Privacy Policy

Our Complex Child is a healthcare management platform designed to help families caring for children with complex medical needs.

We are registered with the Information Commissioner's Office (ICO) as required under UK data protection law.

2.1 Account Information

• Name (first and last name)
• Email address
• Password (encrypted)
• Date of birth
• Relationship to child (e.g., parent, guardian)
• Phone number (optional)

2.2 Child Profile Information

• Child's name and date of birth
• NHS number (optional)
• Gender and ethnicity
• Medical conditions and diagnoses
• Allergies and comorbidities

2.3 Medical and Care Information

• Medications and dosages
• Medication administration records
• Appointments and medical consultations
• Emergency contacts and protocols
• Care protocols and procedures
• Advanced Care Plans
• Healthcare professional contacts
• Daily care entries and notes

2.4 Technical Data

• IP address
• Browser type and version
• Device information
• Login timestamps
• Usage patterns and page views

We process your personal data under the following lawful bases:

We use your personal data to:

• Provide and maintain our healthcare management platform
• Enable you to record and manage your child's care information
• Generate care packets and reports for healthcare providers
• Send important service notifications (e.g., appointment reminders)
• Improve our platform and user experience
• Ensure security and prevent fraud
• Comply with legal obligations

We process this special category data based on:

• Article 9(2)(a) - Explicit Consent: You provide explicit consent when you register and agree to our terms
• Article 9(2)(h) - Healthcare Purposes: Processing is necessary for the management of health care systems and services

Additional safeguards for health data:

• Encryption at rest and in transit
• Access controls and authentication
• Audit logging of all data access
• Regular security assessments

6.1 Service Providers (Data Processors)

We use the following third-party services to operate our platform:

All service providers have signed Data Processing Agreements (DPAs) and comply with UK GDPR requirements.

6.2 When We May Share Data

• With your consent: When you generate care packets to share with healthcare providers
• Legal requirements: If required by law, court order, or regulatory authority
• Vital interests: In emergencies to protect life

6.3 International Transfers

Your data is primarily stored in the UK. If data is transferred outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) or adequacy decisions.

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

When you delete your account, all personal data is permanently removed within 30 days, including from our backup systems.

You have the following rights regarding your personal data:

Right to Withdraw Consent

You can withdraw your consent at any time. This won't affect the lawfulness of processing based on consent before withdrawal. To withdraw consent, contact us at privacy@ourcomplexchild.com or delete your account.

Right to Complain

If you're unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113

We implement appropriate technical and organisational measures to protect your personal data:

Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:

1. Notify the ICO within 72 hours of becoming aware
2. Notify affected individuals without undue delay if the breach is likely to result in high risk
3. Document the breach and our response

We use cookies to operate our service. Here's what we use:

Our platform stores information about children as provided by their parents or legal guardians. We take extra care to protect children's data:

• Only parents/guardians can create accounts and enter child data
• We verify the user's relationship to the child during registration
• Child data receives the same (or greater) protection as adult data
• We do not knowingly collect data directly from children

The age of digital consent in the UK is 13. Our service is intended for use by adults managing care for children.

If you have questions about this privacy policy or how we handle your data:

We aim to respond to all privacy-related enquiries within 30 days.