Privacy notice

Who is responsible for what

Your practice decides what is recorded about its staff in Ochiplan and why. For that information your practice is the controller, and we process it for them, under a data processing agreement. Questions about your rota, absence or pay records go to your practice first.

We are the controller only for the little we need to run the service itself: logins, sign-in records and messages you send us.

What is held

• Your name, email address, role, home site, working dates and leaving date.
• The rota: where and when you work, holiday, time-off requests and decisions.
• Sickness, lateness, return-to-work records and day notes, which can be health information. Only you, your practice’s owners and admins, and site managers for their own sites can see them.
• Pay changes the practice records, such as overtime hours or days deducted. Ochiplan does not hold salaries or bank details.
• Sign-in records: when you signed in, from which device and internet address, and whether two-step verification was used.

Why, and on what basis

Your practice uses Ochiplan to run its rota, manage time off and absence and prepare pay changes. Its lawful basis is usually the employment contract and its legal obligations as an employer; for health information, its obligations in employment law. Your practice can tell you more.

We use sign-in records to keep accounts secure, on the basis of our legitimate interest in protecting the service and your practice’s data.

Who else handles it

We use a small number of providers to run Ochiplan. Each is bound by a contract to protect the information and use it only for us.

• UpCloud (the United Kingdom): the servers and database.
• Cloudflare (European Union storage): encrypted nightly backups.
• Resend: sending sign-in links, invites and notification emails (your email address and the email’s content).
• Sentry: error reports, with names, emails and anything typed removed before they are sent.

Outside the UK

The servers are in the United Kingdom and the backups in the European Union. The UK recognises the European Union as protecting personal information adequately. Where a provider may handle information in another country, such as the United States, we use the UK’s approved transfer safeguards.

How long it is kept

Your practice decides how long it keeps records, within what employment and tax law require. When someone leaves, their access ends on their leaving date; their practice can erase their health details and notes from Ochiplan, keeping only the days worked that pay and billing must keep. When a practice stops using Ochiplan, its data is deleted within 30 days, and backups expire within a further 30 days.

Keeping it safe

• Everything is encrypted when it travels and when it is stored.
• Anyone who can see sickness records signs in with two-step verification, and signs in again every 12 hours.
• Each practice can only ever see its own information, enforced in the database itself.
• Every change is recorded, with who made it.
• Ochiplan’s support team can see a practice only when its owner lets them in, for a set time, and each visit is recorded in the practice’s change log.

Your rights

You can ask to see the information held about you, have it corrected or, in some cases, erased or restricted, and object to how it is used. Ask your practice: owners can export or erase one person’s data in Ochiplan. You can also contact us, and we will pass your request to your practice and help them answer it.

If you are unhappy with how your information is handled, you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).

Cookies

Ochiplan uses only the cookies it needs to work: to keep you signed in, remember which practice you chose, and remember light or dark mode. There are no advertising or tracking cookies.

Changes to this notice

If this notice changes, the new version is published here with its date, and practices are asked to accept it.