Quantum Medix Deal Portal

The Quantum Medix Deal Portal is operated by Quantum Medix Central Ltd, 167–169 Great Portland Street, 5th Floor, London W1W 5PF (company number 17234306), which is the data controller for information held on the portal. ICO registration number: ZC266920. You can contact us about anything in this notice at privacy@quantummedix.com. We need a name, firm and work email address to give anyone access; without them we cannot open the portal to you.

The portal is a private document room for practice acquisitions that Quantum Medix is pursuing. Each deal has its own room. We use it to share the documents we issue — letters of intent, non-disclosure agreements, heads of terms, business plans and information requests — with the selling agent, the practice owner and, where a transaction proceeds, our funders and advisers; and to receive documents from the practice owner during due diligence. Access is personal: brokers sign in with a one-time code sent to their work email, sellers use a link and PIN provided to them, and lenders and advisers receive their own access. Every view and download is logged.

About you, if you are a broker, seller, lender or adviser: your name, firm, role, work email address and telephone number, and the record of when you signed in and which documents you opened. We hold this because we need it to run the transaction and to show who has seen what. If a portal page fails in your browser, your browser also sends us a short technical error report — the kind of failure, the error message, the first part of the page address with any code or link token removed, your browser type, our software version and your network address — so we can fix the fault; it never includes documents, anything you typed, or your PIN or sign-in code.

About the practice, once a transaction proceeds: the documents the practice owner or their agent provides for due diligence — statutory and management accounts, practice management system reports, clinician agreements, staff lists and payroll summaries, lease and property documents, regulatory registrations, bank and hire-purchase statements. These are business records of the practice. Some contain personal data about the practice's staff and clinicians (names, roles, pay rates). We do not accept patient-identifiable data on the portal. Production reports must be provided by clinician or in aggregate, and any document containing patient names or clinical details will be deleted and a replacement requested.

Documents we create: our own offers, agreements, plans and analyses relating to the deal.

Most of this comes from you directly. Some comes from others: a broker gives us the practice owner's details, a practice owner's pack contains details of their staff and clinicians, and a lender or adviser gives us the names of the people on their team. If you are a member of practice staff whose details appear in a pack, the practice owner is responsible for telling you that your information has been shared; we hold it only under the non-disclosure agreement for that deal, use it only to assess the practice, and never contact you.

We hold this information to evaluate, negotiate and, where agreed, complete the purchase of a dental practice. Under UK data protection law our basis is our legitimate interest in evaluating and completing the transaction and, where we are dealing with you directly, the steps needed to enter into a contract with you. We also hold records where the law requires it — for accounting and tax, or when a court or regulator asks — and where we need them to establish, exercise or defend a legal claim. Where we rely on legitimate interests we have assessed whether they are outweighed by your own; you can ask us for a copy of that assessment. Everything received from a practice is held under the non-disclosure agreement for that deal, which limits what we may do with it.

We use software, including an AI service, to read documents in a deal pack and summarise the figures and terms in them. The output is reviewed by our staff and informs our view of the practice. We make no decisions about any individual by automated means, and the software is not used to profile brokers, sellers, lenders or staff.

Only the people involved in that deal: the named people at Quantum Medix working on it, the selling agent, the practice owner, and — only where a transaction proceeds — our funders and finance advisers, our legal, accounting and tax advisers, and other companies in the Quantum Medix group. Each sees only the documents relevant to their role: a seller never sees lender material; a lender never sees our negotiation notes. Service providers that host, send email or store documents for us act only on our instructions under contract. We will disclose information if the law or a court requires it. If Quantum Medix Central Ltd is itself sold or reorganised, the information would pass to the new owner on the same terms as this notice. We do not sell or share the information with anyone else, and we do not use it for marketing.

Our systems are hosted by established cloud providers with data stored in the European Economic Area (Ireland); information is encrypted in transit and at rest. Transfers from the UK to the European Economic Area are covered by the UK's adequacy regulations. Two services sit outside the UK and EEA, both in the United States: automated reading of information memoranda and CVs by Anthropic, and estimation of a visitor's region from their IP address. For Anthropic we rely on the UK International Data Transfer Addendum to the EU standard contractual clauses, which forms part of our contract with them, and you can ask us for a copy of the safeguard. The IP lookup receives only the IP address — no name, email address or document content — and its provider publishes no UK transfer safeguard, so we are replacing that service. The current list of providers is at quantummedix.com/security.

Every connection to the portal is encrypted, and documents are held in private storage that is reached only through a short-lived link issued after the server has checked you may see that document. Brokers and lenders sign in with a single-use code sent to their work email rather than a password; their session ends after a day without use or a week at most, they can sign out of every device at once, and we email them when their account is used from a new device. Practice owners use a personal link and a PIN that locks after repeated wrong attempts and expires after 14 days (your broker, or our staff, can read your current PIN back to you if you lose it, and we record each time that happens); our staff use authenticator-app multi-factor authentication, checked on every request. Access is decided on the server, deal by deal and person by person, and every view and download is recorded with the name, firm and time — never with the code or PIN itself. Documents a practice owner has provided are locked for a lender until that lender has signed the NDA, and every PDF a lender downloads is stamped with their name, firm and the time. We take our own encrypted backups and have tested restoring from them. The full account, including where the data is held, our sub-processors and the independent checks we have run, is at quantummedix.com/security.

Practice acquisitions do not run in straight lines. Deals pause when a seller is undecided, are revived months later from a shortlist, or return after another buyer falls away — and when that happens the owner should not have to send the same accounts and lease a second time. We therefore keep deal documents for up to 24 months after the last activity on the deal, after which they are deleted unless the transaction completed (in which case the records pass into the acquired practice's own files) or there is a legal reason to retain them. Contact details for brokers and advisers we work with regularly are kept while that relationship continues. A practice owner may ask us to delete their documents sooner at any time, and we will, unless we are legally required to keep them. Technical error reports from your browser are deleted automatically after 90 days.

The portal sets only the strictly necessary session cookie that keeps you signed in; it sets no analytics, advertising or other cookies, which is why there is no cookie banner.

You can ask what we hold about you and for a copy of it, ask for it to be corrected or deleted, ask us to restrict what we do with it, object to our holding it, and ask for information you gave us in a form you can take elsewhere. Where we have asked for your consent, you can withdraw it at any time. Write to privacy@quantummedix.com and we will respond within one month; we may ask you to confirm who you are first. These rights have limits — for example we cannot delete documents we must keep for tax or to defend a legal claim, and we will not disclose information that identifies another person. If you are unhappy with how we handle your information you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113, though we would ask you to contact us first.

We will update this notice when the portal changes. The date at the top tells you when it was last revised, and if a change affects what we do with your information we will tell signed-in users by email before it takes effect.