INFORMATION GOVERNANCE · PRIVACY
Staff Privacy Notice
How RTT Buddy handles the personal data of the staff who use it.
| Document owner | Ali Robinson, Product Owner |
|---|---|
| Service provider | [Operator legal entity name and registered address] |
| Approved by | [Customer IG group / DPO to confirm] |
| Effective date | [DD Mmm YYYY] |
| Next review | [DD Mmm YYYY] |
This notice mirrors commercial software-as-a-service practice. Some details depend on the adopting organisation and its Data Protection Officer; these are marked [Customer to confirm]. This notice should be read with the RTT Buddy User Terms of Service, the Acceptable Use Policy, and the Data Processing Agreement between the provider and the customer.
1 About this notice
This notice explains what personal data RTT Buddy collects about you as a member of staff who uses it, why we process it, who we share it with, how long we keep it, and your rights. RTT Buddy is a commercial guidance service provided to NHS organisations for Referral to Treatment pathway administration.
2 Who is responsible for your data
RTT Buddy operates on a controller and processor model:
| Role | Who | For what |
|---|---|---|
| Data controller | Your organisation (the adopting NHS body) | Your staff account data and the query content you submit through the service. |
| Data processor | [Operator legal entity], the RTT Buddy provider | Processes that data only on your organisation's documented instructions, under a written Data Processing Agreement. |
| Provider as controller | [Operator legal entity] | A limited set of provider-side processing: account security, service operation and support, billing and administration, and aggregated service improvement. |
3 What personal data we process
| Category | Examples |
|---|---|
| Account data | Name, work email address, job role or band, organisation and assigned unit or reference. |
| Authentication and audit data | Sign-in events, timestamps, session and security metadata, and a de-identified record of how each answer was reached. |
| Query content | The de-identified RTT scenarios you type. These should contain events and timings only, never patient-identifiable data. |
| Usage data | Aggregated analytics about how the service is used, used to monitor safety and improve the product. |
We do not knowingly process patient-identifiable data, and we do not process special category data about identifiable patients. A server-side guardrail is designed to block identifiers before processing.
4 Why we process it
- to give you access to the service and authenticate you;
- to generate cited RTT guidance in response to your questions;
- to keep the service secure and to detect and investigate misuse;
- to maintain an audit trail for assurance and clinical safety;
- to provide support, and to improve the accuracy and safety of the product; and
- to administer the contract with your organisation.
5 Our lawful basis
Where your organisation is the controller, it determines the lawful basis. For NHS bodies this is normally UK GDPR Article 6(1)(e), the performance of a task carried out in the public interest [Customer to confirm with its Data Protection Officer].
Where the provider acts as controller for the limited processing described in section 2, the lawful bases are UK GDPR Article 6(1)(b), performance of a contract, and Article 6(1)(f), legitimate interests in operating, securing, and improving the service. No special category data is processed, so no Article 9 condition is required.
6 Who we share it with
We do not sell your personal data. We use a small number of vetted sub-processors to run the service, each under a written contract with appropriate safeguards:
| Sub-processor | Purpose | Location |
|---|---|---|
| Render | Application hosting | Frankfurt, EEA |
| Supabase | Authentication and database | EU region |
| Amazon Web Services (Bedrock) | Large language model inference | London, United Kingdom |
| [Other sub-processors] | [Purpose] | [Location] |
The language model processes your de-identified queries to generate answers. It is configured so that your data is not used to train the model and is not retained by the model provider. We may also disclose data where required by law.
7 International transfers
Language model processing takes place in the United Kingdom, so there is no international transfer for that processing. Hosting and database services are located in the European Economic Area, which the UK recognises as providing an adequate level of protection. If any processing later involves a transfer outside the UK or EEA, we will put appropriate safeguards in place, such as the International Data Transfer Agreement or Standard Contractual Clauses.
8 How long we keep it
Retention periods are set with your organisation and configured per contract. Our default positions are:
| Data | Default retention |
|---|---|
| Account data | For as long as you have access, then deleted within [6 months] of access ending. [Customer to confirm] |
| Authentication and audit data | Retained for [12 months] for assurance and clinical safety, then deleted or anonymised. [Customer to confirm] |
| Query content | Retained for [12 months] in de-identified form, then deleted or anonymised. [Customer to confirm] |
| Usage analytics | Retained in aggregated, anonymised form, which is no longer personal data. |
On termination of the contract, your organisation's data is deleted or returned in line with the Data Processing Agreement.
9 How we protect it
We apply encryption in transit and at rest, role-based access controls, strict separation between organisations so one customer can never see another's data, and supplier assurance aligned to the NHS Data Security and Protection Toolkit. Access to data is limited to those who need it to operate the service.
10 Your rights
You have rights over your personal data, including the right to be informed, and to request access, rectification, erasure, restriction, objection, and portability, subject to the conditions in UK GDPR. Because your organisation is usually the controller, please exercise these rights through its Data Protection Officer in the first instance; the provider will support any request promptly.
11 Automated decision-making
RTT Buddy provides guidance and decision support. It does not make automated decisions that produce legal or similarly significant effects about you, and it does not carry out automated decision-making about individuals within the meaning of Article 22 of the UK GDPR.
12 Contact and complaints
For questions about your data, contact your organisation's Data Protection Officer [Customer to confirm contact]. For questions about the service itself, contact the provider at [Operator contact / DPO email]. If you are not satisfied, you have the right to complain to the Information Commissioner's Office at ico.org.uk.
13 Changes to this notice
We may update this notice to reflect changes to the service, sub-processors, or the law. The version and date are shown in the document control table, and material changes will be communicated to your organisation.