Privacy Policy

1. Who We Are

Bloom is a practice management platform for UK financial advisers, operated by Arthur Browns Wealth Management Ltd (FCA 825843), registered in England and Wales.

Who decides how your information is used depends on who you are:

• If you are a client of an advice firm that uses Bloom, your advice firm is the data controller for your information. We process it on the firm's behalf, as its data processor. Your firm's own privacy notice explains how it uses your information; ask your adviser for a copy.
• If you are an adviser or staff member using Bloom, or you contact us about Bloom, we are the data controller for your account and contact details.
• If you visit our website or use the free plan tool, without being a client of an advice firm that uses Bloom, we are the data controller for the information you give us there.
• If you send your results from a free check that an advice firm has shared with you, what you send goes to that firm, which is its data controller; we process it on the firm's behalf, as its data processor.
• Arthur Browns Wealth Management Ltd is also an advice firm that uses Bloom for its own clients. For those clients it is the data controller, in its role as their adviser.

ICO registration: Arthur Browns Wealth Management Ltd is registered with the Information Commissioner's Office as a data controller.

Contact: For any data protection queries, contact us at privacy@bloomflow.app

2. What Data We Collect

We collect and process the following categories of personal data:

Adviser users:

• Name, email address, phone number
• Firm name, FCA number, role
• Login credentials (passwords are hashed, never stored in plain text)

Client data (entered by advisers):

• Name, date of birth, address, contact details
• National Insurance number, tax status
• Employment and income details
• Financial information: pensions, investments, debts, properties, insurance policies
• Risk profile and attitude to risk
• Health and vulnerability information (where relevant to financial advice)
• Meeting recordings and transcripts (where the adviser uses this feature)

3. Lawful Basis for Processing

We process personal data under the following lawful bases:

• Contract: Processing necessary to provide the Bloom platform to adviser users and to manage client relationships
• Legal obligation: FCA regulatory requirements including record-keeping under SYSC 9, COBS 16, MiFID II (5-7 year retention)
• Legitimate interest: Platform improvement, security monitoring, and product testing with session replay for named test accounts only
• Consent: Marketing communications (you can unsubscribe at any time)

4. Where We Store Your Data

Our primary data stores are in the United Kingdom (AWS eu-west-2, London) through our technology partners:

• Supabase (database and authentication) — London, UK (eu-west-2)
• Vercel (application hosting and serverless functions) — London, UK (lhr1)

Some services involve transfers outside the UK, mainly to the United States: the AI features (Anthropic), speech-to-text for recordings and dictation (Deepgram, with OpenAI as a back-up), encrypted backups (GitHub), and the connected services listed in the sub-processor table below. Transfers to Anthropic, OpenAI and Recall.ai rely on Standard Contractual Clauses with the UK Addendum in each provider's data processing agreement. For the others we show the safeguard where we have confirmed it, and say where we are still confirming it. Data is sent to an AI provider only when an AI feature is used.

5. Sub-Processors

We use the following third-party services to operate Bloom:

Firms can also connect provider feeds and planning tools (for example AJ Bell, Transact, FINIO, CashCalc and Trading 212). Those exchange data directly with the provider the firm chose.

AI connector (off unless a firm switches it on). A firm can let its advisers connect their own Claude account to look up client records. Information looked up that way goes to Anthropic under the firm's own agreement with Anthropic, not ours.

6. How Long We Keep Your Data

We retain data for as long as necessary to provide our services and meet regulatory requirements:

• Client financial records: Minimum 7 years from the end of the advice relationship (FCA requirements)
• Suitability letters and advice records: Minimum 5 years (MiFID II)
• Meeting recordings and transcripts: Kept as part of the advice file, subject to regulatory minimums. Advisers cannot yet delete a recording themselves; ask your advice firm.
• Account data: Retained while your account is active. After it closes, we delete it on request, unless regulatory retention applies.

Automatic deletion at the end of each retention period is not yet in place. Until it is, deletion is carried out on request.

7. Your Rights

Under UK GDPR, you have the right to:

• Access — Request a copy of the personal data we hold about you (Subject Access Request). We will respond within 30 days; where we need to verify your identity or ask you to clarify your request, the time spent waiting for your reply pauses that deadline.
• Rectification — Ask us to correct inaccurate data
• Erasure — Ask us to delete your data (subject to FCA retention requirements)
• Portability — Request your data in a machine-readable format
• Restriction — Ask us to limit how we process your data
• Objection — Object to processing based on legitimate interest

To exercise any of these rights, email privacy@bloomflow.app. If you are not satisfied with our response, see the complaints section below.

8. Complaints

If you have a concern about how we handle personal data, you can complain to us directly. Email privacy@bloomflow.app with the subject line “Data protection complaint”. We will acknowledge your complaint within 30 days (our target is 5 working days), investigate it, and respond without undue delay — our target is within 30 days of acknowledgement, and we will tell you if a complex complaint needs longer. Our Data Protection Complaints Procedure explains the process in full. Making a complaint will never affect the service you or your firm receive from us.

You also have the right to complain at any time to the Information Commissioner's Office (ICO) — 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

If you are a client of a financial advice firm that uses Bloom, complaints about the advice itself go to your advice firm under its FCA-regulated complaints process; this procedure covers how personal data is handled on the platform.

9. Security

We take the security of your data seriously:

• All data is encrypted in transit (TLS/HTTPS) and at rest (AES-256)
• Every request is authorised server-side against the requesting user's firm and role, with automated tests enforcing that coverage across all API routes
• Passwords are hashed using bcrypt
• Access to production systems is restricted to named people
• We use static IP addresses for platform integrations to enable IP whitelisting

10. Data Breaches

If a breach affects client information we hold for an advice firm, we tell that firm without undue delay, so it can notify the ICO and you where required. Where we are the controller (for example adviser accounts), we notify the ICO within 72 hours where required, and tell the people affected without undue delay when the risk to them is high.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users of any material changes by email. The latest version will always be available at this page.