RotaCheck Privacy Notice
Version 2.0 · Last updated: 15 November 2026
Your privacy at a glance
- What stays on your phone, and never reaches us: your location and whether you are on site, your notes, your dictation and your Allocate password.
- Nothing RotaCheck reads from Allocate is sent to our servers or seen by our staff. That includes your form, your report status, page content and screenshots.
- What we do receive: your name, email and account details; the details of each report you prepare with RotaCheck (shift, extra time, reason category, your answers and signature); fee and refund records; problem reports you choose to send; and security logs.
- We do not sell your data, use it for advertising, or use it to train AI.
- Every record we keep is kept for at least 28 days, and no longer than we need it (section 9).
- You can see, correct, delete or download your data at any time (section 11). Contact: [email protected].
Contents
- About this notice
- Who we are
- How RotaCheck is designed to protect your privacy
- What stays on your phone
- What we receive and why
- Information about rota coordinators and hospital staff
- Special care: health information and patient data
- Who we share data with
- How long we keep data
- International transfers
- Your rights
- Security
- Automated decisions
- Children
- Links and third-party services
- Changes to this notice
- Complaints
1. About this notice
1.1 This notice explains how RotaCheck ("we", "us") handles personal data when you use the RotaCheck app, browser extension or add-on, and website (together, "RotaCheck"). It is written to meet our duties under the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003 ("PECR").
1.2 It covers:
(a) doctors who use RotaCheck ("you");
(b) rota coordinators who receive a "still on site" notice from a doctor, if that feature is switched on (section 6); and
(c) hospital staff who ask for a location record (section 6).
1.3 Please read it with our Terms of Service and our Cookie and Device Storage Notice.
2. Who we are
2.1 RotaCheck. Address: to be completed, is the controller of the personal data described in section 5 and section 6. This means we decide why and how it is used.
2.2 We are registered with the Information Commissioner's Office ("ICO"), registration number: to be completed.
2.3 Contact us about anything in this notice at [email protected], or by post to the address above, marked "Data protection". We have not appointed a Data Protection Officer because the law does not require us to. Data protection questions go to the address above.
3. How RotaCheck is designed to protect your privacy
3.1 RotaCheck is built so that the most personal information never leaves your phone. We call this "on-phone first". In practice:
(a) your location is checked on your phone, against your hospital's area, and the result (whether you are inside or outside, and when) is kept on your phone;
(b) your notes are kept on your phone;
(c) speech is turned into text on your phone, and notes are tidied on your phone with fixed rules, with no AI model;
(d) the browser extension fills in your Allocate form on your phone, and nothing it reads from Allocate is sent to us; and
(e) the PDF attached to your report is made on your phone and sent only to Allocate, by you.
3.2 We describe the on-phone information in section 4 so that you know how the app handles it, even though we, as a company, never receive it. Because we do not receive it, we cannot see it, restore it or hand it to anyone.
4. What stays on your phone
| Information | What the app does with it | Can we see it? |
|---|---|---|
| Location | If you allow it, checks on your phone whether you are inside your hospital's area, to record arrival and departure times. You can turn it off and enter times by hand. | No. We never receive coordinates or the arrive/leave times. |
| Day-to-day hours diary | Your rota and the arrival and leaving times worked out on your phone. | No. Only the details of a report you prepare reach us (section 5). |
| Notes and dictation | Speech is turned into text on your phone. Notes are tidied with simple rules on your phone. | No. No recording or text is sent to us or to any AI company. |
| Allocate password (only if you tap Save) | Stored in Apple Keychain (iPhone) or the Android Keystore (Android), on this device only, not backed up. Used to fill in Allocate's sign-in page. | No. Never sent to us. |
| Anything read from Allocate (your form, report status, page content) | Used on your phone to fill in your form and show you your report status. | No. Never sent to our servers or staff. |
| Report PDF | Made on your phone and attached to your Allocate form. If it cannot be attached, a copy stays in your Reports tab for you to share yourself. | No. |
| Local notifications (such as "Get your £5 back?" after a rejection) | Created on your phone from information on your phone. | No. |
4.1 Deleting the app, or deleting your account, deletes this information from that phone. We cannot restore it.
5. What we receive and why
5.1 The table below lists every kind of personal data about you that reaches our servers, why we need it and our lawful basis under Article 6 UK GDPR.
| Data | Where it comes from | Why we use it | Lawful basis |
|---|---|---|---|
| Account details: name, email address, account settings, the date you joined | You | To create and run your account, sign you in with a one-time code, and send you service emails | Contract (Art 6(1)(b)) |
| Report details: for each report you prepare with RotaCheck, the shift, the start and end times of the extra time, the number of minutes, the reason category, your answers to the report's questions, your signature, whether you submitted it, and any refund you ask for. Not your location, your notes, your report's status in Allocate or anything else read from Allocate | Your phone, from what you entered and confirmed | To keep a record of your reports for you, show them in your Reports tab, and charge and refund the £5 fee | Contract (Art 6(1)(b)) |
| Payment records: card set-up confirmation, fee charges, refunds, receipts, Stripe customer reference, card type, last four digits and expiry | You and Stripe | To take and refund fees, send receipts, and keep accounting records | Contract (Art 6(1)(b)); legal obligation (Art 6(1)(c)) for accounting and tax records |
| Trial records: whether you are in the early-access trial and whether fees are on for your account | Us | To make sure you are not charged during the trial | Contract (Art 6(1)(b)) |
| Service emails and support messages: emails we send you, emails you send to support, and our replies | You and us | To answer you and keep a record of what we told you | Contract (Art 6(1)(b)); legitimate interests (Art 6(1)(f)) in handling support well |
| "Still on site" notices you choose to send (only if that feature is switched on): recipient email, time, your hospital and the text you approved | You | To send the notice you asked us to send | Contract (Art 6(1)(b)) |
| Hospital location record requests and your Approve or Decline answer | The requester and you | To pass on your decision and keep an audit trail | Consent (Art 6(1)(a)) to share the record; legitimate interests (Art 6(1)(f)) for the audit log |
| Problem reports you choose to send: your description, your name and email, device and app version, the screen you were on, the app's last 40 activity lines (no notes, passwords or Allocate content) and, only if you turn it on, a screenshot (never of Allocate pages). A person at RotaCheck reads them with help from an AI assistant (Anthropic), without your name or email | You | To investigate and fix problems. We use Anthropic's AI service to help sort and understand them; a person approves any fix | Legitimate interests (Art 6(1)(f)) in a working service |
| Automatic error reports: technical details of an app error (such as a PDF that failed to attach), app version and device model. No report content, notes, diary or Allocate content | Your phone | To find and fix faults | Legitimate interests (Art 6(1)(f)) in a working service |
| Security logs: sign-ins, IP address, device type, app version, time | Your phone and browser | To keep accounts and the service secure and to detect misuse | Legitimate interests (Art 6(1)(f)) in security |
| Push notification token | Your phone (via Apple or Google) | To send notifications you have allowed | Contract (Art 6(1)(b)) |
| Website session cookie | Your browser | To keep you signed in on the website while you save your card | Strictly necessary (PECR); contract (Art 6(1)(b)) |
5.2 Our legitimate interests are: running a secure and reliable service, fixing faults, answering support requests and keeping a record of hospital requests and our responses. We have balanced these against your interests and kept the data to a minimum. You can object at any time (section 11).
5.3 If you do not give us your account details, we cannot provide RotaCheck. Everything else in the table is either needed only for a feature you choose to use, or created when you use the service.
5.4 We do not: sell your data; use it for advertising, marketing profiles or analytics about you; share it with your Trust, RLDatix or Allocate; or use it to train any AI model. We will only send you marketing emails if you opt in, and you can opt out at any time.
6. Information about rota coordinators and hospital staff
6.1 Rota coordinators. The "still on site" notice feature is currently switched off. If it is switched on, a doctor may choose to send you a short notice by email through RotaCheck. We would then process your work email address and the notice. We receive your email address from the doctor. Our lawful basis is legitimate interests (delivering the doctor's notice). Each email contains a link to stop receiving these notices, and we will respect it. We keep these notices for 90 days.
6.2 Hospital staff who request a location record. If you ask us for a doctor's location record, we process your name, role, work email address, work phone number and the details of your request. We receive these from you. Our lawful basis is legitimate interests (verifying requests and keeping an audit trail). We may check your identity through your hospital's switchboard the first time you ask. We keep request logs for 2 years.
6.3 Rota coordinators and hospital staff have the same rights as doctors, described in section 11.
7. Special care: health information and patient data
7.1 RotaCheck is not designed to hold health information or patient data, and we do not ask for any.
7.2 Your own health. Your notes might, if you choose, mention your own health. Your notes stay on your phone and we never receive them. Please do not put health information in your report answers unless you need to, because we store those (section 5).
7.3 Patient information. Please never put patient names, NHS numbers or any other patient details in RotaCheck. The app checks notes on your phone for patterns that look like an NHS number and asks you to remove them before saving. Problem-report screenshots must not show patient details.
7.4 If, despite this, we receive patient information or special category data in a problem report or support email, we will delete it as soon as we notice it, and in any case use it only to respond to you. We do not intend to receive this kind of information. If it reaches us, we delete it as soon as we notice it and do not use it for anything else.
8. Who we share data with
8.1 Service providers (processors). We use the following providers to run RotaCheck. Each acts only on our instructions under a written contract that meets UK GDPR requirements:
| Provider | What they do | Where data is stored |
|---|---|---|
| Supabase | Database, server functions and sign-in | London, UK |
| Resend | Sending service emails | USA |
| Google (Gmail) | Business mailbox: receives support emails and problem reports | USA |
| Expo | Push notifications | USA |
| Stripe | Card payments, payment links and refunds | UK, EU and USA |
| Anthropic | AI help with sorting and understanding problem reports you send, and nothing else. Anthropic does not use this data to train its models | USA |
| Hugging Face | Hosts the speech model file; sees your IP address once | USA |
8.2 Independent controllers. Some organisations decide for themselves how to use data they receive:
(a) Stripe is also a separate controller for fraud prevention and its own legal and regulatory duties. See stripe.com/gb/privacy.
(b) Apple and Google receive information under their own terms when you download the app, use push notifications or (if offered) pay through them.
(c) Your bank or card issuer receives payment information when you are charged or refunded.
8.3 Your hospital. We do not currently share anything with your hospital. If we ever offer requests for a location record, we will give every requester the same reply, whether or not the person uses RotaCheck.
8.4 Legal and safety reasons. We may disclose data if we are required to by law, a court order or a regulator, or where it is necessary to protect someone's vital interests, to prevent fraud or to establish, exercise or defend legal rights. We will tell you unless we are not allowed to.
8.5 Business transfer. If our business or its assets are sold or restructured, data may be transferred to the new owner, who will be bound by this notice. We will tell you before that happens.
9. How long we keep data
9.1 We keep each record only for the period in the table below. Report details are kept for at least 28 days so you can submit within your trust's deadline.
| Data | How long we keep it |
|---|---|
| Account details | Until you delete your account |
| Report details | Until you delete your account (and at least 28 days); the payment parts are then kept as payment records |
| Payment and accounting records | 6 full tax years after the tax year they relate to (legal duty) |
| Email messages (service and support) | 90 days |
| "Still on site" notices | 90 days after sending |
| Hospital request logs | 2 years |
| Location record PDFs | Kept only while the download link works. The link expires after 28 days and the file is then deleted |
| Problem reports | 2 years. Problem reports you sent are deleted when you delete your account |
| Automatic error reports | 12 months |
| Security logs | 12 months |
| Website session cookie | Until you sign out or close your browser, and no more than 30 days |
9.2 When you delete your account, we delete or anonymise your data within 30 days, except where the table above or the law requires us to keep it longer.
10. International transfers
10.1 Some of our providers are based in, or have staff or sub-processors in, the USA or other countries outside the UK. When personal data is transferred outside the UK, we make sure it is protected by:
(a) UK adequacy regulations (including the UK-US Data Bridge, where the provider is certified); or
(b) the ICO's International Data Transfer Agreement or International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.
10.2 You can ask us for details of the safeguards for any provider at [email protected].
11. Your rights
11.1 Under UK data protection law you have the right to:
(a) be informed about how we use your data (this notice);
(b) access the data we hold about you and get a copy;
(c) rectification: have inaccurate data corrected and incomplete data completed;
(d) erasure: have your data deleted in certain circumstances;
(e) restrict how we use your data in certain circumstances;
(f) data portability: receive data you gave us in a machine-readable format, or have it sent to another organisation;
(g) object to our use of your data where we rely on legitimate interests, and to direct marketing at any time; and
(h) withdraw consent at any time where we rely on consent. This does not affect anything we did before you withdrew it.
11.2 You can delete your account in the app at any time (Account > Delete account). The download button gives your main records. Email us for a full copy. For any other request, email [email protected]. We may ask you to confirm your identity. We will reply within one month. If your request is complex, we may extend this by up to two further months and will tell you why.
11.3 We do not charge for responding to requests, unless a request is manifestly unfounded or excessive.
11.4 Remember that your location, notes and dictation are on your phone, not with us. You can see, change and delete them in the app directly.
12. Security
12.1 We use appropriate technical and organisational measures to protect the data we hold, including:
(a) encryption in transit (TLS) and at rest;
(b) sign-in by one-time code sent to your email;
(c) access controls so that only authorised staff can reach our systems, and only where needed;
(d) keeping sensitive data on your phone, in the phone's secure storage where appropriate;
(e) never receiving your full card number, which is handled by Stripe; and
(f) contracts with our providers requiring them to protect data.
12.2 If a personal data breach is likely to result in a risk to you, we will report it to the ICO within 72 hours where required, and tell you without undue delay if the risk is high.
13. Automated decisions
13.1 We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
13.2 Some things in RotaCheck happen automatically: for example, a £5 fee is charged when you submit a report through RotaCheck, and the app suggests a rest-period answer when the arithmetic from your diary is certain. These follow fixed rules you can see in our Terms, and you can always contact us to have a person look at a charge.
14. Children
14.1 RotaCheck is only for doctors aged 18 or over. We do not knowingly collect data from anyone under 18.
15. Links and third-party services
15.1 RotaCheck can fill in exception report forms on the Allocate website, on your own phone. It is not made, approved or supported by Allocate, RLDatix or your trust. Allocate is provided by your Trust under its own privacy notice. We are not responsible for how your Trust, Allocate's supplier, Apple, Google or any website we link to handles your data. Please read their privacy notices.
16. Changes to this notice
16.1 We may update this notice, for example when we add a feature or change a provider. We will tell you about important changes by email or in the app before they take effect. The version and date at the top show when it last changed.
17. Complaints
17.1 To complain about how we use your data, email [email protected]. We will reply within 30 days. You can also complain to the ICO.
17.2 You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
RotaCheck. Address: to be completed · ICO registration: to be completed · [email protected]