Privacy Policy

1. Introduction

This policy explains how DR COMPASS® Ltd collects, uses and protects personal data when you visit this website, submit a contact enquiry or use the Challenge your prescribing area. It applies to this website, not to patient data processed within the clinical software.

2. Who we are

DR COMPASS® Ltd is the data controller for personal data collected through this website. Our Data Protection Officer can be contacted at enquiries@drcompass.co.uk.

3. Data we collect

We collect only the information needed to operate the site, prevent abuse and respond to you. We do not collect patient identifiable clinical data through this website.

Account data

We collect your email, full name, professional role (GP, ANP, Pharmacist, Nurse or Other) and optional organisation to provide access to full DR COMPASS reports. We retain account data until you delete your account. You can edit or delete your profile, or permanently delete your account, from My account. Google reCAPTCHA protects sign-up. Email verification is required before access. Deleting your profile alone keeps your email sign-in account; deleting your account removes both.

4. How we use and share data

• To respond to enquiries and provide requested information.
• To provide account access and save progress.
• To secure and maintain the website.
• To meet legal and record keeping obligations.

Contact form information is delivered using EmailJS. Google reCAPTCHA receives technical and interaction data to assess whether a submission is genuine. The explainer video is embedded from YouTube in privacy-enhanced mode; YouTube processes viewing data only when you choose to play the video. Our website hosting and authentication providers process data on our behalf. We do not sell personal data and do not use it for advertising or automated decisions with legal effect.

5. Lawful basis

• Consent: when you submit a form after making the required choice.
• Legitimate interests: to respond to professional enquiries and operate and secure the site.
• Legal obligation: when records must be kept by law.

6. Retention

We keep contact enquiries for up to 24 months after the last contact, commercial and accounting records for up to six years where required, and technical security logs for up to 90 days. Browser storage remains until it expires, you clear it or the feature removes it.

7. Your rights

Depending on the circumstances, you may ask to access, correct, erase, restrict or transfer your data, object to processing, or withdraw consent. Contact our Data Protection Officer. You may also complain to the Information Commissioner's Office at ico.org.uk.

8. Cookies and similar technologies

We use essential local and session storage. No analytics service or analytics cookies are currently active. Google reCAPTCHA may set or read cookies and similar identifiers for security. See our Cookie Policy.

9. Security

We use proportionate technical and organisational safeguards, including encrypted connections, access controls and restricted administration. No online service can be guaranteed completely secure.

10. International transfers

Google and EmailJS may process data outside the UK. Where personal data is transferred internationally, we require an applicable adequacy decision, the UK International Data Transfer Agreement or Addendum, or another lawful safeguard.

11. Changes

We may update this policy when our services or legal obligations change. The effective date at the top shows the latest version.