-level checks. No service can guarantee absolute security or that a certificate statement is professionally valid. Report suspected disclosure or security problems to [email protected]; do not include passwords or one-time codes. You can complain to us and to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. This notice does not claim an ICO registration number or independent accreditation.
Changes and contact
We update this notice when our service or processing changes. The date above identifies this version. For a processor agreement or institution-specific data handling requirements, contact [email protected] before supplying participant data.