How Appointbox handles personal and clinical data under UK GDPR. Patient rights, lawful basis, retention, sub-processors and breach response — in plain English.