Privacy Policy

QuietDuty Ltd
Registered in England and Wales
Registered office: [virtual office address — add after company registration]
Contact: info@quietduty.co.uk
Last updated: 19 October 2026

1. What we do

QuietDuty Ltd provides Practitioner Watch, a browser extension that monitors public UK healthcare practitioner registers for registration status changes on behalf of employers (NHS trusts, private hospitals, locum agencies, dental practices, care home groups).

2. Data we process

Data	Source	Where stored	Purpose
Practitioner registration numbers	Entered by you	Your device (local browser storage) + our secure backend	To fetch and monitor the relevant public register page
Public register page content	Fetched from public register websites	Our secure backend (stored as a cryptographic fingerprint + page snapshot)	To detect changes between scheduled checks
Change alerts (timestamp, fingerprint, regulator, summary)	Generated by our system + on-device AI	Your device (local browser storage)	To display in the extension and export
Payment data (card details, billing address)	Entered at checkout	Our payment processor's servers. Not accessible to us.	To process subscriptions

3. Data we do NOT collect

Browsing history or data from other websites
Cookies (we do not set any)
Analytics or usage tracking
Location data
Device identifiers
Practitioner names (only registration numbers are stored; names appear only in the public register page content we fetch)
Any data transmitted to third-party AI services

4. AI processing

Practitioner Watch uses an on-device AI model (provided by the browser itself) to generate plain-English summaries of detected changes. This model runs entirely on your device. No page content, registration numbers, or summaries are transmitted to any external AI service, cloud provider, or third party. The model operates locally and requires no internet connection to generate summaries.

5. Where your data is stored

Data	Location
Your watch list (registration numbers, regulator, dates)	Your device only (local browser storage). Never transmitted to us.
Public register page fingerprints + snapshots	Our secure backend infrastructure (data centres in the UK and EU). This is public data from public government registers.
Change alerts + AI summaries	Your device only (local browser storage).
Payment data	Our payment processor (PCI-DSS compliant). Not accessible to QuietDuty Ltd.

6. Legal basis (GDPR)

Where we process personal data (limited to the registration numbers you enter, which identify individual practitioners), our legal basis is:

Your explicit consent — you voluntarily enter the registration numbers to be monitored.
Legitimate interest — the data is used solely to perform the service you subscribed to (change detection on public register pages).

Practitioner registration numbers are publicly available on the relevant registers. We do not process special category data (health data, etc.) — we process the public registration status only.

7. Your rights

Access: All your data (watch list, alerts) is stored on your device. You can view it in the extension or export it as CSV at any time.
Erasure: Remove a practitioner from the watch list in the extension, or uninstall the extension (this deletes all local data). For data on our servers (public register fingerprints), email info@quietduty.co.uk and we will delete it within 30 days.
Portability: Use the CSV export button in the extension.
Complaint: You have the right to complain to the ICO (ico.org.uk).

8. Data retention

Your device: Data persists until you remove the watch or uninstall the extension. Alerts are trimmed to the last 500 entries automatically.
Our servers: Public register page fingerprints are retained for as long as you maintain the watch. When you remove a practitioner, the associated entry is deleted. Alert history is trimmed to the last 1,000 entries per regulator.
Payment processor: Payment records are retained in accordance with their privacy policy and tax obligations.

9. Third-party services

Service	What they process	Why
Cloudflare (infrastructure)	Public register page content, cryptographic fingerprints, timestamps	Hosting and scheduled fetching of public data
Paddle (payments)	Payment card details, billing address, subscription status	Payment processing (merchant of record). We do not see or store payment data.

We do not use any other third-party services. No analytics. No advertising. No tracking pixels. No data brokers.

10. International transfers

Our backend infrastructure is hosted in the UK and EU. Our payment processor (Paddle) is a US-based company with EU/UK data transfer safeguards in place (Standard Contractual Clauses). No data is transferred to other jurisdictions.

11. Security

All communication between the extension and our backend uses encrypted HTTPS (TLS).
Your watch list is stored locally on your device and is not transmitted to us.
Our backend does not store any personal data beyond public registration numbers and public page content.
We do not use cookies, session tokens, or authentication on our backend endpoint.

12. Children's data

Practitioner Watch is a professional compliance tool. It is not directed at children and we do not knowingly process the data of children.

13. Changes to this policy

We may update this policy as the product evolves. Material changes will be indicated by a new "Last updated" date. For a professional tool with a small user base, we will email existing subscribers of any material change before it takes effect.

14. Contact

QuietDuty Ltd
info@quietduty.co.uk
[Registered office address — add after company registration]