Privacy notice
Last updated: 27 October 2026
Who we are
CHC Ready is a service run by Dispono Ltd, a company registered in England and Wales (company number 17529136), registered office Apartment 47, The Pinnacle, 8 School Road, Hove, BN3 5EU. We are the controller of the personal data described here. Contact: hello@chcready.co.uk. ICO registration number: ZC283916.
UK data protection law requires us to tell you who we are, what we collect, why, and the legal basis for it.
What we do not collect
- No health information on the public pages. The guides, the self-screen and the waitlist do not ask for, or store, any information about the health or care of the person you support. Only the signed-in service, Prepare, does, as set out below.
- The stage tracker and the "Should we ask about a checklist?" questions run only in your browser. Your answers are saved on your own device (in your browser's local storage) so you can come back to them. They are never sent to us. Use the "Clear my answers" button to delete them.
- No cookies. We do not use cookies or any tracking that identifies you.
Care records and your account
When you use Prepare, you upload care records about the person you are helping. These contain health information, which is special category data. We use it only to make your evidence pack.
| What | Why | Legal basis | How long we keep it |
|---|---|---|---|
| Your account: email, first name, your choices | To sign you in and run your account | Contract (Article 6(1)(b)) | Until you delete your account, or 24 months after you last signed in |
| About the person you help: first name, your relationship, your authority to act, where they are, the stage of their assessment, the meeting date | To set up the case and guide you | Legitimate interests (Article 6(1)(f)) | As your account |
| The care records you upload, the text we read from them, and your pack | To make the pack | Legitimate interests (Article 6(1)(f)), and for health information, establishing or exercising legal rights (Article 9(2)(f)): the person's right to a proper assessment for NHS Continuing Healthcare | Deleted 30 days after the pack is ready, or sooner if you ask |
| Points you mark as wrong | To improve accuracy | Legitimate interests (Article 6(1)(f)) | Deleted with the records |
How the pack is made. A computer program reads the records. We use Anthropic's Claude AI models for this. Each point in the pack shows the record and page it came from. The program does not decide or predict whether anyone is eligible. No decision about anyone is made by automated means.
Who can upload. You can upload records if you have a health and welfare lasting power of attorney or a deputyship, if the person agrees, or if you are a close relative or friend involved in their care, acting in their interests. If the person, or someone else acting for them, objects, we stop and delete the records.
If you are the person whose records were uploaded. You have the same rights over your information as anyone else. You can ask us to stop, delete it, or give you a copy. Email hello@chcready.co.uk.
What we collect and why
| What | Why | Legal basis | How long we keep it |
|---|---|---|---|
| Waitlist: your email address, which option interests you (Prepare, Challenge, or just updates), the date you signed up, and the consent wording you agreed to | To email you about CHC Ready, only because you asked us to | Your consent (UK GDPR Article 6(1)(a)). You can withdraw it at any time. | Until you unsubscribe or ask us to delete it, or 24 months after the service launches if you have not bought anything, whichever is sooner |
| Payments: your name, email address, what you bought, the amount and the payment date | To take your payment, provide what you paid for, and refund it if needed | Contract (Article 6(1)(b)), and legal obligation for tax and accounting records (Article 6(1)(c)) | 6 years after the end of the financial year of the payment, for tax records |
| Visit counts | To know which pages help and whether people use the tools | Legitimate interests (Article 6(1)(f)) in running a useful website. The counts are anonymous and do not identify you. | Counts are kept in aggregate only |
| Technical data: your device's IP address and browser details, seen by our hosting provider when you load a page | To deliver the website and protect it from attacks | Legitimate interests (Article 6(1)(f)) in keeping the website working and secure | We do not keep these logs ourselves. Our hosting provider keeps them for a short time under its own policy |
You do not have to give us any personal data to use the guides or the self-screen. The waitlist is optional. We do not make any decisions about you by automated means.
Where we rely on consent, you can withdraw it at any time. Every email has an unsubscribe link, or email hello@chcready.co.uk.
We only send marketing emails if you have told us you want them. The consent box on the waitlist form is never ticked for you.
Card payments
Payments are taken by Stripe. Your card details go straight to Stripe and we never see them. Stripe acts as a separate controller for some payment data, such as fraud checks. See Stripe's privacy notice at https://stripe.com/gb/privacy.
Who holds your data for us
We use these providers to run the service. They process data only on our instructions.
| Provider | What for | Where |
|---|---|---|
| Supabase | Waitlist, accounts, case details, uploaded records and packs | Stored in the UK (London). Supabase is a US company, so its staff may access data from outside the UK for support; its data processing agreement covers this |
| Render | Runs the program that makes the pack | EU (Frankfurt) |
| Anthropic | AI models that read the records | US. Anthropic may not train its models on our data. It keeps what we send for at most 29 days, and usually not at all |
| Resend | Sign-in codes and "your pack is ready" emails. No health information is in any email | Sent from Ireland; account data held in the US |
| Google Workspace | Our email, including messages you send to hello@chcready.co.uk. Anything you put in an email to us, including about the person you help, is held here | Google may store data outside the UK; its data processing terms include the UK transfer safeguards |
| Stripe | Taking and refunding payments | Stripe may process data outside the UK; its privacy notice explains the safeguards it uses |
| Cloudflare | Hosting this website and protecting it from attacks | A global network, so pages may be served from outside the UK. Cloudflare's data processing agreement covers this |
| GoatCounter | Anonymous visit counts, no cookies | See provider |
Where data goes outside the UK, we rely on the provider's data processing agreement, including the UK International Data Transfer Addendum, or on UK adequacy regulations for the EU. You can ask us for details.
We do not sell or share your data with anyone else, and we do not use it to train AI.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to move it. Email hello@chcready.co.uk. We will reply within one month. We may ask you to confirm your identity first, so we only give data to the right person.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/. We would like the chance to put things right first.
Changes
If we change this notice we will update the date at the top. If we start collecting anything new, we will publish a new notice before we do.