Privacy policy

ARCPeasy is operated by Kinesis Consultants Ltd, a company registered in England and Wales, which is the data controller for the personal data described here. We are registered with the Information Commissioner’s Office under reference ZC116604. Our registered address is #406 Peppercorn Court, 18 Blair Street, London E14 0NY. Privacy enquiries should be directed to hello@arcpeasy.uk.

ARCPeasy is not affiliated with Horus, Turas, NES, the UKFPO, the GMC, or any deanery or foundation school. Your programme’s ARCP checklist and the Gold Guide remain the authoritative source; we organise and gap-check, we do not assess.

Trainees are the doctors who create an account, set up a review year, upload evidence, and use the coverage view. Almost all of the personal data we process belongs to, or is uploaded by, a trainee.

Supervisorsmay be shown a read-only view of a trainee’s coverage through a private, tokenised share link. Supervisors do not have accounts and cannot change anything; the link can be revoked or allowed to expire by the trainee at any time.

Account data. We collect your email address when you sign up and use it to authenticate you. You sign in with your email and a password; the password is never stored in plain text — our authentication provider (Supabase) keeps only a salted cryptographic hash. If you forget it, we email a one-time recovery link. We also record activity you take in the product, such as review years you create and evidence you upload.

Programme and ARCP data. To build your checklist we collect your programme and training year (for example Foundation F1 or F2), your ARCP date, and the placements that make up your year (specialty, site, and dates). This is professional information about your training.

Evidence you upload. You upload the evidence for your ARCP — typically your Horus or Turas portfolio export, plus loose files such as certificates and teaching logs. These documents can contain information about you (including professional and, in Form R / SOAR declarations, health and probity information) and may incidentally contain information about patients. How we screen and minimise that is described in the next two sections.

Reflective writing. Reflections receive the strictest handling in ARCPeasy and are covered in their own section below. In short: by default we keep only that a reflection exists, never the words.

Payment data. If you unlock a training year, billing is handled by Stripe. We do not store your card details; we keep a record of your unlock and transaction history.

Technical data. We collect standard server logs, including IP address, device and browser type, and timestamps, to run and secure the service. We do not use advertising trackers, and we do not currently run any third-party analytics.

Correspondence. If you contact us — for example by emailing hello@arcpeasy.uk — we process your email address, the name you give, and the content of your message in order to respond to you. Email sent to that address is delivered to our mailbox by ImprovMX, our email-forwarding provider (listed below). We keep correspondence only as long as needed to deal with your enquiry and keep a sensible record of it.

ARCPeasy is designed to hold the evidence of your training, not patient records. You should anonymise clinical evidence before uploading it, in line with GMC guidance.

As a safety net, every uploaded page is screened for patient-identifiable information before any other processing, and before any text is sent to an external AI service. Documents where identifiers are detected are flagged and blocked from export. This screen is part of the core service: its findings are shown to you for free and are never placed behind a paywall.

Reflections are the most sensitive thing in a portfolio, so they get the strictest handling in ARCPeasy. This section is the formal counterpart to our plain-English reflections page.

Detection happens first, and locally. ARCPeasy checks for reflective content before it does anything else with a document, and it makes that check on its own — it does not send your writing to an outside AI in order to decide whether it is a reflection. Where a Horus or Turas export labels an item by type, reflections are recognised deterministically; for loose files, if there is any doubt, we treat the content as a reflection.

The default is metadata only. When a reflection is detected we keep only three things: that it exists, its date, and the checklist item it appears to support. The reflective text itself is discarded as it is ingested — not stored hidden, not encrypted-but-kept, not retained at all. This is enforced at the database level, not merely in the application: the schema forbids storing reflective text unless you have explicitly opted in.

Optional, one-off review — only if you ask. You may want a second read of a single reflection: whether it is complete, clear, or has gaps a reviewer might flag. You can request that one document at a time, as an explicit opt-in that is off by default. The PID screen runs first, as always. After the review is returned, nothing is kept beyond a content hash — so we can recognise the same file if you upload it again — and whatever summary you choose to save. The reflective text is not retained.

Why we built it this way. A generation of doctors came to fear that writing done in order to learn could later be read back to them in a courtroom or tribunal. Guidance since has stressed that reflection is for learning, not liability, but the chilling effect on honest reflection is real and well documented. We would rather build for that reality than pretend it away — so the safest default is the one you have here: reflect honestly in your portfolio, and let ARCPeasy hold only the fact that a reflection exists, never the words. Nothing reflective reaches an AI model unless you explicitly ask, one document at a time.

After a document has been screened for patient-identifiable information, ARCPeasy uses AI to read the remaining evidence text and suggest which checklist item it supports, with a confidence score and a short rationale. This classification is provided by Anthropic (Claude), which is based in the United States; sending screened evidence text to Anthropic is a restricted international transfer, made under the safeguards described below. Your content is not used to train models, and — as set out above — reflective text is never sent unless you opt in per document.

We treat every piece of document text as data, never as instructions, and apply prompt-injection guards before it reaches a model. Separately, we use OpenAI’s content-moderation service to screen extracted text for harmful or inappropriate material; OpenAI operates a zero-retention policy for moderation requests.

We describe our AI features by what they do, not by claims about the underlying technology. Every mapping the AI produces is a suggestion that you confirm or reject — see automated decision-making, below.

Two kinds of special-category data can arise in ARCPeasy. First, your own health and probity information, which appears in Form R / SOAR-adjacent declarations. Second, health information about patients, which may remain in clinical evidence despite our expectation that it is anonymised before upload. Under UK GDPR both are special-category data (Article 9).

We process this data on the basis of explicit consent (Article 9(2)(a)), which you provide when you accept our terms and upload evidence, and we minimise it: the PID screen is designed to catch and block patient identifiers before any external processing, and you should not upload identifiable patient data. We do not use this content for any purpose beyond delivering the gap-check service, and we never share it with insurers, employers, the GMC, your deanery, or anyone other than the sub-processors listed below.

We process personal data under the following lawful bases:

Contract performance: managing your account and authentication, running the evidence pipeline and coverage view, and handling your unlock.

Legitimate interests: improving the product, preventing abuse, securing the service, and producing anonymised, aggregate analytics. We have assessed that these interests are not overridden by your rights.

Legal obligation: keeping financial records for the period required by UK law (currently seven years).

Consent: for optional processing such as reminder emails and the opt-in reflection review, and as the Article 9 basis for special-category data. You can withdraw consent at any time.

ARCPeasy does not make automated decisions that produce legal or similarly significant effects. The pipeline only ever suggests a mapping between your evidence and a checklist item; a human — you — confirms or rejects it, and confirmed decisions are immutable. Nothing about your ARCP is determined by the software. The panel decides your outcome, not us.

We do not sell your personal data and we do not allow advertisers to target you. We share data only with the service providers below, who process it on our behalf under data-processing agreements:

• Supabase — Database, authentication, and private file storage for your uploaded evidence. Your data is hosted in the United Kingdom (London / eu-west-2).
• Vercel — Hosting and deployment of the application.
• Anthropic — AI classification of evidence — reading screened document text to suggest which checklist item it supports. Based in the United States; transfer governed by Standard Contractual Clauses with the UK addendum, under Anthropic’s Data Processing Addendum. Your content is not used to train models. Reflective text is never sent unless you explicitly opt in, per document.
• OpenAI — Content-moderation screening of extracted document text for harmful or inappropriate material. Based in the United States; operates a zero-retention policy for moderation requests and does not use the content to train its models.
• Stripe — Payment processing and management of your per-year unlock. We never see or store your card details.
• Resend — Delivery of account, recovery, and (if you opt in) reminder emails.
• ImprovMX — Forwarding of email sent to our contact address (hello@arcpeasy.uk) to our mailbox. ImprovMX processes EU and UK customers’ email in the European Union (France) and does not read or sell email content.

We may disclose personal data if required by law, a court order, or a regulator, and would tell you unless legally prevented from doing so.

Your account and evidence are stored in the United Kingdom. Two of our sub-processors — Anthropic and OpenAI — are based in the United States, so the screened text we send them for classification and moderation is transferred internationally. We rely on Standard Contractual Clauseswith the UK addendum for these transfers, and have assessed them as necessary and proportionate, including for any special-category data involved. Email sent to our contact address is forwarded by ImprovMX, which processes it in the European Union; transfers from the UK to the EU are covered by the UK’s adequacy regulations.

• Account and evidence data: kept while your account is active. If you delete your account, we begin a 30-day grace period during which it is recoverable; after that, personal data is permanently deleted. Anonymised, aggregate statistics may be kept for product improvement.
• Reflective text: not retained at all by default. Where you opt in to a one-off review, only a content hash and the summary you choose to keep are retained — never the reflective text itself.
• Billing records: retained for seven years, as required by UK law. These are minimal (transaction ID, amount, date, tier) and never include card data, which is held by Stripe.
• Authentication logs: retained for 90 days for security purposes, then deleted.

ARCPeasy sets only cookies that are strictly necessary to deliver the product — the first-party Supabase authentication cookies (names beginning sb-) that keep you signed in. We have deliberately chosen not to add analytics, advertising, or behavioural tracking cookies, and we use no Google Analytics, Meta Pixel, or equivalent. Because there are no non-essential cookies, we do not show a cookie banner.

When you pay, Stripe sets cookies on its own checkout domain for fraud prevention; we do not embed Stripe’s scripts on our own pages. If we ever add cookies that require consent under UK PECR, we will add a proper consent mechanism and update this policy first.

We take reasonable technical and organisational measures to protect your data: encrypted storage and transmission (TLS), row-level security on our database so that each user’s data is accessible only to them, a private storage bucket scoped per user and review year, and UK data residency.

We are a small team at an early stage, and we want to be honest about what that means: we do not have the security apparatus of a large enterprise, and we keep improving as the product matures. If you find a vulnerability, please email hello@arcpeasy.uk before disclosing it publicly, and we will respond promptly.

Under UK GDPR you have the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data, subject to any legal obligation to retain certain records.
• Restriction — ask us to restrict how we process your data in certain circumstances.
• Portability — request an export of your data in a structured, machine-readable format.
• Objection — object to processing we carry out on the basis of legitimate interests.
• Withdrawal of consent — where we rely on consent (such as reminder emails or an opt-in reflection review), withdraw it at any time without affecting processing already carried out.

To exercise any of these, contact hello@arcpeasy.uk. We will respond within 30 days. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk.

ARCPeasy organises and gap-checks evidence; it does not assess you and it does not guarantee any ARCP outcome. Your ARCP is decided by your panel against your programme’s published checklist and the Gold Guide. Nothing ARCPeasy shows you is a substitute for that, or for advice from your educational supervisor, foundation school, or the BMA. For matters relating to outcomes and appeals, follow the Gold Guide and your local processes.

We will update this policy as the product develops. When we make significant changes we will notify you by email and show a notice in the product; the date at the top always reflects the latest revision. Minor corrections and clarifications are made without specific notice.

For any question about this policy, to exercise your rights, or to raise a concern, contact hello@arcpeasy.uk.