Keptura Privacy Notice

1. The short version

Your documents stay yours. Keptura keeps your certificates, training and identity documents on your own device. They are not uploaded to us and we cannot read them.

What we hold is an account record: who you are, that you have paid, and that the app is working. That is all. Nothing in this notice should surprise you, and if any of it does, please tell us.

2. Who controls your data

Patient Thread Ltd controls the account data described in section 4. It is not the controller of the documents you store in the app: those remain under your control in your own storage, as set out in section 3.

To contact us about your data: chris@patientthread.com

3. Where your documents live

This is the most important thing to understand about Keptura, and it is a deliberate design decision rather than an accident.

• Your records and documents are held on your device, in the app's own storage. They are not sent to us, and there is no Keptura server holding a copy.
• If you have your device's own backup switched on (iCloud Backup on iPhone and iPad, or the equivalent on other platforms), your device includes the app in that backup under your account, governed by that provider's terms. That is your backup, not ours, and you can turn it off.
• You move or keep your own copy through the app's encrypted export (see section 13).

Because of this, we cannot produce a copy of your documents if you ask, and we cannot recover them if you lose your device without a backup or export. Section 13 explains how to keep your own copy.

4. What we collect and why

The account record we hold consists of:

• Your name, email address, profession, country of practice and professional registration number
• Your subscription state: whether it is active, when it expires, and which of the three routes it came from (App Store, our website, or a code issued by an organisation)
• Basic technical logs needed to keep the service running and secure

Legal basis

Performance of a contract (UK GDPR Article 6(1)(b)) to provide the subscription you have bought; legitimate interests (Article 6(1)(f)) in operating the service securely; and legal obligations (Article 6(1)(c)) for accounting records.

If your access was provided by a defence organisation, employer or similar body, we tell them only that a code they bought has been redeemed and when it expires. We do not tell them anything about what you keep in the app, whether you use it, or what your record contains.

5. Forwarding documents by email

Every account can be given an email address so that certificates and payslips can be forwarded in rather than saved and uploaded by hand. If you use it:

• We receive the forwarded message, take the attachments, file them to your storage, and then delete the message. It is not retained, archived or backed up.
• We keep a short log of what happened: the sending address, the subject line, and whether the attachments were filed or refused. We do not keep the body of the message or the attachments themselves.
• We accept mail only from addresses you have confirmed, and only where the sending domain passes DKIM or SPF authentication. Mail that fails is refused and logged, not filed.

Forwarded messages may contain personal data about other people, for example the colleague who emailed you a certificate. For the short period we hold such a message we act as your processor. This is why we delete it immediately and why the address only accepts mail you have chosen to send.

Legal basis

Performance of a contract (Article 6(1)(b)); and our legitimate interests, and yours, in a secure and abuse-resistant service (Article 6(1)(f)).

6. Voice notes and transcription

You can record a spoken reflection instead of typing one. Recording and transcription both happen on your own device. The audio is not uploaded to us and is not sent to any transcription service. Both the recording and the resulting text are stored with the rest of your documents, under your control.

7. Health and other sensitive data about you

A professional record can contain special category data about you: an occupational health clearance, an immunisation record, a health declaration in an appraisal, or a reflection that mentions your own health.

This data stays in your own storage and we do not process it. Where a feature does touch it, for example when the app reads a certificate to fill in its dates, that reading happens on your device.

Legal basis — special category data

Your explicit consent (Article 9(2)(a)), given by choosing to store such a document. You can delete any document at any time, which withdraws that consent for the future.

8. No patient data

The app actively enforces this. Documents are screened before they are filed, and anything bearing the marks of clinical correspondence, such as a patient name and date of birth, an NHS number, or the shape of a clinic letter, is refused rather than stored. Refusals are logged so you can see what happened.

If you need a system for patient records, that is a different product with different obligations. See the Patient Thread privacy notice.

9. How long we keep things

• Forwarded email messages: deleted as soon as the attachments are filed, normally within seconds.
• Forwarding log entries: 12 months.
• Account record: for as long as your subscription is active, then 12 months, then deleted.
• Accounting records of payments: 6 years, because we are legally required to keep them.
• Your documents: for as long as you keep them. They are in your storage, so deletion is yours to perform and takes effect immediately.

10. Who else is involved

We keep this list as short as we can.

• Apple — hosts your documents in your own iCloud account, and processes App Store payments. Apple does not tell us your payment details.
• Google — equivalent role on Android, if you use it.
• Stripe — processes payments made through our website. Card details go to Stripe, never to us.
• Our email provider — carries forwarded messages for the seconds before they are processed and deleted.

We do not sell data, we do not share it for advertising, and we do not use it to train anything.

11. International transfers

Apple, Google and Stripe operate internationally and may process data outside the UK. Each is covered by the UK International Data Transfer Addendum or equivalent safeguards. Your documents themselves follow the rules of the cloud account you chose, which you can inspect and change independently of us.

12. Security

• Documents are held in your own storage, so a breach of our systems does not expose them. This is the main security property of the design.
• Exports are encrypted with AES-256-GCM using a passphrase only you hold. We cannot open an export and cannot recover a lost passphrase.
• Forwarding accepts mail only from confirmed addresses that pass sender authentication.
• Access to any account data we do hold is limited to those who need it, and administrative accounts require multi-factor authentication.

13. Your rights, and getting your data out

You have the right to access, correct, delete and port your data, to object to or restrict processing, and to withdraw consent.

Portability is built in rather than a request you have to make: the app produces a single encrypted export containing every record and every document. Once decrypted it is an ordinary archive, with the records as plain text and the documents as ordinary PDFs and images. It does not need our software to be read, which is deliberate.

To exercise any right, email chris@patientthread.com. We respond within one month.

14. Complaints

Please raise any concern with us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

15. Changes to this notice

If we change how the app handles your data we will update this notice and, where the change is material, tell you in the app before it takes effect.