Privacy Policy & Data Protection Notice

1. Information We Collect

We collect personal information directly from you when you register, complete questionnaire modules, log symptoms, or upload medical documents:

• Account & Contact Credentials: Your full name, email address, password hash, and optional National Insurance Number (NINO) if provided for form drafting.
• Special Category Data (Health & Medical Records): Clinical condition descriptions, symptom severity logs, mobility scores, daily living impact details, GP letters, and uploaded medical evidence files.
• Technical & Usage Analytics: Anonymised browser data, interaction timestamps, and consent records. Non-essential analytics (such as Google Analytics 4) are strictly opt-in and consent-gated.

2. Legal Basis for Data Processing (UK GDPR)

We process your personal information under the following lawful bases set out in the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018:

• Contractual Performance (Article 6(1)(b)): Processing is necessary to provide your MyPIPApp account workspace, save your claim drafts, and fulfil one-off stage pack purchases or admin-approved fee relief.
• Explicit Consent for Special-Category Health Data (Article 6(1)(a) & Article 9(2)(a)): Special-category data concerning your health, medical conditions, symptom diary entries, uploaded evidence, and prompts in My PIP Adviser or the PIP Application Writer is processed only with your explicit opt-in consent. You may withdraw consent at any time.
• Legal Obligation (Article 6(1)(c)): Retaining de-identified payment and VAT invoice records for 7 years to comply with UK HMRC tax and accounting laws.
• Legitimate Interests (Article 6(1)(f)): Maintaining site security, enforcing Firebase App Check and reCAPTCHA abuse protection, and preventing unauthorised access.

3. Data Sharing & Third-Party Processors

Data is shared strictly with UK/EU-configured infrastructure sub-processors operating under UK GDPR Data Processing Agreements. We never send claimant health data to OpenAI or any US-hosted (us-* or global) AI service:

4. Data Security & Storage Controls

We enforce multi-layered security controls to protect your medical details:

• Strict Firebase App Check validation and UID tamper protection on all Firestore and Cloud Storage operations.
• TLS 1.3 encryption for all data in transit and AES-256 encryption at rest in europe-west4.
• Owner-only security rules ensuring claimants can read and write only their own records, plus instant local storage and IndexedDB purging on sign-out or Quick Exit.

5. Data Retention & UK/EU Regional Residency

All claimant health records, symptom diary entries, and uploaded evidence files are stored in the European Union (europe-west4, Netherlands) and processed for AI guidance exclusively within the UK (europe-west2, London) and EU (europe-west4), covered by UK adequacy regulations.

• Health & Claim Records: Retained while your account remains active so you can progress from an initial PIP claim through Mandatory Reconsideration or Tribunal appeal. Inactive accounts are scheduled for automated deletion after 24 months of continuous inactivity (following advance email notice), or purged immediately whenever you trigger Account Deletion.
• Statutory HMRC Billing Records (7 Years): When you delete your account, all health data, uploaded documents, and personal identifiers are permanently erased immediately; only anonymised Stripe transaction references required for UK HMRC tax and accounting compliance (Article 6(1)(c) / Article 17(3)(b)) are retained for 7 years.

6. Your Statutory Rights & Account Deletion (Articles 15–22)

Under the UK GDPR and Data Protection Act 2018, you possess full statutory rights over your personal data:

1. Right of Access & Data Portability (Articles 15 & 20): Download a complete, machine-readable JSON archive of all profile information, questionnaire responses, and symptom logs directly from your Account Settings workspace.
2. Right to Erasure / Instant Account Deletion (Article 17): Trigger an immediate, irreversible purge of your entire account, Firestore health records, and Cloud Storage evidence files via your Account Settings workspace (or by emailing [email protected]).
3. Right to Rectification (Article 16): Edit or correct any inaccurate personal details or clinical information directly in your profile settings. Updating your profile on MyPIPApp updates your private drafts only and never notifies the DWP (call the DWP PIP enquiry line on 0800 121 4433 to update official DWP records).
4. Right to Restriction & Right to Object (Articles 18 & 21): Request restriction of processing or object to processing carried out under legitimate interests at any time.
5. Protection Against Automated Decision-Making (Article 22): MyPIPApp never makes automated decisions with legal or similarly serious effects; every AI-generated draft is advisory guidance reviewed by you.
6. Right to Revoke Consent (Article 7(3)): You can withdraw consent for optional analytics or special-category health data processing at any time without affecting the lawfulness of prior processing.

7. Data Controller & Registered Corporate Disclosures