Privacy Policy — PharmTrainTrack

1. Who we are

PharmTrainTrack is a pharmacy apprentice training tracker operated by PharmTrainTrack Ltd (“we”, “us”, “our”).

Data Controller: PharmTrainTrack Ltd
Contact: privacy@pharmtraintrack.co.uk

2. What data we collect

Account data: name, email address, password (hashed), role (trainee / supervisor / admin)
Pharmacy data: pharmacy name, ODS code, NHS shared email address
Training records: task completions, competency observations, sign-off decisions, notes, module passes
Technical data: IP address, browser/device user-agent, login timestamps
Push notification tokens (if you opt in to browser notifications)
Audit logs: who performed which action and when (held for 2 years)

3. Why we collect it (lawful basis)

Purpose	Lawful basis (UK GDPR Art. 6)
Providing the training tracker service	Contract (Art. 6(1)(b))
Verifying pharmacy identity via NHS ODS	Contract (Art. 6(1)(b))
Security monitoring and audit logging	Legitimate interests (Art. 6(1)(f))
Complying with regulatory requirements (GPhC, MCA/MCDC)	Legal obligation (Art. 6(1)(c))
Sending transactional emails (verification, notifications)	Contract (Art. 6(1)(b))

4. Where your data is stored

Database: Supabase (AWS eu-west-2, London, UK) — all training records and personal data
API servers: Render (Frankfurt, EU) — processes requests in transit
Web portal: Vercel (CDN with EU edge nodes) — serves the application
Transactional email: Resend (US-based processor) — email addresses are shared only to deliver verification and notification emails, under a data-processing agreement

All data at rest is encrypted. Resend transfers are protected under standard contractual clauses (SCCs).

5. How long we keep your data

Active account data: held for the duration of your account
Training records: retained for 6 years after programme completion (GPhC regulatory requirement)
Audit logs: 2 years
Deleted accounts: personal identifiers are immediately scrubbed; anonymised training records are retained per the above schedule

6. Your rights under UK GDPR

You have the right to:

Access the personal data we hold about you (Art. 15)
Correct inaccurate data (Art. 16)
Erase your account and personal data (Art. 17) — available via Settings in the app
Restrict processing in certain circumstances (Art. 18)
Data portability of data you provided to us (Art. 20)
Object to processing based on legitimate interests (Art. 21)

To exercise any of these rights, email privacy@pharmtraintrack.co.uk. We will respond within 30 days.

7. Cookies and tracking

We use only a single session cookie (JWT authentication token) strictly necessary for you to stay logged in. We do not use advertising, analytics, or tracking cookies.

8. Security

We implement technical and organisational measures aligned with ISO 27001, including: TLS 1.2+ in transit, AES-256 encryption at rest, bcrypt password hashing, account lockout after failed logins, rate limiting, and comprehensive audit logging.

9. Complaints

If you have concerns about how we handle your data, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we will notify admin users by email. The “last updated” date at the top of this page reflects the most recent revision.