Privacy Policy

Privacy Policy Effective date: 02 July 2026 Provider: A&A Healthcare Solutions Ltd, a company registered in England and Wales, (“we”, “us”, “our”). Service: MedicalRota, the rota, workforce, training and compliance web application. 1. Introduction A&A Healthcare Solutions Ltd operates MedicalRota, a rota, workforce, training, portfolio, compliance and reporting web application. We are committed to protecting personal data and respecting privacy in accordance with applicable data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, store, share and protect personal data when you access or use MedicalRota, create an account, communicate with us, or interact with our website or related services. This Privacy Policy should be read alongside our End User Terms of Use, Cookie Policy and, where applicable, any separate customer agreement or data processing agreement between us and your organisation. 2. Our role: controller and processor MedicalRota may involve different types of personal data. Our role depends on the context. 2.1 Where we act as controller A&A Healthcare Solutions Ltd is the controller for personal data we decide how and why to use. This may include: - Account registration and login information; - User support and communications; - Security, audit and system monitoring information; - Website and cookie data; - Marketing preferences; - Billing and customer administration information, where applicable; - Feedback, testimonials and product improvement information. Where we are the controller, we are responsible for explaining how and why we use your personal data and for responding to data protection rights requests. 2.2 Where we act as processor Where MedicalRota is used by an employer, NHS trust, department, rota team, training programme, university, GP practice, local authority or other organisation, that organisation will usually be the controller for rota, workforce, staff, training, portfolio, compliance and organisational data entered into the Service. In that situation, we process the data on behalf of that organisation as its processor and in accordance with its documented instructions, any applicable customer agreement and any applicable data processing agreement. If your account is linked to an organisation and your request relates to rota, workforce, employment, training, leave, compliance or organisational data controlled by that organisation, we may need to refer your request to that organisation. 2.3 No assumption of organisational approval Creating an account, being invited to MedicalRota, using an organisational email address, selecting an organisation within the Service, accessing a demonstration environment, or being able to log in does not mean that your organisation has approved MedicalRota or that any particular data protection, information governance, procurement, cyber security, clinical safety, DTAC, DPIA, data processing, contractual or other organisational approval, certification or agreement is in place. Unless appropriate approvals, agreements and assessments have been confirmed by your organisation, you must not use MedicalRota for live operational use or enter real, confidential, patient-identifiable, sensitive, employment, rota or organisational data. 3. Personal data we may collect Depending on how MedicalRota is used, we may collect or process the following types of personal data. 3.1 Account and identity data - Name; - Email address; - Username or display name; - Organisation; - Department, team or rota group; - Role or permission level; - Job title, staff group, grade, specialty or training level; - Account status and authentication information. We do not usually see or store your plain-text password where authentication is handled by a secure authentication provider. 3.2 Rota and workforce data Where entered by you, your organisation or another authorised user, MedicalRota may process: - Rota assignments; - Shift patterns; - Working locations; - On-call duties; - Leave requests or leave records; - Absence information where authorised; - Rota gaps; - Staffing requirements; - Team membership; - Availability information; - Rota notes or administrative comments; - Exception, compliance or escalation information; - Audit records of rota changes. 3.3 Training, portfolio and compliance data Where MedicalRota is used for training, portfolio or compliance workflows, we may process: - Training requirements; - Sign-off status; - Portfolio readiness information; - Appraisal, supervision or progression-related administrative records; - Teaching, audit, QI, clinic, procedural or workplace-based assessment tracking; - Compliance flags, completion status and supporting administrative notes. MedicalRota is not intended to replace formal appraisal, ARCP, revalidation, employment, HR or regulatory systems unless this has been expressly agreed and approved by the relevant organisation. 3.4 Support, feedback and communications data We may collect: - Support requests; - Emails and messages sent to us; - Feedback, suggestions or comments; - Issue reports; - Survey responses; - Testimonials, where provided; - Records of consent or communication preferences. 3.5 Technical, usage and audit data We may collect: - IP address; - Device and browser information; - Login records; - Timestamps; - Account activity; - Audit logs; - Pages or features accessed; - Error logs; - Security events; - System events; - Cookie and analytics data, where applicable. This information helps us operate, secure, maintain, troubleshoot and improve MedicalRota. 3.6 Payment and billing data If MedicalRota includes paid services, subscriptions, invoices or customer billing, we may process limited billing and transaction information. Payments, where applicable, may be processed by a third-party payment provider. We do not usually store full payment card details ourselves. 4. Special category data and patient-identifiable data MedicalRota is not intended to store patient-identifiable clinical records. Unless we have expressly agreed otherwise in writing with your organisation, you must not enter patient names, NHS numbers, hospital numbers, clinical notes, diagnoses, treatment information, appointment information or other patient-identifiable information into MedicalRota. MedicalRota may process special category data only where this is entered by or on behalf of an organisation and where that organisation has confirmed that such processing is authorised and lawful. This may include limited health-related information, such as sickness or absence information, where this is necessary for approved rota, workforce or employment administration purposes. Users should avoid entering detailed medical information, diagnoses, symptoms or clinical notes about staff members unless this has been expressly authorised by the relevant organisation and is necessary for an approved purpose. Where your organisation controls this data, your organisation is responsible for identifying the appropriate lawful basis and special category condition for processing. 5. How we use personal data We may use personal data for the following purposes: 5.1 To provide and operate MedicalRota We use personal data to: - Create and manage user accounts; - Authenticate users; - Provide access to MedicalRota; - Display rota, workforce, training, portfolio and compliance information; - Manage user roles and permissions; - Enable authorised users to create, edit, review, export or manage relevant records; - Provide support, maintenance and troubleshooting. Where we act as controller, our legal basis is usually performance of a contract or our legitimate interests in providing, securing and administering MedicalRota. Where we act as processor, we process this data on behalf of your organisation and your organisation is responsible for identifying the relevant lawful basis. 5.2 To support organisational rota and workforce administration Where MedicalRota is used by an organisation, personal data may be processed to support: - Rota planning; - Workforce visibility; - Rota gap management; - Leave administration; - Staffing reports; - Training requirement tracking; - Portfolio and compliance tracking; - Audit and governance workflows; - Operational reporting. Where your organisation is the controller, your organisation is responsible for determining the lawful basis for this processing. 5.3 To secure and monitor the Service We use technical, audit and usage data to: - Protect accounts; - Detect unauthorised access; - Investigate suspicious activity; - Maintain audit logs; - Prevent misuse; - Troubleshoot errors; - Protect the security, integrity and availability of MedicalRota. The legal basis is usually our legitimate interests in maintaining a secure and reliable service, compliance with legal obligations, or processing on behalf of your organisation. 5.4 To communicate with you We may use contact details to: - Respond to enquiries; - Provide support; - Send service notices; - Send security alerts; - Notify users of important account or policy changes; - Communicate about incidents, downtime or maintenance. The legal basis is usually performance of a contract, legitimate interests, legal obligation, or processing on behalf of your organisation. 5.5 To improve MedicalRota We may use feedback, usage patterns, aggregated statistics, error logs and support trends to: - Improve functionality; - Fix bugs; - Develop new features; - Improve user experience; - Monitor performance; - Understand how the Service is used. Where possible, we use aggregated or anonymised information for service improvement. 5.6 Marketing and optional communications We may send marketing communications only where we have a lawful basis to do so, such as consent or legitimate interests, depending on the context. You can opt out of marketing communications at any time. We will still send essential service, account, security and legal notices where necessary. 6. Legal bases for processing Where we act as controller, we may rely on the following legal bases: - Contract: to provide MedicalRota, manage your account, deliver support and operate services you or your organisation have requested. - Legitimate interests: to secure, maintain, improve and administer MedicalRota, prevent misuse, respond to enquiries and manage our business. - Consent: for optional marketing communications, optional analytics cookies or other optional features where consent is required. - Legal obligation: to comply with applicable laws, regulatory obligations, tax, accounting, audit, security or legal requirements. - Vital interests or public task: these are not expected to be routine legal bases for our own controller processing, but your organisation may rely on different legal bases depending on its role and purpose. Where we act as processor, we process personal data on behalf of your organisation in accordance with its instructions. Your organisation is responsible for identifying and explaining its lawful basis for processing. 7. Automated decision-making and profiling MedicalRota may display rota, workforce, compliance, training or portfolio information based on data entered into the Service. MedicalRota is not intended to make automated decisions that produce legal or similarly significant effects without human review. Users and organisations must not rely on MedicalRota as the sole basis for final decisions about employment, pay, training progression, ARCP, appraisal, revalidation, disciplinary action, clinical deployment, safe staffing, patient safety or regulatory compliance. 8. Who we share personal data with We do not sell personal data. We may share or make personal data available to the following categories of recipients where necessary: 8.1 Your organisation and authorised users Where your account is linked to an organisation, authorised administrators or users within that organisation may be able to view, manage, export, amend or delete certain information associated with your account, rota, team, training records, compliance records, activity or use of MedicalRota. 8.2 Service providers and sub-processors We may use trusted third-party providers to operate MedicalRota, including providers of: - Cloud hosting; - Database hosting; - Authentication; - Email delivery; - Analytics; - Monitoring and logging; - Payment processing, where applicable; - Support and helpdesk tools; - Document storage or backup services. Current or expected providers may include: - Supabase, for database hosting and authentication; - Vercel, for application hosting; - Resend, for automated emails. Third-party providers are required to process personal data only for authorised purposes and with appropriate safeguards. 8.3 Legal, regulatory or professional advisers We may share personal data where necessary with: - Legal advisers; - Accountants; - Insurers; - Auditors; - Regulators; - Law enforcement bodies; - Courts or public authorities. We will only do this where required or permitted by law, or where necessary to protect our rights, users, organisations, systems or the Service. 8.4 Business transfers If our business, assets or Service are sold, transferred, merged, reorganised or acquired, personal data may be transferred to the relevant buyer, successor or professional advisers as part of that process, subject to appropriate safeguards. 9. International transfers Some of our service providers may process personal data outside the United Kingdom. Where this happens, we will take steps designed to ensure that appropriate safeguards are in place, such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms. 10. Data retention We keep personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods may depend on: - Whether your account remains active; - Whether your organisation continues to use MedicalRota; - The terms of any customer agreement or data processing agreement; - Legal, accounting, audit or regulatory requirements; - Security, dispute or incident investigation needs; - Whether data has been deleted, exported or anonymised. As a general guide: - Account data is retained while your account remains active and for a reasonable period afterwards; - Support and communication records may be retained for a reasonable period to manage enquiries, disputes and service history; - Audit logs and security records may be retained for a reasonable period for security, compliance and incident investigation; - Billing and financial records, where applicable, may be retained for up to 7 years; - Rota, workforce, training, portfolio and compliance data controlled by your organisation will usually be retained according to your organisation’s instructions, customer agreement, data processing agreement or agreed retention settings. Where data is no longer required, we will delete, anonymise or securely archive it, unless we are required or permitted to retain it. 11. Your rights Under UK data protection law, you may have the right to: - Access your personal data; - Correct inaccurate personal data; - Request deletion of your personal data; - Restrict processing; - Object to processing; - Request data portability; - Withdraw consent where processing is based on consent; - Complain to the Information Commissioner’s Office. These rights are subject to legal limits and may depend on whether we act as controller or processor for the relevant data. If your request relates to account, security, support, website, marketing or billing data for which we are controller, you can contact us using the details below. If your request relates to rota, workforce, employment, leave, training, portfolio, compliance or organisational data controlled by your organisation, you may need to contact your organisation directly. We may also forward or refer your request to your organisation where appropriate. 12. Cookies and similar technologies MedicalRota may use cookies and similar technologies. We may use essential cookies for authentication, account security, session management and core platform functionality. We may use optional analytics or performance cookies only where required consent has been obtained. You can manage cookie preferences through our cookie banner or settings where available. For further details, please see our Cookie Policy. 13. Security We use appropriate technical and organisational measures designed to protect personal data. These may include: - Encryption in transit; - Encryption at rest where supported by our providers; - Secure authentication; - Role-based access controls; - Row-level security or equivalent access restrictions; - Audit logging; - Monitoring and alerting; - Backup and recovery controls; - Least-privilege access controls; - Internal access restrictions; - Incident response processes; - Supplier due diligence. No system is completely secure. Users must also protect their own accounts, use strong passwords or approved authentication methods, and notify us promptly of suspected unauthorised access or security issues. 13.1 Data accuracy and user responsibility MedicalRota depends on information entered by users and organisations. Users and organisations are responsible for ensuring that personal data entered into MedicalRota is accurate, relevant, up to date, necessary and authorised. Where you believe information about you is inaccurate, you should contact your organisation or contact us using the details below, depending on who controls the relevant data. 14. Confidentiality MedicalRota may contain confidential workforce, rota, training, compliance or organisational information. Users must only access, use, disclose or export information where authorised and necessary for their role. Where your account is linked to an organisation, your organisation may have additional confidentiality, information governance, HR, employment, clinical safety or security policies that apply to your use of MedicalRota. 15. Children MedicalRota is intended for adult professional, organisational, workforce, rota, training and administrative use. It is not intended for children, and users must be at least 18 years old. 16. Demonstration, trial and evaluation use Where MedicalRota is used for demonstration, trial, testing or evaluation purposes, users should use dummy, anonymised or otherwise approved data unless their organisation has confirmed that real data may be used and that appropriate approvals, agreements and assessments are in place. Users must not enter real, confidential, patient-identifiable, sensitive, employment, rota or organisational data into a demonstration, trial or evaluation environment unless appropriate authorisation, approvals, agreements and assessments are in place. 17. Changes to this Privacy Policy We may update this Privacy Policy from time to time. Where changes are significant, we will take reasonable steps to notify users, such as by email, in-platform notice or requiring acceptance of updated terms. We may retain previous versions of this Privacy Policy for audit and compliance purposes. 18. Contact If you have questions about this Privacy Policy or wish to exercise your data protection rights where we are the controller, please contact us: - Email: info@aahealthcaresolutionsltd.com - Business name: A&A Healthcare Solutions Ltd We aim to respond to all enquiries within 2 working days, and often sooner. Response times may vary during weekends, public holidays, or periods of high demand. For general enquiries, technical support, or account-related issues, contacting us by email is the most efficient way to receive assistance. This email address is the primary method for contacting us regarding contractual, technical, or support-related matters. You also have the right to complain to the Information Commissioner’s Office if you believe your personal data has been handled unlawfully.