Privacy Policy

Doc Plan (“we”, “us”, “our”) provides a workspace for Coordinators to manage referrals, invitations, documents and time logs. This policy explains what personal data we collect when you use Doc Plan, how we use it, and the rights you have over it under UK data protection law (UK GDPR and the Data Protection Act 2018).

For the personal data in your account (your name, email and profile details) we act as the data controller. For the information you record about families and referrals we act as a data processor, meaning you, or the organisation you work with, remain the controller of that data.

When you create and use an account we collect:

• Account details: your name, email address and sign-in credentials (passwords are hashed; we never see them in plain text).
• Profile details: optional information you add in Settings, such as your job title, phone number and message-template tokens.
• Billing details: when subscriptions launch, payment is handled by our payment provider. We do not store card numbers on our servers.
• Usage data: basic technical logs (such as sign-in events) needed to keep the service secure and reliable.

The heart of Doc Plan is the information you record about referrals: family names, contact details, invitation statuses, meeting notes, plans and worksheet entries. This can include sensitive information about children and families.

• This data belongs to you (and where applicable, the local authority or service you work with). We process it only to provide the service to you.
• It is never shared with other Doc Plan users, used for marketing, sold, or used to train AI models.
• Access is restricted to your signed-in account through row-level security enforced at the database level.
• You are responsible for ensuring you have a lawful basis to record the family information you enter, in line with your own organisation's policies.

We use your personal data to:

• Provide, maintain and secure the Doc Plan service.
• Authenticate you and send essential account emails (magic links, password resets).
• Process subscription payments and manage your plan.
• Tell you about important product updates through the in-app Updates feed.
• Respond to support requests.

We do not send marketing emails without your consent, and we do not share your data with advertisers.

• Data is stored in a managed PostgreSQL database (Supabase) with encryption at rest and in transit (TLS).
• Row-level security policies ensure each account can only read and write its own records.
• Access to production infrastructure is limited and protected by authentication.

No system is perfectly secure, but we design Doc Plan so that the sensitive data you hold is protected by default.

We use a small number of service providers (sub-processors) to run Doc Plan:

• Supabase: database, authentication and file storage.
• Vercel: application hosting.
• SendGrid: transactional emails (sign-in links, password resets).
• Payment provider: subscription billing (details will be listed here when subscriptions launch).

Each provider only receives the data necessary to perform its function and is bound by its own data-processing agreement.

• Your account and referral data are kept for as long as your account is active.
• You can delete individual referrals, entries and documents at any time from within the app.
• If you close your account, we will delete your data within 30 days, except where we are legally required to retain it (for example, billing records).

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Export your data in a portable format (worksheet CSV export is built in; contact us for a full account export).
• Object to or restrict certain processing.
• Complain to the Information Commissioner's Office (ICO) if you believe your data has been mishandled.

To exercise any of these rights, contact us using the details below.

Doc Plan uses only essential, functional cookies, the ones required to keep you signed in securely and manage your account. We do not use advertising or third-party tracking cookies.

If we make material changes to this policy we will update the date at the top of this page and, where the change is significant, notify you through the in-app Updates feed or by email.

Questions about this policy or your data? Email us at support@doc-plan.app and we'll get back to you as soon as we can.

You can also review our pricing or learn more about Doc Plan.