Privacy Policy

Effective date: 23 May 2026 · Last reviewed: 16 June 2026

This Privacy Policy explains how PortfolioMD collects, uses, and protects personal data when you use our service at portfoliomd.co.uk. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

⚠ Important — patient data

PortfolioMD is intended for doctors preparing their own Portfolio Pathway applications. You must not enter patient-identifiable data into the Platform. If you do, you may breach your professional confidentiality duties and UK data protection law. Anonymise all clinical content before entry. PortfolioMD is not designed to receive or process patient data.

1. Who we are

Data Controller

PortfolioMD Ltd, Company No. 17246944, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. For data protection purposes, PortfolioMD Ltd is the Data Controller responsible for personal data processed through the Platform.

Contact: hello@portfoliomd.co.uk

PortfolioMD Ltd is registered with the Information Commissioner's Office, registration number C1947802.

2. What data we collect

We collect only the data necessary to provide the Platform's services:

Data type	When collected	Purpose
Email address	When you join the waitlist or express interest in another specialty	To notify you when the service or your specialty becomes available
Specialty selection	When you sign up to the waitlist or specialty interest form	To prioritise which specialties to build next
Text you enter into the generator, reviewer, or Evidence Mapper (AI Suggest: item title and description)	When you use the app's input fields	To generate a reflective statement, provide review feedback, or suggest curriculum domain mappings
Basic technical data	Whenever you visit the site	To deliver the website (IP address, browser type — handled by Netlify for hosting and security)

We do not collect: cookies for tracking, marketing identifiers, social media data, payment information (no paid tier currently), or any other personal data beyond what is listed above.

3. Legal basis for processing

Under UK GDPR Article 6, we rely on the following legal bases:

Consent — for waitlist and specialty-interest email collection. You actively provide your email; you may withdraw consent at any time by requesting deletion.
Legitimate interest — for processing the text you enter into the app, in order to provide the service you have explicitly requested by using the tool. We have balanced this against your rights and consider it proportionate given the voluntary nature of input.
Legitimate interest — for basic technical operation of the website (server logs, security).

4. How your data is processed and where it goes

Third-party processors & international transfers

PortfolioMD uses a limited set of sub-processors to operate the Platform. All sub-processors are bound by data processing agreements and appropriate transfer safeguards.

Sub-processor	Purpose	Location	Transfer safeguard
Anthropic	AI statement generation and evidence mapping	USA	UK Addendum to EU SCCs, confirmed 1 June 2026
Cloudflare	Worker backend (server-side AI processing) and error logging	EU edge	Cloudflare DPA v6.4; EU-US / UK-US Data Privacy Framework
Netlify	Static hosting and waitlist form	USA	Netlify DPA (Nov 2023); EU SCCs + UK IDTA
Plausible Analytics	Analytics (no PII, no cookies)	EU	Plausible DPA
Zoho (Zoho Mail)	Business email hosting (hello@portfoliomd.co.uk)	EU	Zoho DPA; data hosted in the EU region

4.1 Anthropic — what is sent

What is sent: the text you type into the generator, reviewer, or Evidence Mapper (for AI Suggest, the item title and description), plus the system prompts encoded by PortfolioMD
Training: Anthropic does not train its AI models on API content, including yours
Retention by Anthropic: up to 30 days for safety review, then deleted — see anthropic.com/legal/privacy

4.2 No other third parties

We do not share your data with any third party outside those listed above. We do not sell, rent, or trade personal data under any circumstances.

5. How long we keep data

Data	Retention
Waitlist email and specialty	2 years from signup or until deletion requested
AI processing text (text entered into the generator, reviewer, or Evidence Mapper AI Suggest)	30 days (Anthropic API policy)
Device-local evidence data (autosaved drafts in your browser)	Controlled by the user
Server logs	Up to 30 days (Netlify's standard retention)

Generated statements are returned to your browser and are not stored by PortfolioMD. If you wish to keep your work, you must copy and save it yourself.

6. Your rights under UK GDPR

You have the following rights regarding your personal data:

Right to be informed — what we do with your data (this policy)
Right of access (Art. 15) — request a copy of the personal data we hold about you
Right to rectification — correct inaccurate data
Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten")
Right to restrict processing — limit how we use your data
Right to data portability — receive your data in a portable format
Right to object — object to specific processing activities

To exercise any of these rights, email hello@portfoliomd.co.uk. We will respond within one calendar month as required by UK GDPR. Most requests are simple and can be actioned within days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data appropriately.

7. Security

We take appropriate technical and organisational measures to protect personal data:

All data in transit is encrypted using HTTPS (TLS 1.3)
The Platform is hosted on reputable infrastructure (Netlify) with industry-standard security
AI processing occurs over encrypted connections to Anthropic
No long-term storage of statement content by PortfolioMD
Email data stored by Netlify Forms is access-controlled

AI processing is performed entirely server-side through a Cloudflare Worker. API keys and other secrets are held only as encrypted Worker environment variables and are never present in client-side code.

8. Data breaches

In the event of a data breach affecting personal data, we will:

Notify the ICO within 72 hours of becoming aware, where required by UK GDPR
Notify affected users without undue delay if there is a high risk to your rights and freedoms
Take all reasonable steps to mitigate the breach and prevent recurrence

9. Children and capacity

The Platform is intended for qualified doctors and individuals aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a minor has submitted personal data to the Platform, please contact us immediately and we will delete it.

10. Cookies, tracking, and third-party content

10.1 No marketing or analytics cookies

PortfolioMD does not use cookies for marketing, advertising, or behavioural tracking. We do not use Google Analytics, Facebook Pixel, or any similar tracking tool. We use Plausible Analytics, a cookieless, privacy-first analytics service hosted in the EU. Plausible does not collect personal data, does not use cookies, and does not track individuals across sites. No consent banner is required for Plausible under UK GDPR or PECR.

10.2 Essential cookies

Netlify, our hosting provider, may set minimal essential cookies for security purposes (DDoS protection, basic session management, duplicate form submission prevention). These cookies are exempt from consent requirements under the Privacy and Electronic Communications Regulations (PECR) as they are strictly necessary for the service to function. We do not use any non-essential cookies that would require a consent banner.

10.3 Google Fonts

The Platform uses typefaces served by Google Fonts (fonts.googleapis.com). When your browser loads these fonts, your IP address is transmitted to Google in the United States. This is necessary to render the Platform's typography. Google does not use this data to identify you personally and does not associate it with other Google services. If you wish to avoid this transmission, you can use a browser extension that blocks third-party font loading, although this may affect the Platform's appearance.

10.4 No third-party social media or embed content

The Platform does not embed YouTube videos, social media widgets, or any other third-party content that would set additional cookies or transmit data to other services.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Platform, the law, or our processing practices. The "Last reviewed" date at the top of this page will reflect any changes. Material changes will be highlighted by a notice on the Platform. Continued use of the Platform after updates constitutes acceptance of the revised policy.

12. Contact

For any questions about this Privacy Policy, or to exercise your data protection rights, contact:

PortfolioMD Ltd (Data Controller)
Company Number: 17246944
Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Email: hello@portfoliomd.co.uk
Website: portfoliomd.co.uk

Last reviewed: 16 June 2026