This policy explains what personal information Barihan collects, why we collect it, who we share it with, and the rights you have. We have tried to write it in plain language. If anything is unclear, please contact us using the details at the end.
We are committed to processing your information lawfully under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
1. Who we are
Barihan is operated by [ Barihan Systems Ltd — to be confirmed at company registration ] (“we”, “us”, “our”). We are the data controller responsible for the personal information described in this policy.
- Contact for privacy matters: [ contact email — e.g. privacy@barihan.co.uk — to be confirmed ]
- Registered office: [ registered/service office address — to be confirmed ]
- Company number: [ company number — to be confirmed ]
Barihan is a tool for NHS and other healthcare professionals to plan, document and manage clinical audits and quality improvement projects (QIPs). It is intended for professional use, not for members of the public or patients.
For individual (self-serve) users, we act as the data controller for the personal information described in this policy. For organisation, department, Trust or enterprise arrangements, our role may differ depending on the contract and configuration in place, and separate data processing terms may apply.
2. The information we collect
Information you give us
- Account information — your name and email address, and the password credentials used to secure your account.
- Billing information — your subscription plan and payment status. Card payments are processed directly by Stripe; we do not receive or store your full card number.
- Audit and QIP content — the topics, local policy text, standards, results and other content you create or upload to produce your audit, QIP and related outputs.
- Correspondence — the content of any enquiry or message you send us, including enterprise enquiries.
Information we collect automatically
- Technical and usage data — basic information needed to run the service securely and reliably, such as your IP address, device and browser type, and logs of errors and security events generated by our hosting providers.
- Essential cookies — used to keep you signed in and to operate the service. See our Cookie Policy.
3. Patient data — what you must not submit
Barihan is designed to be used with anonymised or aggregated audit information. You must not enter patient-identifiable information — including names, NHS numbers, dates of birth, addresses, or free-text that could identify a patient — into the service. We do not ask for it, do not need it, and do not intend to process special category (health) data about identifiable patients.
If patient-identifiable information is entered contrary to these instructions, you remain responsible for it as the clinician and organisation handling that data, and you should follow your own organisation’s information governance procedures.
If we become aware that patient-identifiable information has been submitted contrary to this policy, we may delete, quarantine or restrict access to that content, contact the relevant user, and take other steps we reasonably consider necessary to protect individuals, comply with the law, and support appropriate information governance handling.
4. How and why we use your information
We use your information only for the purposes below, each with a lawful basis under the UK GDPR:
| Purpose | Lawful basis |
|---|---|
| Create and manage your account and provide the service | Performance of a contract with you |
| Process your audit and QIP content to generate criteria, results, recommendations and outputs | Performance of a contract with you |
| Take payment and manage your subscription | Performance of a contract; and legal obligation (accounting and tax records) |
| Keep the service secure, prevent fraud and misuse, and diagnose problems | Our legitimate interests in operating a secure, reliable service |
| Respond to your enquiries and provide support | Performance of a contract; and our legitimate interests in helping users |
| Comply with legal and regulatory obligations | Legal obligation |
| Send optional updates or use any optional cookies (none are currently used) | Consent — which you can withdraw at any time |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and we limit our processing accordingly. You can ask us about this balancing assessment at any time.
If you choose to receive product updates or other marketing from us, we rely on your consent and you can unsubscribe at any time. We will only publish a testimonial, or your name, role, organisation or an identifiable quote, with your permission.
5. How we use AI
To generate your audit criteria, recommendations and QIP plans, the content you submit is processed using a third-party artificial intelligence provider (Anthropic, the maker of Claude) and, where relevant, a web-search provider (Tavily) that helps locate publicly available clinical guidance. Because you must not submit patient-identifiable information, this processing should not involve personal data about patients. Account information is not sent to these providers for this purpose.
We do not use these tools to make automated decisions that produce legal or similarly significant effects about you. The outputs are drafts for you to review and verify, as explained in our Terms of Use.
We send only the content needed to provide the relevant feature, and we do not intentionally send patient-identifiable information. Under Anthropic’s commercial API terms, the content we send is not used to train its models; it may be retained by the provider for a limited period to detect and prevent misuse before being deleted. These providers’ processing, retention and security arrangements are governed by our contracts with them and their applicable data-processing terms, and you can ask us for more detail.
6. Who we share your information with
We do not sell your personal information. We share it only with the service providers (“processors”) that help us run Barihan, each under a contract that requires them to protect it and use it only on our instructions:
| Provider | What they do | Location |
|---|---|---|
| Supabase | Authentication and database — stores your account, subscription status and the audit/QIP content you create. | Primary data stored in the UK region. Operated by a provider based outside the UK; access may occur from outside the UK under appropriate safeguards. |
| Stripe | Payment processing and subscription management. Stripe collects and processes your card details directly; we do not receive or store full card numbers. | May process data outside the UK under appropriate safeguards. |
| Vercel | Hosting and delivery of the Barihan website and application front-end, including security and reliability logging. | May process data outside the UK under appropriate safeguards. |
| Railway | Hosting of the Barihan application back-end, which processes the audit content you submit. | May process data outside the UK under appropriate safeguards. |
| Anthropic (Claude) | AI processing — the content you submit (such as policy text and audit topics) is processed to generate criteria, recommendations and QIP plans. You must not include patient-identifiable information. | Processes data outside the UK (United States) under appropriate safeguards. Under our API agreement, content sent via the API is not used to train its models. (⚠️ confirm current API terms before launch.) |
| Tavily | Web search used to locate publicly available clinical guidance and standards. Search queries relate to audit topics and standards, not to your patients. | May process data outside the UK under appropriate safeguards. |
We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety or property of our users or others. If our business is reorganised or transferred, information may be shared with a successor under the same protections.
7. International transfers
Some of our providers process data outside the UK (for example, Anthropic in the United States). Where personal data is transferred outside the UK, we rely on appropriate safeguards as required by UK data protection law — such as the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, or transfers to recipients certified under the UK Extension to the EU–US Data Privacy Framework. You can ask us for more detail on the safeguards that apply.
8. How long we keep your information
We keep personal information only for as long as we need it for the purposes set out in this policy — including providing the service, keeping it secure, meeting our legal obligations, and resolving disputes. Where we cannot give a fixed period in advance, we set out the criteria we use to decide.
| Information | How long we keep it |
|---|---|
| Account information | While your account is active. After you close your account, we delete or anonymise it, unless we need to keep some of it for legal, security, billing or dispute-handling reasons. |
| Project content | The topics, standards, results and other content in your projects are kept in your account while your project and account remain active. You can delete project content within the service. |
| Documents you upload | Local policies and similar documents are used to produce your outputs and are held only transiently on our processing systems for that purpose. We do not keep them in a long-term document library. |
| Outputs and exports | Generated for you to download. Any copy you keep in your account is held as project content (above). |
| Billing records | Kept for the period required by UK accounting and tax law (generally six years). |
| Security and error logs, and backups | Kept only as long as needed to keep the service secure and reliable, then deleted or overwritten in the ordinary course. Some of this is determined by our hosting providers’ standard retention settings. |
When we no longer need your information, we delete it or anonymise it.
9. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your information (this policy);
- access a copy of the personal information we hold about you;
- have inaccurate information corrected;
- have your information erased in certain circumstances;
- restrict or object to how we use your information;
- data portability — receive certain information in a reusable format;
- withdraw consent where we rely on it; and
- complain to the supervisory authority.
To exercise any of these rights, contact us at [ contact email — e.g. privacy@barihan.co.uk — to be confirmed ]. We will respond without undue delay and within the time limits set by law. In some cases we may need to verify your identity, or ask you to clarify your request before the response period begins.
10. Cookies
We use only essential cookies needed to run the service. We do not currently use analytics or advertising cookies. Full details, and how to manage cookies, are in our Cookie Policy.
11. Children
Barihan is a professional tool and is not intended for anyone under 18. We do not knowingly collect information from children. If you believe a child has provided us with information, please contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. We will change the “last updated” date above and, where changes are significant, take reasonable steps to bring them to your attention.
13. How to contact us or complain
For any privacy question or to make a complaint, contact us first at [ contact email — e.g. privacy@barihan.co.uk — to be confirmed ]. We take complaints seriously and will help you raise one.
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection:
- Website: https://ico.org.uk
- Helpline: 0303 123 1113
- Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
This policy is governed by the law of England and Wales.