Privacy Policy

We collect the minimum needed to measure and report on clinical workload.

• Account information. Name, professional email address, job role (GP partner, salaried GP, locum, trainee, ANP, pharmacist, practice nurse or other), practice affiliation and working pattern.
• Workload and operational data. Session times and durations, time by domain (direct care, triage, indirect care, running the practice, supervision, QI and cluster work, professional responsibilities), patient contact counts by consultation mode, and MDT whole-time-equivalent cover.
• Self-reported ratings. Cognitive load (1–5), perceived continuity of care (0–5) and IT friction (0–5), recorded by the clinician about their own working day.
• Uploaded paper sheets. Photographs of the clinician's own tally sheet, stored in a private bucket readable only by that clinician and processed to extract the numbers on it.
• Free-text notes. Optional day notes, template names, repeat-pile descriptions and sprint reflections you type yourself. These are visible only to you, are never shown to a colleague or sent to the AI provider, and must never contain anything about a patient.
• Notification and device data. Your reminder preferences and timezone, push subscription details for each device you enable reminders on (endpoint, platform and browser identifier), and a log of which reminders were sent and whether they were opened, kept so we do not send duplicates.
• Voice notes. If you dictate a day, the audio is transcribed to produce a draft entry and neither the audio nor the transcript is retained afterwards — only the entry you confirm is saved.
• Security and audit records. Sign-in attempts (recorded as a one-way hash of the address, never the address itself), administrative actions taken on an account, and a trail of every occasion practice-wide totals are viewed or downloaded, recording who, when and for which period. Access trails are kept so a practice can show its aggregate figures were used properly.
• Billing data. Subscription plan, currency, renewal dates and a payment provider customer reference. No card numbers are stored by us.

We do not use advertising trackers, and we do not build profiles for any purpose other than showing you and your practice your own workload.

• To produce your personal workload reports, session balance, trends and safe working scorecards.
• To produce practice-level capacity reports for practice leads, always as aggregated totals.
• To power the written analysis and improvement suggestions. Only operational figures are sent to the AI provider — never names, emails or free-text notes — and those inputs are not used to train models.
• To manage your subscription, send receipts and tell you about changes that affect your data or your access.

Our lawful bases are performance of a contract (running your subscription), and legitimate interests (providing workload analysis your practice has asked for and keeping the service secure).

Practice leads see aggregated totals only. Individual diary entries, notes and self-rated scores are never shown to a colleague. Charts that could identify one person are suppressed until at least three clinicians have contributed to that view. No per-colleague rows are shown to anyone else: team views give ranges and spreads across the practice, and you can only see your own position within them.

The one exception is where a lead records a day on behalf of a colleague at that colleague’s request — that entry is attributed to the colleague and visible to them.

Every occasion a practice-wide total is viewed or downloaded is recorded — who did it, when, and for which period — and that trail is visible to the practice’s leads. It exists so a practice can demonstrate its pooled figures were used for capacity planning and nothing else.

If — and only if — you choose to take part, your anonymised workload figures may be combined with those of other clinicians and used in published research on workload and wellbeing in general practice. Consent is asked once, when you set up your account; it is never assumed, and the lawful basis is your explicit consent (UK GDPR Art. 6(1)(a)), which you can withdraw at any time in Settings.

In scope: workload timings, contact counts, working pattern, role and nation, and your self-rated scores. Never included: your name or email, your practice’s name or location, free-text notes, uploaded sheet images, or anything about patients.

Every published slice pools at least 20 clinicians from at least 5 different practices, so no clinician or practice can be identified. Withdrawing consent stops your data feeding future analyses; results already published in aggregate cannot be withdrawn, because no one can be picked out of them.

A practice can choose to see how its working patterns compare with similar practices, privately. Joining is always an explicit choice by the practice lead — never assumed, never bundled into normal use — and the practice can leave at any time with no change to any other part of the service. The dashboard works fully with zero data sharing.

Comparison is always against a band, such as similar-sized practices in the same nation — never a named practice — and there are no rankings, league tables or percentiles. A pooled figure appears only once at least 12 practices in the band share that same figure, so no practice can be picked out. The practice lead chooses exactly which figures are shared, a practice only sees a comparison for a figure it shares itself, and safe-working signals stay off unless the practice turns them on.

Comparison figures stay inside the app: they never appear in downloads or reports, and nothing derived from a practice’s data is sent anywhere automatically. Every change to these choices is recorded.

We never sell, rent or trade personal data. We use a small number of vetted providers, each bound by equivalent data protection terms:

• Supabase (Germany (Frankfurt) and Ireland, within the European Union / EEA.) — Managed Postgres database, authentication and encrypted file storage for uploaded paper sheets.
• Cloudflare (United Kingdom and European Union edge locations. To deliver pages quickly and block attacks, request metadata may pass through other Cloudflare points of presence worldwide.) — Application hosting, edge delivery, TLS termination and DDoS protection.
• Stripe (United Kingdom and Ireland (EEA), certified PCI DSS Level 1.) — Subscription payments and invoicing. Card details are entered directly with Stripe and never reach our servers.
• Lovable AI Gateway (OpenAI / Google models) (European Union and/or the United States.) — Reads uploaded paper sheets into numbers, transcribes voice notes into text (OpenAI gpt-4o-transcribe) and drafts the entry and the written workload analysis (Google Gemini). Voice audio is forwarded for transcription only and is never stored by us; the transcript is discarded once your draft entry is produced. Only operational workload figures are sent; inputs are not used to train models and are not retained by the model provider for training.

The full list and our processor commitments are set out in the Data Processing Agreement.

Your records are stored in the European Union and handled only in the jurisdictions listed here. We never sell or share data outside these arrangements, and any handling outside the UK or EEA is covered by the UK International Data Transfer Addendum and EU Standard Contractual Clauses, with a transfer risk assessment on file.

If you turn on reminders, the notification itself travels through your device maker's push service. Only a reminder ping and a link back to the app are ever sent — never workload data, names or notes.

Administrative access for support and fault investigation is from the United Kingdom only, on a least-privilege basis.

• In transit: TLS 1.3 (HTTPS), with HSTS enforced.
• At rest: AES-256 at rest, including database backups.
• Access control: Per-row database authorisation (Row Level Security) scoped to the signed-in clinician.
• Hosting: Primary data storage in the European Union (Germany — Frankfurt, and Ireland), with the application served from UK / EU edge locations.
• Sign-in: Email and password or Google sign-in, with hashed credentials handled by the managed auth provider.

While your subscription is active we keep your records so you can see long-term trends. After a subscription ends you have 30 days of full access, then read-only download access, and everything is permanently deleted 90 days after expiry.

Retention and deletion timeline

The full schedule and the wording that binds us are in the Terms of Service (§13 — data retention after cancellation) and the Data Processing Agreement (clause 9 — return and deletion), with plain-English answers in the retention FAQ.

• Access and portability. Download a complete export of everything we hold about you, as JSON or CSV, at any time from Downloads or Settings — no request needed.
• Correction. Change your profile, working pattern and any recorded day yourself in Settings and the diary.
• Erasure. Email hello@studystreaks.co.uk and we will delete your account and personal records within 30 days.
• Objection and complaint. You can object to processing, and you can complain to the Information Commissioner’s Office (ico.org.uk) at any time.

Studystreaks Ltd, company no. SC865254, D-U-N-S © 234235037. Registered office: Studystreaks Ltd, c/o Smith & Wallace & Co., 1 Simonsburn Rd, Kilmarnock, Scotland, KA1 5LA. Data protection enquiries: hello@studystreaks.co.uk.

Data protection and security questions are answered by a named person: Dr Bob Lunan, GP, founder and data protection lead, Studystreaks Ltd.