Privacy Policy
Last updated: 14 October 2026
This policy explains how ClinicShield ("we", "us") collects and uses personal data when you use clinicshield.co.uk and the ClinicShield app.
Who we are
ClinicShield is a trading name of Ashleigh Newman-Jones, a sole trader based in England. We are the data controller for the account and billing information described below. Our registration with the Information Commissioner's Office is in progress. Contact: hello@clinicshield.co.uk.
What we collect
- Account details: your name, email address and role, provided when you sign up or are invited by a colleague.
- Organisation details: organisation name, type, ODS code, ICO number, address, and the names of people in IG roles (e.g. Caldicott Guardian) if you choose to add them.
- Assessment content: your answers, notes, policy documents and any evidence files you upload.
- Billing information: handled by Stripe. We receive your billing name, email, address and subscription status, but never your full card details.
- Usage data: how the site and app are used, and which page or campaign you arrived from. We use cookies for this only with your consent (see our Cookie Policy).
- Google Ads click ID: if you arrive from one of our Google adverts and accept optional cookies, the advert's click identifier (gclid), saved with your organisation when you create one.
- Account events: when you sign up, create an organisation or change your subscription, recorded against your account ID (not your name or email).
ClinicShield is not designed to hold patient data. Please don't upload documents that contain identifiable patient information. If you upload evidence files, remove or redact personal data first.
How and why we use it
| Purpose | Lawful basis |
|---|---|
| Providing your account and the ClinicShield service | Contract |
| Taking payment and keeping financial records | Contract; legal obligation |
| Service emails (invitations, reports you send, DSPT deadline reminders — which you can turn off in Settings) | Legitimate interests |
| Product analytics using cookies | Consent |
| Measuring whether our Google adverts lead to sign-ups and purchases, using the Google Ads click ID | Consent |
| Counting visits without cookies, and measuring sign-ups and subscriptions, so we know which marketing works | Legitimate interests |
| Security, fraud prevention and fixing problems | Legitimate interests |
Who we share it with
We use these service providers (processors), who handle data only on our instructions:
- Clerk — sign-in and account management
- Convex — database and file storage
- Vercel — website hosting
- Stripe — payments
- Resend — email delivery
- PostHog — product analytics and website performance metrics, hosted in the European Union
With your consent, we also share the Google Ads click ID with Google (via PostHog) when you create an organisation or start a subscription, along with the subscription's price, so Google Ads can report which adverts led to it. We don't send your name or email.
Your organisation's assessment data and files are stored by Convex in the European Union (Ireland). Some providers, such as Clerk and Stripe, also process data in the United States. Where personal data leaves the UK, it is protected by safeguards recognised under UK law, such as the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum.
Other members of your organisation's ClinicShield team can see your organisation's assessment, documents and evidence, and your name and email.
How long we keep it
We keep your account and assessment data while your organisation has an account. If you close your account we delete it within 90 days, except billing records, which we keep for 6 years for tax purposes. You can delete evidence files yourself at any time. A Google Ads click ID is kept in your browser for up to 90 days, and we only send it to Google within 90 days of the click.
Your rights
You have the right to access, correct, delete, restrict or object to our use of your personal data, and to data portability. Where we rely on consent you can withdraw it at any time. Contact us at hello@clinicshield.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk.
Security
Data is encrypted in transit and at rest by our providers. Access to your organisation's data is limited to its team members, and only practice managers and admins can manage the team.
Changes
We'll update this page if our practices change and tell you by email about significant changes.