UK GDPR · DPA 2018
Privacy notice
This notice explains how ReadyPath handles information for users in the United Kingdom. It reflects the product as built: your assessment-admin pack stays on your iPhone unless you yourself export or share it.
You are responsible for your data. ReadyPath is a tool you operate. You decide what to store, who may unlock the device, whether to enable backups, and who receives anything you export. The publisher does not receive your referral notes, photos, scores, or informant contacts through a ReadyPath dossier API — because none is implemented.
Under UK data protection law, information about your health or healthcare pathway can be special category personal data. Notes, screening scores, letter photos, and informant details you store may fall in that category. ReadyPath is designed so that this information stays under your control on your device.
Your responsibility for handling data
By using ReadyPath you acknowledge and agree that:
- You are the person who chooses what personal data (including special category and third-party data) to enter, photograph, dictate, or import.
- You are responsible for the lawfulness of processing any third-party information (for example informant name and phone) you store.
- You are responsible for keeping the device secure (passcode / Face ID), for iCloud or computer backups you enable outside ReadyPath’s backup-exclusion settings, and for anyone you allow to use the unlocked phone.
- You are solely responsible for recipients and channels when you export or share a pack (share sheet, email, messaging, printing, AirDrop, Files, clinic portals, etc.).
- If you email the publisher for support, you should not attach full identifiable packs unless you accept the risk of email transmission; prefer in-app export only to clinicians you choose.
- ReadyPath cannot recover data after you delete the app or use Delete all ReadyPath data, and cannot retrieve content from destinations you shared to.
Who is responsible (controllers)
On-device dossier: Processing of your pack happens on your iPhone (and, if you choose, in Apple system apps you already use — Health, Reminders, Calendar, Mail, Safari, Files / share sheet). The publisher does not host your dossier.
Publisher: The App Store publisher of ReadyPath is responsible for the app’s design and for any limited personal data they process outside the device (for example a support email you send to info@kakitsu.com, or App Store Connect account data held by Apple). They do not receive your referral notes, photos, scores, or informant contacts through a ReadyPath cloud API.
Apple Inc. processes Sign in with Apple, Health, App Store purchases, and other system services under Apple’s terms when you use those features.
Separate controllers: NHS.uk, NICE, NHS England / ODS, postcodes.io, and other sites you open are separate controllers with their own notices.
Contact for privacy questions: Contact.
What stays on this device
- Assessment pathway progress (completed steps, route choice, wait timers)
- Evidence you add: notes, photos, OCR text you confirm, screening scores you enter, informant contacts, dates, bookmarks
- On-device path analytics (stage timing, missing chips, nudges) — not uploaded to ReadyPath
- Optional display name and Sign in with Apple user identifier for local unlock
- Preferences (nation, biometrics, Health write, Focus helpers)
- Widget App Group snapshot: readiness %, next step title, missing chip — not full letter text
What ReadyPath does not collect to its own servers
No ReadyPath account database for the dossier, no advertising SDK in the app for the pack, no remote sync of your pack. Sharing a PDF uses Apple’s share sheet to destinations you pick.
When you use NHS organisation lookup (“near you”), ReadyPath sends the postcode (or coordinates converted to a postcode) to postcodes.io and queries NHS England’s public ODS directory. Your dossier notes and photos are not uploaded with that lookup.
Lawful bases
For on-device processing you initiate to organise your own assessment admin: your consent and/or processing necessary for your own purposes as the person using the app on your device. Special category health-related content you choose to store is processed with your explicit consent when you accept the in-app notice and add that content.
If you email the publisher, they process that correspondence under legitimate interests and/or consent to respond to your enquiry, and will not use it for advertising.
Security (and its limits)
- Dossier metadata and evidence photos encrypted at rest (AES-GCM); Keychain key WhenUnlockedThisDeviceOnly
- Evidence files use iOS complete file protection and are excluded from iCloud/iTunes backup where the OS allows
- Optional Face ID / device passcode gate
- No ReadyPath remote API for the dossier
Encryption reduces risk if the device is lost while locked. It does not protect content after you unlock the phone and open ReadyPath, content you export/share, screenshots, or backups you enable outside ReadyPath’s controls. You remain responsible for who sees your pack.
Your rights
- Access / portability — open steps, export PDF pack, system share
- Erasure — Delete all ReadyPath data on this iPhone, or delete the app. Sign out only ends your session; your pack stays on the device until deleted
- Restriction / objection — turn off Health, Reminders, Calendar, location, biometrics
- Withdraw consent — revoke privacy acceptance and delete local data
You can complain to the UK Information Commissioner’s Office: ico.org.uk.
Third parties you may reach
- Apple (Sign in with Apple, Health, EventKit, Maps, App Store billing)
- NHS England Organisation Data Service (ORD / ODS)
- postcodes.io (UK postcode geography)
- NHS.uk, NICE, NHS England guidance pages you open in Safari
- Optional Directory of Healthcare Services API if the publisher configures an API key
- Any recipient you choose when exporting or sharing
This website (www.readypath.live)
The marketing and legal site is hosted on Vercel. Hosting may process technical logs (IP address, user agent) to deliver the site. We use Vercel Web Analytics for aggregate page views — first-party, privacy-oriented measurement, not an advertising cookie SDK. See Cookies.
Google Fonts may be requested by your browser when loading pages.
Retention
ReadyPath keeps dossier data on this device until you use Delete all ReadyPath data, or remove the app. Sign out does not erase your pack. There is no ReadyPath server retention schedule for your pack.
Support emails you send are retained only as long as needed to respond and for legitimate record-keeping, then deleted or minimised.
Children
The adult assessment admin pathway is intended for adults managing their own referral administration (or an adult helper using the device with permission). It is not directed at children.
Changes
If ReadyPath’s capabilities change (for example adding a sync server), this notice will be updated before that processing starts. Version: 2026-10-09-b.