What we collect, and why.

Who is responsible

The controller is Samad Salam, trading as Doctor Tax Check, for the Doctor’s Passport website, saved free Passport and interest registrations. Questions or privacy requests can be sent to privacy@doctorspassport.co.uk. The service address is 101 Queens Drive, Liverpool, L15 7ND, United Kingdom.

Information we collect

If you register interest, we collect the Passport you selected, your email address, contact consent, current medical role, broad UK region, the first outcome you would use the Passport for, your response to the displayed price options and when you would realistically want access. We also record the page and non-personal campaign label you joined from and the version of this notice. Do not include patient, colleague, employer, rota, health or other confidential details. Email and consent details are stored in a separate linked contact record.

If you sign in to the free Passport, the sign-in service provides your email address and may provide your name. We store the non-confidential fields you choose to save: preferred name, career stage, specialty, UK nation, current organisation, one rotation or post with dates, and up to three professional goals. A saved goal may include its title, type, deadline, confirmed next step, researched draft actions, suggested dates, source links and the date those sources were checked. Do not enter patient information, clinical notes, colleague details, health information or confidential organisational information. You can clear these saved fields from the Passport page.

The public demos do not ask for or save payslips, payroll numbers, payment details, patient information or health information. Assessment-drafting fields use example information in your browser and are not saved or transmitted. The free gross-pay screen reads one digital work-schedule PDF, XLSX or CSV rota, iCalendar file and one payslip PDF in your browser. It uses extracted and confirmed rota and gross-pay fields to calculate the displayed result locally. The files, extracted text, confirmed figures and result are not transmitted to or stored by Doctor’s Passport. Password-protected, scanned and image-only files are not supported.

Goal research is optional. The source-led fallback does not send goal context to OpenAI. When live source research is available and you ask for it, Doctor’s Passport sends only the non-confidential goal context needed to prepare the response—such as goal title and type, target date, career stage, specialty and UK nation—to OpenAI. It does not send your email address, name, organisation, rota, payslip or uploaded file. OpenAI returns draft actions, dates and sources for you to review; it does not receive authority to make decisions or submit anything for you.

Basic website-action records contain an allowlisted event name, page, short-lived page-view identifier, time and non-personal campaign labels from the link used to open the page. These labels can record that a free check, free Passport or Doctor’s Brief page was opened or completed, but not the fields entered or an article-reading profile. They identify a channel or campaign, not an individual. We do not add advertising identifiers, fingerprints or session replay.

How we use it and our lawful bases

We use your registration to understand demand for Money Passport and Complete Passport separately and contact you about early access to the Passport you selected. We rely on your consent for these emails. We rely on our legitimate interests to understand aggregated demand, compare non-personal acquisition channels, prevent duplicate registrations and count a limited set of first-party interactions needed to improve the site. Those interests are balanced against the small amount of data collected and your right to object. Registering interest does not create an account, start a subscription or authorise any payment. We use the signed-in identity and saved free-Passport fields to provide the persistent record you ask us to maintain. When you actively request goal research, we process the bounded goal context to provide that requested feature. Signing in does not give marketing consent or authorise payment, and goal suggestions do not determine eligibility or official completion.

Retention

Interest, email and consent records are deleted no later than 12 months after collection, and earlier where appropriate after consent is withdrawn. Basic website-action records are deleted within 90 days. Free-Passport fields are kept while you use the feature and are deleted from the active record when you use “Clear saved Passport” or request deletion. Unused records are reviewed periodically so they are not kept longer than needed. A minimal suppression record may be retained when needed to respect an unsubscribe.

Storage and sharing

The site and database are hosted through ChatGPT Sites using Cloudflare infrastructure. ChatGPT sign-in identifies the user of a saved free Passport. When live source research is available, OpenAI processes the bounded non-confidential goal context only when that research is requested. The owner-only interest-response page is restricted to the project owner. IONOS hosts the branded project mailbox and processes recipient details and message content when an email is sent. These providers act as processors or supporting service providers. Some processing may occur outside the UK; where UK data-protection law requires a transfer safeguard, the relevant provider arrangement must use an applicable adequacy decision or approved contractual safeguard. You can request further information about applicable safeguards. We do not sell this information or use it for advertising.

Your choices and rights

You can ask for access, correction, deletion, restriction or portability where applicable; object to processing based on legitimate interests; or withdraw email consent at any time by contacting us. Neither the interest list nor goal research makes decisions about eligibility, progression, employment or payment. You may complain to the UK Information Commissioner’s Office at ico.org.uk.