Trust & privacy

Privacy Notice

How we collect, use, and protect personal data — including special-category data about children — across the Rconnected website and platform.

DRAFT — pending legal review. This document is a working draft published for transparency. It has not yet been reviewed by legal counsel, is not legal advice, and is not yet contractually binding. Last reviewed: Not yet reviewed.

This notice is provided under the UK GDPR (Articles 13–14) and the Data Protection Act 2018. It is a working draft; the lawful bases, retention periods, and named officer below are marked for confirmation by an appointed Data Protection Officer (DPO).

1. Who we are

Rconnected Ltd (“Rconnected”, “we”) operates this website (rconnected.health) and the care-coordination platform at app.rconnected.health. We are being incorporated as a private limited company in London, United Kingdom (company registration in progress). For the personal data described here we act as a data controller; when we process care records on behalf of a school, NHS service, or local authority, we act as their data processor under a separate data-processing agreement.

Data Protection Officer: [to be appointed]. Until a DPO is named, privacy enquiries are handled by the founding team via the contact below.

2. What this notice covers

This notice covers the marketing website and general enquiries. Personal and clinical data processed inside the platform (care plans, behavioural records, clinical notes) is governed by the in-product privacy information and the data-sharing agreement between your organisation and Rconnected — not by this page.

3. The data we collect

From website visitors

Demo / contact requests: the name, email, role, organisation, and message you submit through our forms.
Technical data: minimal, privacy-respecting request logs needed to run and secure the site. We do not use advertising cookies (see our Cookie Policy).

Within the platform

The platform processes special-category data (UK GDPR Article 9) — including health, neurodevelopmental, and educational information about children — strictly on behalf of, and under the instructions of, the commissioning organisation.

4. Why we use it, and our lawful basis

To respond to enquiries — lawful basis: legitimate interests (Article 6(1)(f)), namely responding to a request you initiated.
To deliver the platform — for care records, the relevant Article 6 basis and the Article 9 condition (e.g. provision of health or social care, or explicit consent) are set in the agreement with the commissioning organisation. [exact conditions pending DPO confirmation]

5. Children’s data

Rconnected exists to coordinate care for children with neurodevelopmental needs, so the platform necessarily processes data about children. This data is entered and accessed by authorised professionals and parents/carers under the commissioning organisation’s governance. This marketing website is not directed at children and we do not knowingly collect data from children through it.

6. Who we share it with

We do notsell personal data. Within the platform, information is shared between the child’s authorised care team (family, school, clinicians) — that multi-agency sharing is the purpose of the service and is governed by access controls and the data-sharing agreement. We use a small number of vetted processors (hosting, email) under contract. A sub-processor list is being maintained as part of our records of processing.

7. How long we keep it

Retention periods are being set as part of a data-retention schedule and are pending Data Protection Officer review. We have built the mechanism to enforce retention once those periods are confirmed; today nothing is auto-deleted. See the platform’s in-product Data & retention settings.

8. Your rights

You have the right to:

access a copy of your personal data;
have inaccurate data corrected;
request erasure, where applicable;
data portability (a machine-readable export);
restrict or object to certain processing.

Platform users can export their own data and raise a data-subject request directly in the app’s Settings → Data area. Otherwise, contact us using the details below.

9. Security & international transfers

We protect data with encryption in transit and at rest, role-based access control, mandatory multi-factor authentication, and audit logging. Our infrastructure is hosted in the European Union. See our Security & compliance statement for the honest current status of our certifications and governance work.

10. Complaints & contact

Privacy enquiries: privacy@rconnected.health [mailbox being provisioned]. If you are in the UK and unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk); in the EU, to your local supervisory authority.