Your practice, board or cluster is the controller of its staff’s workload data. Studystreaks Ltd, which runs Tidemark, is the processor — we only handle that data to run the service and on your instructions. A Data Processing Agreement is in force automatically with every subscription; no signature is needed, and a countersigned copy is available on request.

Full answer: DPA clause 1 — Roles and scope and the IG summary table.

Only to run the service for you. All data held by Tidemark is internal to the service: it is used solely to operate and improve the app for the clinicians and practices who created it. It is never sold, never shared with advertisers, and never used for anything else. Nothing is done with your practice’s or a clinician’s data outside the service — research participation, case studies, testimonials, cross-practice comparison — without that party’s explicit, informed, revocable consent. Developer access is limited to named people on a least-privilege basis, is logged, and is used only to investigate faults or support requests you raise.

Full answer: Privacy Policy — How your data is, and isn’t, used and DPA clause 2 — purpose limitation.

No. Any aggregated or pooled figure is only ever produced at a level where no individual practice or clinician can be identified. Inside a practice, a team figure appears only once at least three clinicians have contributed, and no per-colleague rows are shown to anyone else — only ranges and spreads across the team — and everyone appears under a generated handle rather than a name or initials. The opt-in cross-practice comparison needs at least 12 practices in a band and shows bands, never named practices. Opt-in research outputs pool at least 20 clinicians across 5 practices, with no names, no practice names or locations, and no free text.

Full answer: Privacy Policy — How your data is, and isn’t, used, §3 Anonymity within your team, §4 Anonymised research and §5 Comparing with similar practices.

No — and it is designed so it cannot. There are no patient fields anywhere: no names, dates of birth, CHI or NHS numbers, no clinical record. Tidemark records how long staff spent on categories of work, not who was seen. Free-text notes are for your own reminders and are visible only to you, and the app tells you plainly never to type patient detail into them. Because there is no patient data, this is a workforce tool, not a clinical system.

Full answer: Privacy Policy §1 — What we collect and DPA clause 4 — No patient identifiable data.

The database, sign-in system and uploaded sheet photographs are stored in the European Union (Frankfurt, Germany and Ireland). Pages are served from UK and EU edge locations. Payments are handled in the UK and Ireland. The AI that reads a photographed sheet and drafts your written analysis runs in the EU and/or the United States. Reminder notifications travel through your device maker’s push service (Apple, Google or Mozilla, US) and carry a content-free ping and a link only. Support and administration are in the UK.

Full answer: Privacy Policy §7 — Where your data is handled, the sub-processor annex (country detail) and DPA clause 11 — International transfers.

Every transfer outside the UK/EEA is covered by the UK International Data Transfer Addendum and EU Standard Contractual Clauses, with a transfer risk assessment on file for the US-capable AI processing. No special category or patient data is involved in any transfer — the data is staff working-time figures.

Full answer: DPA clause 11 and Privacy Policy §6 — Who else processes it.

There is a short, named list: the managed database and storage provider, the hosting and edge network, the payment processor, and the AI gateway used for sheet reading and written analysis. Each is listed with its purpose, its countries and its transfer safeguard. We give notice of any new or replacement sub-processor before it starts processing, and you may object.

Full answer: DPA clause 5 — Sub-processors and the full country-level annex.

Only operational figures — minutes by domain, contact counts, session pattern, your 0–5 ratings — plus, if you photograph a paper sheet, the image of that sheet. Names, email addresses and your free-text notes are never sent. Inputs are not used to train models and are not retained by the model provider for training. If you dictate a voice note, the audio and the transcript are discarded once your draft entry is produced — only the entry you confirm is saved.

Full answer: Privacy Policy §2 — Why we use it and the AI row in the sub-processor annex.

Every table is protected by row-level security in the database itself, keyed to the signed-in person and their practice membership — not by checks in the app that could be bypassed. A request for another practice’s rows returns nothing, even if someone crafted it by hand. This tenant isolation is covered by automated tests that run on every change.

Full answer: Security page — Controls at a glance and DPA clause 6 — Security measures.

Aggregated totals only. A lead never sees another person’s diary rows, notes or self-rated scores. Any team figure is suppressed until at least three clinicians have contributed to it, no per-colleague rows are shown to anyone else — the practice view gives ranges and spreads across the team, never a row per person — and everyone appears under a generated handle rather than a name or initials. Nobody, including a lead, can see who has or has not recorded: participation is a count of how many people are on track, never who. A job title is only named when at least three people share it; otherwise all professions are shown together. Practice names are not shown in any pooled or cross-practice view, and list sizes travel only as bands.

Full answer: Privacy Policy §3 — Anonymity within your team.

Yes. Every occasion practice-wide totals are viewed or downloaded is recorded — who, when, and for which period — so a practice can show its aggregate figures were used properly. Sign-in attempts are logged as a one-way hash of the address rather than the address itself, and administrative actions on an account are recorded.

Full answer: Privacy Policy §1 (Security and audit records) and DPA clause 12 — Audit.

You can export everything, at any time, in open formats. When an account or subscription is closed there is a short grace window in case you come back, after which records are permanently deleted on a published schedule by an automated nightly job. Deletion means deletion — including uploaded sheet images and backups as they age out. There is no lock-in and no exit fee.

Full answer: Privacy Policy §9 — How long we keep it (includes the retention and deletion timeline), DPA clause 9 — Return and deletion and Terms §13 — data retention after cancellation.

We notify the affected controller without undue delay on becoming aware, with what we know so far and what we are doing, so you can meet your own 72-hour regulatory duty. Incidents are managed through a documented process that captures a timeline, an evidence pack, the tenants affected and the recovery steps, and produces a report you can hand to your IG lead. The process was last rehearsed on 27 August 2026 as a breach tabletop exercise alongside a database restore test, in which every table was restored and verified and a deliberately wiped table was recovered intact. The provider’s own point-in-time recovery is exercised by the hosting provider, not by us. The next rehearsal is due in August 2027.

Full answer: DPA clause 10 — Personal data breach and the security contact on the Security page.

TLS 1.3 in transit with HSTS enforced, AES-256 at rest including backups, row-level authorisation in the database, hashed credentials handled by the managed auth provider, automatic sign-out after a period of inactivity, rate limiting on sign-in, and a strict set of browser security headers an IT reviewer can verify from outside. Uploaded sheet images sit in a private bucket readable only by the clinician who uploaded them.

Full answer: Security page — controls and response headers, and DPA clause 6.

Individuals can export or delete their own data from within the app, which usually answers a request immediately. Where you need us to help as processor — locating records, producing a machine-readable copy, or confirming erasure — we assist and confirm in writing. Requests go to the contact address published on the Privacy page.

Full answer: Privacy Policy §10 — Your rights and DPA clause 8 — Assistance to the Controller.

Outbound HTTPS on port 443 to the Tidemark domain, and nothing else. No local install, no browser plug-in, no smartcard integration, no inbound connections. There is a ready-made whitelist request letter you can send to your board’s IT service, and a copy-for-email version of the whole IG summary and DPA.

Full answer: IT access page (whitelist letter) and the IG summary table.

Yes — Studystreaks Ltd is registered with the Information Commissioner’s Office, and the registration number, company number and registered office are published so a reviewer can check them. One named contact address handles data requests, IG queries and breach notifications.

Full answer: Privacy Policy §11 — Contact and the IG summary table.

No. There is no advertising, no trackers and no data sale, and we do not profile anyone beyond showing them and their practice their own workload. Two optional uses exist and both are strictly opt-in and revocable: anonymised research (published only in pools of at least 20 clinicians across 5 practices) and comparison with similar practices (shown as a band, never a named practice, and only once at least 12 practices share that figure).

Full answer: Privacy Policy §4 — Anonymised research and §5 — Comparing with similar practices.