SMART Fit Note Assistant

1. Introduction and GDPR Compliance

SMART Clinical Solutions ("we," "us," "our," or "Company") is committed to protecting your privacy and ensuring compliance with the UK Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR).

This Privacy Policy explains what data we collect, how we use it, and your rights under data protection law.

2. Who We Are

2.1 Data Controller

SMART Clinical Solutions is the Data Controller for this Service and responsible for your data.

2.2 Data Protection Officer

We have appointed a Data Protection Officer. Contact details are provided in Section 12.

3. What Data We Collect

3.1 Practice Authentication Data

To access the Service, we collect and process:

Data Type	Purpose	Retention
Practice login credentials (email/password)	Authentication and access control	For duration of subscription + 12 months after termination
Practice name and registration details	Practice identification and billing	For duration of subscription + 7 years (tax requirement)
Practice contact information	Service notifications and support	For duration of subscription + 12 months
IP address and login timestamps	Security and fraud prevention	90 days

3.2 Payment Data

Payment processing is handled by Stripe Payment Services. We do not collect or store:

• Credit card numbers
• Debit card numbers
• CVV/CVC codes
• Full payment card details

Stripe retains payment data according to their privacy policy. We receive only a payment reference and outcome. See Section 8 for Stripe's data handling.

3.3 Patient Data — What We Don't Collect

The Service does not collect, transmit, or store:

• Patient names, dates of birth, or NHS numbers
• Medical diagnoses or clinical assessments
• Generated fitness-for-work notes or medical statements
• Any content entered into clinical templates

3.4 Usage Analytics

We do not use cookies, analytics tracking, or similar technologies to monitor patient data. We may collect:

• Anonymized feature usage counts (how many fit notes were generated)
• Service performance metrics (page load times, error rates)
• Browser type and operating system (for technical support only)

This data cannot identify patients or individual clinicians.

4. Browser-Only Processing

4.1 How It Works

The SMART Fit Note Assistant is built as a static web application. All clinical processing occurs within your browser using JavaScript:

• Data you enter is processed locally on your device
• No patient information is transmitted to our servers
• Generated notes exist only in your browser
• You control when and how notes are saved or exported

4.2 Security Implication

This architecture provides strong data protection:

• Patient data is never in transit
• No server-side breach can expose clinical information
• We cannot access patient information even with full system access

5. Cookies and Tracking

5.1 Authentication Session

We use sessionStorage only to store your authentication token. This is:

• Cleared when you close your browser
• Never transmitted to tracking services
• Device-specific and not accessible to other websites

5.2 No Persistent Cookies

We do not use persistent cookies for patient data tracking. We do not use:

• Google Analytics or similar services
• Third-party tracking pixels
• Marketing cookies
• Advertising technologies

5.3 Essential Infrastructure Cookies

Our hosting provider (Netlify) may use minimal technical cookies for:

• Load balancing and traffic management
• DDoS protection

These are technical necessities and do not track user behavior.

6. Legal Basis for Processing

We process your data on the following legal bases under UK GDPR:

Data Type	Legal Basis
Practice authentication credentials	Contract performance (subscription agreement)
Billing and payment information	Contract performance and legal obligation (tax law)
IP address for security	Legitimate interest (fraud prevention and system security)
Service support communications	Contract performance

7. Data Sharing and Third Parties

7.1 Who We Share Data With

We share data only with:

7.2 Stripe Payment Services

Stripe processes payment card information. We share:

• Practice name
• Subscription amount and currency
• Billing email address

We do not share patient data with Stripe. Stripe's Privacy Policy governs payment data: https://stripe.com/privacy

7.3 Netlify Hosting

The Service is hosted on Netlify, which may process:

• Server logs (IP address, timestamps)
• Website traffic metadata

Netlify does not have access to patient data or clinical content. Their Privacy Policy: https://www.netlify.com/privacy/

7.4 No Onward Sharing

We do not sell, rent, trade, or otherwise disclose your data to:

• Marketing companies
• Data brokers
• Competitors
• Government agencies (except under legal requirement)

7.5 Legal Disclosure

We may disclose data if required by law (court order, regulatory investigation). We will notify you unless legally prohibited.

8. Stripe Payment Processing

8.1 Data Controller Status

For payment card information, both SMART Clinical Solutions and Stripe are joint Data Controllers under UK GDPR. Stripe's complete Privacy Policy is available at: https://stripe.com/privacy

8.2 What Stripe Processes

Stripe processes:

• Card number, expiry date, CVC (for initial validation only)
• Billing name and address
• Email address

8.3 Data Retention

Stripe retains payment data according to their processing requirements and legal obligations. We do not store full card details.

8.4 Stripe Subprocessors

Stripe may use subprocessors for payment processing. See their Privacy Policy for current list.

9. International Transfers

Your data is processed and stored in the United Kingdom. We do not transfer data outside the UK unless:

• Required by law
• Part of a legitimate third-party service (e.g., Stripe's global payment infrastructure)

Where transfers occur, we ensure adequacy through standard contractual clauses or other legal mechanisms compliant with UK GDPR.

10. Data Subject Rights

Under UK GDPR, you have the following rights:

10.1 Right to Access

You may request a copy of all personal data we hold about your practice. We will provide this within 30 days in a structured, commonly-used format.

10.2 Right to Rectification

You may correct inaccurate practice data. Log in to your account to update information, or contact us for assistance.

10.3 Right to Erasure

You may request deletion of your data, subject to legal obligations. Tax records may be retained for 7 years as required by law.

10.4 Right to Restrict Processing

You may ask us to limit how we use your data while a dispute is being resolved.

10.5 Right to Data Portability

You may request your data in a portable, machine-readable format to transfer to another provider.

10.6 Right to Object

You may object to processing for legitimate interest purposes (e.g., security logging).

10.7 Rights Related to Automated Decision-Making

The Service does not use automated decision-making that has legal effects on you.

10.8 How to Exercise Rights

To exercise any of these rights, contact our Data Protection Officer (Section 12). We will respond within 30 days.

11. Data Security

11.1 Security Measures

We implement technical and organizational measures to protect your data:

• HTTPS encryption for all data in transit
• Hashed and salted password storage
• JWT-based authentication tokens with expiration
• Access controls limiting data to authorized staff
• Regular security assessments and penetration testing

11.2 Breach Notification

If a data breach occurs, we will notify affected individuals and relevant regulators within 72 hours as required by UK GDPR, unless the breach poses no risk.

11.3 Your Responsibility

You are responsible for:

• Keeping your login credentials confidential
• Using secure devices and networks
• Logging out after each session
• Reporting suspicious activity immediately

12. Contact Information and Complaints

12.1 Complaints to Regulators

If you believe we have violated your privacy rights, you may lodge a complaint with the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Policy Changes

We may update this Privacy Policy to reflect changes in law or our practices. Material changes will be notified to you at least 30 days before taking effect. Continued use constitutes acceptance.

14. Retention Schedule

Data Category	Retention Period	Reason
Practice login credentials	Active subscription + 12 months	Support and dispute resolution
Billing records	7 years after termination	Tax and accounting requirements
IP addresses and login logs	90 days	Security and fraud prevention
Payment transaction references	7 years	Tax and financial audit