Privacy notice

Last updated 25 September 2026.

Who runs this

Clinical Portfolio is a personal project run by Scott Chalmers, who is responsible for the data it holds. Questions or requests: privacy@clinicalportfolio.uk.

What's stored

• Your account — email address, name if you set one, and a password (stored hashed by our sign-in provider; nobody can read it).
• What you add — activities, reflections, evidence and uploaded files, goals, projects, feedback requests, exports and PRF reports.
• Feedback from other people — when someone answers a feedback link they give their name, role and email (unless they answer anonymously) and their comments, which are stored against your activity.
• Problem reports — if something breaks, the error and the page it happened on are recorded, along with anything you send through “Report a problem”. Only admins can read these.

Patient information

PRF reports are for de-identified reference only. Don't enter names, dates of birth, NHS or CHI numbers, addresses or anything else that identifies a patient — the app warns if a note looks like it does. PRF reports are private to the account that wrote them; not even admins can open them.

Where it's kept and who else is involved

• The database, sign-in and file storage are hosted by Supabase in London, UK.
• The app itself is hosted by Vercel.
• Emails (feedback requests, shared exports) are sent through Resend.
• If you use an AI feature (drafting a reflection, suggesting links, generating a PRF narrative), the relevant text is sent to the AI provider whose key you added in Settings — Anthropic, OpenAI or Google — under your own account with them. Nothing is sent to an AI provider unless you press one of those buttons.
• An encrypted backup of the database is kept for 30 days.

Cookies

Only what's needed to keep you signed in. No tracking or advertising cookies.

How long it's kept

Until you delete it or delete your account. Deleting your account removes everything in it straight away; backups taken before that expire within 30 days.

Your choices

• Download everything your account holds — Profile → Your data → Download my data.
• Delete your account and everything in it — Profile → Your data → Delete my account.
• To correct or remove feedback you gave someone, or anything else, contact privacy@clinicalportfolio.uk. Under UK data protection law you can also complain to the Information Commissioner's Office (ico.org.uk).

Back to the app