Privacy Policy

This policy explains how Finding Out Limited ("we", "us"), trading as Comflyant, handles personal data. It covers two distinct situations:

1. Where we act as a data processor for our customers (healthcare and adjacent organisations) in respect of their recipients' (patients') data.
2. Where we act as a data controller for our own data (our customers' staff user accounts, billing contacts, website / security data).

We are not a medical device and do not make clinical decisions. Our customers (the controllers) decide the clinical use of what they collect.

Who we are

• Finding Out Limited, company no. 16642597
• Registered office: 67 Glenthorne Gardens, Ilford, England, IG6 1LA
• Website / service: comflyant.co.uk
• Data protection contact: tayyeb@findingout.co
• We are registered with the Information Commissioner's Office (ICO) and have paid the data protection fee. ICO registration reference [ICO registration reference — to be added].

When we are a processor (recipient / patient data)

When a healthcare organisation uses Comflyant to send scheduled SMS forms to their patients, that organisation is the controller and decides why and how the data is used. We process it only on their documented instructions under a Data Processing Agreement (UK GDPR Article 28).

• What we process: recipient first / last name, phone number, timezone, the organisation's own reference, form answers (which may include health information), and the SMS messages sent.
• Why: to deliver scheduled SMS forms and capture responses on the controller's behalf.
• Patients: if you received an SMS form and want your data corrected or erased, contact the organisation that sent it (the controller). We will act on their instruction.

When we are a controller (our own data)

• Staff user accounts: name, email, password (stored only as an argon2 hash), role, last login — to authenticate staff into the provider web app. Lawful basis: contract / legitimate interests.
• Customer organisation & billing: organisation name, contact email, Stripe customer id — to manage accounts and billing. Lawful basis: contract.
• Security logs: actor identity, IP address, and actions taken, retained for security and accountability. Lawful basis: legitimate interests / legal obligation.

Where your data is stored (UK)

All personal data is stored and processed in the United Kingdom:

• Google Cloud (europe-west2, London) — our database, application and secrets.
• Amazon Web Services (eu-west-2, London) — SMS delivery and staff email.
• Stripe — billing data only.

See our trust & security page for the full list of sub-processors. We do not intend to transfer personal data outside the UK.

How we protect it

Encryption in transit (TLS) and at rest; role-based access control; hashed credentials; append-only audit logging; secrets held in a UK-pinned secret manager; and security response headers. See our trust & security page for more detail.

Retention

We retain personal data only as long as needed for the purposes above and to meet legal obligations. For recipient data, retention follows the controller's instructions. Full details are in our internal data-retention schedule, available to customers on request.

Your rights

Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. For recipient / patient data, exercise these through the organisation that collected it (the controller); we support them. For data we control (e.g. staff accounts), contact us using the details above. You can also complain to the ICO (ico.org.uk).

Changes

We will update this policy as needed and record the date at the top of this page.