NovareWho we are
Novare provides AI Protect for Health and Social Care. In this policy, “we” and “us” mean Novare. We are the controller of the personal information described here, except where we process information on behalf of a customer organisation, as explained in Information we process for customers.
Contact: support@novare-pwa.co.uk · Lewin Road, Streatham, SW16 6JZ, United Kingdom.
We intend to run the business through a limited company. When we do, we'll update this policy to show the company's details.
The short version
- The AI Protect extension checks text and files on your own computer. What you type, paste or upload into AI tools is never sent to us.
- Names that organisations choose to block are stored only as scrambled fingerprints, never as readable names.
- Our website uses no cookies, no analytics and no advertising trackers.
- We collect contact details only when you ask to get started, subscribe or contact us.
Information we collect and why
| What | Why | Lawful basis | How long we keep it |
|---|---|---|---|
| Requests to get started: your name, work email, organisation, role, organisation type and size, and any message. | To reply and set you up. | Legitimate interests: responding to your enquiry. | 2 years from our last contact, unless you become a customer. |
| Subscriptions and signed agreements: organisation name, address, type and size; the signatory's name, job title, work email and optional phone; the signature; the date and time of signing; the version and fingerprint of the agreement signed; and browser type. | To set up and manage your subscription, and to keep a reliable record of the data processing agreement. | Contract, and legal obligation (keeping business records). | For the subscription, then 6 years. |
| Billing: your Stripe customer and subscription references, the number of sites paid for, and whether the subscription is active. Card and bank details are held by Stripe, not by us. | To take payment and switch your sites on and off. | Contract, and legal obligation for accounting records. | For the subscription, then 6 years for tax records. |
| Manager accounts: the work email managers sign in with, and when they last signed in. Sign-in is provided by Firebase Authentication (Google). | To let managers sign in to the dashboard securely. | Contract. | For the subscription, then deleted within 30 days. |
| Emails and support requests. | To help you. | Legitimate interests, or contract for customers. | 2 years from the last message. |
| Website server logs (IP address, browser and pages requested), kept by our hosting provider. | To deliver the website securely. | Legitimate interests: running a secure website. | As set by Google, usually up to 30 days. |
Please don't send us identifiable details of patients, service users or staff, whether in forms, emails or support requests.
The AI Protect extension
- Checking happens on the device. Text and files are checked inside the browser. They are never sent to Novare or anyone else.
- Settings stay on the device, including the organisation name, block lists and rules, unless an organisation's IT team or administrator manages them centrally.
- Blocked names are stored as salted SHA-256 fingerprints. Names that staff type at the start of a session are held in browser memory only, never written to disk, and cleared automatically.
- The audit log on each device records the date and time, the AI site, what happened and the type of detail found, such as “NHS number ×1”. It never records the text itself. It is deleted automatically after 90 days, or after the period the organisation sets.
Information we process for customers
When an organisation links its computers with a site code, we store its settings, its fingerprint lists of blocked names, the names it gives its computers (such as “Office PC”), and activity counts from those computers. We do this as a processor on the organisation's behalf, under our Data Processing Agreement. The organisation is the controller. If your information is in one of their lists, please contact that organisation first.
Who we share information with
- Google (Google Ireland Limited and Google LLC), which provides our website hosting and database through Firebase and Google Cloud. Our database is in London (europe-west2). The network that delivers web pages, and account sign-in where used, operate globally.
- Stripe (Stripe Payments Europe Limited and Stripe, Inc.), which takes subscription payments. Stripe receives the billing name, email and address and the card or bank details you enter on its payment page. We never see or store full card details. Stripe acts as an independent controller for some of this information; see Stripe's privacy policy.
- Professional advisers, such as accountants and lawyers, where needed, and authorities where the law requires it.
We never sell personal information or use it for advertising.
Transfers outside the UK
Where any personal information is handled outside the UK by our providers, it is protected by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
Keeping information secure
We use encryption in transit and at rest, strict database access rules, multi-factor authentication on our accounts, and the minimum information needed. If a personal data breach affects you and is likely to put your rights at high risk, we'll tell you without undue delay.
Your rights
You have the right to ask for a copy of your personal information, and to ask us to correct, delete or restrict it, to object to how we use it, or to receive it in a portable format. Some rights depend on the lawful basis we use. To make a request, email support@novare-pwa.co.uk. We'll reply within one month.
If you're unhappy with how we've handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this policy
We'll update this page when anything changes and show the date at the top. If a change affects customers' agreements, we'll tell them directly.