Privacy notice

Veridose may handle sensitive information, including health or disability related information.

Most sensitive data starts private and we try to collect only what is necessary for the task at hand.

Verification is designed to avoid unnecessary document sharing and users can manage sharing where the product supports it.

Access is logged where applicable, health data is not sold for advertising and users have data-protection rights.

Trent End Ventures Ltd trading as Veridose is the current operating entity for this product.

The exact controller, processor and joint-controller position for each workflow is subject to completed legal-role analysis and should not be assumed globally.

The categories below are used only where the product actually supports the relevant workflow.

Health, disability and similar sensitive information receives additional protection.

The platform is designed to keep raw evidence separate from a verification outcome, and to avoid showing more than the scenario requires.

The purpose registry below is the source for public wording. Any purpose that has not been reviewed remains a production blocker rather than being described as approved.

A structured internal basis register exists for the product, but public wording should not invent a lawful basis that has not been reviewed.

Until a purpose reaches approved legal review status, it is flagged as a blocker rather than published as settled legal wording.

The application does not claim a blanket Article 9 condition for all sensitive data.

Where a special-category condition applies, it must be tied to the specific processing purpose and approved in the registry before public wording is published.

We share different categories of information with different recipients depending on the purpose and the user action involved.

Processors, organisations, verification recipients and support providers do not all receive the same information.

The subprocessors page should list the active vendors once they are confirmed in the vendor register and approved for public disclosure.

At present the product should not assume more than the code and environment actually show.

International transfer wording should only describe actual transfers after they have been mapped and reviewed.

If special-category information is sent outside the UK, a documented transfer assessment is required where the law or policy requires it.

Retention must be handled by category and purpose, not by guesswork.

A human-readable retention overview should explain the current policy before production use.

Security controls are layered at a high level and avoid publishing exploit-enabling detail.

Sensitive access is intended to be logged and constrained by role, purpose and review state.

Child and dependant data receives higher protection and the context should remain clear when one account manages another person.

Separate children and families notices are needed for the layered product model.

Where the law applies, people can ask for information, access, rectification, erasure, restriction, portability, objection, withdrawal of consent and review of automated decision-making.

Not all rights are absolute, and the effect of a request depends on the law and the records involved.

People should be able to raise privacy or service complaints through Veridose and, where applicable, complain to the ICO.

The app should not discourage external complaints where the law gives that option.

This privacy notice remains a working compliance draft until the legal register is completed and reviewed.