Privacy Policy

ESATT and Verity Privacy Policy

This policy explains how ESATT Ltd handles personal information through www.esatt.co.uk, enquiries and demonstrations, and the Verity governance and quality assurance platform for care services. It also explains the different responsibilities of ESATT and organisations using Verity.

1. Who we are and how to contact us

ESATT Ltd provides Verity. In this policy, “ESATT”, “we”, “us” and “our” mean ESATT Ltd (Electronic Self Assessment Tools & Technology).

Registered office and postal contact: 82A James Carter Road Mildenhall IP28 7DE
Company registration number: 17518567
Privacy contact: info@esatt.co.uk
Data protection officer: Gary Holland, info@esatt.co.uk

For website enquiries, sales communications, billing, business relationships and our own account administration, ESATT is normally the data controller. This means we decide why and how that personal information is used.

When a care provider or other customer uploads personal information into Verity for its own governance purposes, that customer is normally the controller and ESATT acts as its processor under a data processing agreement. The customer decides the purposes, lawful basis, authorised users and appropriate retention instructions for that information. Our agreement with the customer sets out the processing arrangements.

2. Personal information we handle

Depending on how you interact with us, we may handle:

Enquiry and business contact details: your name, work email address, telephone number, job title, organisation and correspondence, including demo requests and support messages.
Account and service details: user identifiers, login and authentication information, permissions, care service name, CQC Location ID and subscription details. An organisation name or CQC Location ID may not itself identify an individual, but it can be associated with a user account.
Commercial records: billing contacts, invoices, payment status and contract records. ESATT does not directly receive or store payment card details on our servers; these are processed securely by our authorized payment providers.
Platform content: self-assessment responses, compliance evidence, photographs, action plans, reports and audit history. Although intended for organisational governance, this material may identify staff or other individuals if users include their details.
Technical and security information: IP address, browser and device information, timestamps, access records and error or security logs, where collected by our systems and suppliers.
Preferences: communication choices and cookie preferences, where applicable.

We receive information directly from you, from your employer or an authorised customer administrator, and from suppliers supporting the service. Where relevant, we also obtain public care-service registration information from the CQC register and retrieve aggregated dashboard metrics (such as incident counts or training compliance) via authorized API integrations with third-party clinical systems if this is the agreed approach within the contract.

3. Why we use information and our lawful bases

The following applies where ESATT acts as controller. Customers determine the lawful bases for information we process on their behalf.

Responding to enquiries, arranging demonstrations and discussing a proposed service: Legitimate interests in responding to business requests and developing customer relationships; steps at your request before a contract where you personally would be a contracting party.
Creating accounts, providing support and administering customer access: Contract where the individual is a contracting party; otherwise legitimate interests in providing the service to the customer and its authorised users.
Billing and maintaining commercial records: Contract where applicable; legal obligation for records required by tax and accounting law; legitimate interests in administering corporate customer relationships.
Monitoring security, preventing misuse and investigating faults: Legitimate interests in protecting users, customer information and the service; legal obligation where a specific duty applies.
Handling complaints and establishing, exercising or defending legal claims: Legitimate interests in resolving disputes and protecting legal rights; legal obligation where applicable.
Sending promotional communications: Consent where required, or legitimate interests where permitted by applicable direct marketing rules.
Optional cookies and similar technologies: Consent where required; any permitted exception will be identified in our cookie information.

Where we rely on legitimate interests, we consider the necessity of the processing and its effects on your rights and reasonable expectations. You may contact us for information about that assessment.

Some information is needed to create or secure an account, provide a requested service or meet legal obligations. If it is not provided, we may be unable to fulfil the request. We will explain which information is required when we collect it. Optional marketing choices do not determine access to the core service.

4. Resident information and sensitive information

Verity is designed for organisational governance and quality assurance. It is not intended to be a clinical record system or a repository for patient-identifiable information.

Users must not upload identifiable resident or patient information, unredacted medical records, or special category personal data, including health information. Users must check free text, photographs, documents and screenshots before uploading them. Names, faces, identifying labels and details that identify someone through context must be removed where necessary.

Before text is sent to our AI service, Verity applies automated sanitisation that replaces detected resident names with anonymous labels (e.g., "[Resident A]") to support Caldicott Guardian principles and UK GDPR.

Automated sanitisation is not a guarantee of anonymity. It may miss identifiers and does not establish that photographs or attachments have been checked. Replacing names alone may leave information identifiable through other details. Customers remain responsible for checking their submissions.

If you discover an inappropriate upload, contact your organisation’s Verity administrator and our privacy contact promptly, without repeating sensitive details in an ordinary email. We will coordinate restriction, removal and any necessary incident response with the customer. An accidental upload remains subject to data protection requirements; this restriction does not remove our responsibilities for information we actually receive.

5. AI assisted functions

Verity uses AI to assist with analysing organisational self-assessments, drafting SMART action plans and preparing regulatory summaries and reports. Relevant submitted content is processed securely by Google Cloud Vertex AI, which acts as our AI supplier for this function.

All AI processing is routed exclusively through secure, enterprise-grade endpoints hosted in the UK (London). The Vertex AI service operates under a strict zero-data-retention policy. Your audit inputs, compliance evidence, and generated action plans are never used to train or fine-tune Google’s foundational AI models.

Verity’s storage of customer records on our primary database is separate from the AI supplier’s handling of requests. The AI provider’s zero retention arrangement does not mean that Verity itself does not retain accounts, evidence, action plans, reports or audit records for your operational use.

AI outputs require human review. Any Verity assessment of a care service is an advisory gap analysis and is not an official CQC rating. ESATT does not use Verity to make decisions based solely on automated processing that have legal or similarly significant effects on individuals.

6. Who receives information

Access is limited to people and organisations who need information for the relevant purpose. Recipients may include:

Authorised ESATT personnel and contractors providing support or administration.
Hosting, database, authentication, email, support, security and backup suppliers, including Google Cloud Run (hosting), Google Cloud Firestore (database), Firebase (authentication), and Microsoft 365 Exchange (secure email and OTP transmission).
AI suppliers (Google Cloud Vertex AI) supporting the functions described above.
Payment, accounting and professional advisers where relevant.
Authorised users and administrators within the customer organisation, according to the permissions configured for their accounts.
Regulators, courts or law enforcement where disclosure is required by law or otherwise lawfully justified.
Advisers and prospective successors in a business sale or restructuring, subject to appropriate confidentiality and lawful disclosure arrangements.

Where applicable, Verity securely integrates with third-party clinical systems to ingest aggregate operational metrics via authorized API endpoints. Suppliers acting as processors are subject to appropriate contractual terms. A customer’s Verity subscription does not itself authorise ESATT to disclose that customer’s records to the CQC or a local authority. Customer-directed exports or sharing are managed under the relevant instructions and permissions.

7. International transfers

Our primary application infrastructure, databases, and AI endpoints are hosted by Google Cloud and are configured for UK and EU data residency (including London, europe-west2, and Frankfurt, europe-west3) to align with UK GDPR and NHS Data Security and Protection Toolkit (DSPT) standards.

Where personal information is transferred outside the UK, we use the applicable lawful transfer mechanism. This is governed by the Google Cloud Data Processing Addendum (CDPA) incorporating UK/EU Standard Contractual Clauses. Contact our privacy contact for information about the safeguards and how to obtain a copy, subject to necessary redactions.

8. How long information is retained

We retain information only as long as needed for its purpose, customer instructions and applicable legal requirements.

Enquiries that do not become customers: 6 months after the last meaningful contact, unless a documented reason requires longer retention.
Account and business contact records: For the active 6 years afterwards for administration or dispute resolution.
Customer evidence, assessments, photographs, action plans and reports: Retained for the duration of an active subscription to maintain historical compliance tracking. Upon cancellation or termination, all live organisational data is securely deleted from our primary databases within 3 months.
Audit and security logs: Technical access logs and encrypted system backups are retained for 28 days days to ensure disaster recovery and security auditing before being automatically destroyed.
Billing and accounting records: Retained for 6 years matching applicable UK legal and tax requirements.
Support tickets and attachments: 6 months; unnecessary sensitive material is removed sooner where appropriate.
Marketing records: Until consent is withdrawn, an objection is received or 1 year of inactivity, as applicable; minimal suppression details may be retained to respect an opt out.
AI supplier request data: Zero-data-retention; data sent to Google Vertex AI is not retained by the processor after the action plan is generated.

Information may be retained longer where necessary for a legal obligation or a specific dispute or investigation. Such retention is limited to relevant material and reviewed. Deletion from live systems may precede expiry from protected backups.

9. Security

We use technical and organisational measures appropriate to the nature and risks of processing. These include HTTPS/TLS encryption in transit, strict multi-tenant architecture keyed to individual CQC Location IDs for data isolation, custom Firestore security rules enforcing role-based permissions, server-side API proxying to secure credentials, and time-limited multifactor OTP codes for password resets.

No system can guarantee absolute security. We assess suspected personal data breaches and notify affected customers, regulators or individuals where required by applicable law and contractual obligations.

10. Cookies and marketing

We explain the technologies we use and obtain consent where required before placing or accessing them. Where a statutory exception applies, our cookie information explains that use and any required objection mechanism. You can unsubscribe from promotional emails (which may include Verity walkthroughs and CQC readiness campaigns sent via our marketing engine) through the unsubscribe facility or our privacy contact. Necessary service, security and billing messages may still be sent.

11. Your rights

Depending on the circumstances and applicable law, you may have rights to access your personal information, correct inaccuracies, request erasure, restrict processing, receive certain information in a portable format, and object to processing. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

You have the right to object at any time to the use of your personal information for direct marketing. You may also object to processing based on legitimate interests on grounds relating to your particular situation.

Contact our privacy contact to exercise your rights. We may need proportionate information to verify your identity. We normally respond within one month, subject to applicable rules on identity checks, clarification and extensions. Rights are subject to legal conditions and exemptions; we will explain our response.

If your request concerns information controlled by a care provider using Verity, contact that organisation first. If you contact us, we will help identify the relevant controller and assist it in accordance with our obligations and agreement.

12. Complaints and changes

Please contact us if you have a privacy concern so we can investigate. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator: https://ico.org.uk/make-a-complaint/.

We update this policy when our processing or legal requirements change. The current version will be available on our website with its effective date. Where required, we will give additional notice of significant changes.