The short version
- This page sets out, in detail, how CliniPro processes data: who handles it, where it is stored, how reports are made and how it is protected.
- One PCN Training Ltd is the data controller. Four providers process data for us, under written contracts.
- Your account and portfolio are stored in the European Union.
- Reports are built on your own device. Patient references and evidence files never go into them.
Who is responsible
One PCN Training Ltd (company number 14660730, registered office 7 Bell Yard, London, WC2A 2JR), trading as CliniPro, is the controller. It decides why and how personal data is processed, and is responsible for it under the UK GDPR and the Data Protection Act 2018.
The providers below are processors. They act only on our instructions, under data processing terms that meet UK requirements.
Apple and Google, which distribute the app, are separate controllers for app downloads and act under their own privacy policies. They do not receive portfolio data.
Our processors
| Provider | Service | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Supabase, Inc. | Sign-in and account security | Email address, password hash, sign-in sessions | Ireland (EU) | EU adequacy; Supabase's data processing terms for any access from outside the UK and EU |
| Cloudflare, Inc. | The app's server, database (D1) and file storage (R2); website hosting (Pages); bot protection (Turnstile) | Account and portfolio data, evidence files, supervisor directory, audit trail; technical data for delivery and security | European Union for stored data; a global network for delivery and security | EU adequacy; Cloudflare's Data Processing Addendum with the UK's approved transfer terms |
| Sendinblue SAS (Brevo) | Sending email | Recipient address and message: support messages, supervisor confirmations, patient feedback links, account reminders | France (EU) | EU adequacy |
| Hostinger International Ltd | Hosting our email inboxes | Messages sent to us, including support form messages | European Union | EU adequacy |
We will update this list before adding or replacing a processor. Where a provider uses its own sub-processors, it is bound to hold them to the same standards.
What we process, and why
| Activity | People | Data | Lawful basis | Kept for |
|---|---|---|---|---|
| Accounts and sign-in | Clinicians | Name, email, phone, password hash, practice details, role, registration number, training status, start date, optional photo | Contract | While the account is open |
| The portfolio | Clinicians | Cases, competencies, reflections, encrypted patient reference, status, reference numbers | Contract | Six years, then the clinician's choice |
| Evidence | Clinicians | Photos, scans, videos and voice notes attached to a case | Contract | With the case |
| Supervisor directory | Supervisors | Name, register, registration number; hidden email address | Legitimate interests | While any record refers to the supervisor |
| Sign-off and confirmation | Supervisors | Feedback (written or audio), signature, time, confirmation status | Legitimate interests | With the case |
| Patient feedback | Patients | Email address, used once and discarded; anonymous rating and comment | Legitimate interests | Email: not kept. Response: with the case |
| Retention reminders | Clinicians | Email address, notification status, the clinician's choice | Contract | With the account |
| Audit trail | Everyone using the app | Who viewed, changed or exported which record, and when | Legitimate interests; legal obligation (security) | As long as the records it relates to |
| Support and app feedback | Anyone who contacts us | Name, email, optional role, message, topic details, optional app version and platform | Legitimate interests | Up to 24 months after the conversation ends |
| Security and delivery | Everyone | IP address, device and browser details, request logs | Legitimate interests; legal obligation (security) | Days, unless needed for an investigation |
Keeping patients out of the record
CliniPro is designed so that it never needs to identify a patient.
- No field asks for a patient's name, NHS number, date of birth or contact details, and the app tells clinicians not to enter them.
- The optional patient reference is the clinician's own code. It is encrypted by CliniPro before it is stored, shown only to that clinician, and excluded from every report and export.
- A patient feedback request uses the patient's email address only to send the link. It is never written to our database. The response carries no name or address.
- If identifying information is entered by mistake, the clinician can edit or delete it, or ask us to remove it.
How reports are made
All three reports are generated on the clinician's own device, from entries already in their portfolio. CliniPro's servers do not build them or keep copies.
| Report | Contains |
|---|---|
| Competency Checklist (PDF) | The One PCN competency grid, with each competency placed at the first review point after the case that showed it, measured from the clinician's start date |
| Portfolio Summary (PDF) | Cases for the chosen period, with reflections and supervisor sign-off, each marked Self-recorded, Signed or Verified |
| Data export (CSV) | Every entry for the chosen period, as a spreadsheet |
- Never included: patient references and evidence files. A report states how many files are held, so a reader knows supporting material exists.
- Drafts are left out, and the report states how many.
- The PDFs show the clinician's name, role and registration number. Every report, including the spreadsheet, states the period and the date it was made, and ends with a note that it was generated from the clinician's own entries and that the checklist is not an official NHS or regulator document.
- Sharing is done by the clinician, through their device's share options. The audit trail records that an export happened, its type and its period, not its contents.
Security measures
| Area | Measure |
|---|---|
| In transit | Every connection is encrypted (HTTPS/TLS) |
| At rest | Stored data is encrypted by our providers; the patient reference is additionally encrypted by CliniPro |
| Passwords | Held only as a one-way hash by our sign-in provider |
| Access to data | Every server request must carry a valid, signed sign-in token, and each account can reach only its own records |
| Evidence files | Private storage; reached only through signed links that expire after minutes |
| Supervisor emails | Hidden from every user; used only by the server to send confirmations |
| Integrity | Signed feedback is locked under the signature; sign-offs can be confirmed by email |
| Accountability | An audit trail of views, changes and exports |
| Abuse | Bot protection on sign-up and forms; strict validation of everything the server receives |
| Our team | Access limited to the people who need it, protected with two-factor authentication |
Retention and reminders
Portfolio records are kept for six years. Before that period ends, the clinician is reminded in the app and by email, and decides whether the records are kept for longer.
- 3 monthsbefore
- 1 monthbefore
- 15 daysbefore
- 7 daysbefore
- 2 daysbefore
- Final emailthen records may be deleted
If the clinician asks us to keep the records, they continue to be stored. If we receive no reply, we send a final email, after which the records may be deleted. Deleted data leaves our live systems within 30 days and our backups within a further 30 days.
If something goes wrong
If we become aware of a personal data breach, we contain it, assess the risk and record what happened. Where the law requires it, we notify the Information Commissioner's Office within 72 hours, and we tell affected people without undue delay if the breach is likely to put them at high risk.
Requests about your data
Anyone can ask to access, correct, delete, restrict, object to or receive a copy of their data. Use the support form and choose Privacy and your data, or email info@clinipro.uk. We reply within one month, and may first confirm the requester's identity. Full details are in our Privacy Policy.
Practices and PCNs
CliniPro is used by individual clinicians, who each hold their own account. If your practice or Primary Care Network needs information about CliniPro for its own data protection records, contact us through the support form, choosing Practices and PCNs.
Sources and references
- Data Protection Act 2018, legislation.gov.uk
- UK GDPR guidance and resources, Information Commissioner's Office
- International transfers, Information Commissioner's Office
- Customer Data Processing Addendum, Cloudflare
- Privacy Policy, Supabase
- Privacy Policy, Brevo
- Revalidation, General Medical Council
- Revalidation, Nursing and Midwifery Council
- Revalidation and renewal, General Pharmaceutical Council
- Continuing professional development, Health and Care Professions Council