Privacy notice

RQAI operates this website and is responsible for website enquiries and beta-support correspondence. An evaluator controls information entered into their self-hosted installation; RQAI normally has no access to that local database. The beta is not currently offered for NHS, hospital or other organisational deployment. Any future deployment must identify its actual controller, processor, privacy contact and contractual roles before live use.

• Website enquiries: name, email address, message and associated delivery metadata.
• Beta support: contact details and correspondence sent voluntarily to hello@rqai.co.uk. No payment-card or checkout data is collected by this beta website.
• Technical and security data: request, device, browser, network and security-event information needed to serve and protect the site.
• Clinical deployments: patient identity and contact details, health and operation data, PROM answers and scores, clinician accounts, audit events, imports, exports and configuration data.
• Optional AI data: extraction inputs, redacted prompts, tool results, model outputs, provider/model information and review metadata when an operator enables an AI feature.

Website information comes from visitors who choose to email RQAI and from ordinary Hostinger delivery and security logs. It is used to answer enquiries, provide requested beta support, protect the site and meet legal obligations. The website does not currently offer Stripe checkout. The contact form opens the visitor’s email application unless a separate form service is explicitly enabled.

Clinical information can come from patients, clinicians, uploaded theatre or clinic lists and connected systems. The deployment controller must document its Article 6 basis, an Article 9 condition for health data, any Data Protection Act 2018 Schedule 1 condition, and safeguards for care, audit, service evaluation or approved research.

Website enquiries are sent through the visitor’s email provider; Hostinger and relevant network/security providers receive the information needed to deliver and protect the site. A future configuration may enable Web3Forms or Stripe only after this notice is updated. A local installation may additionally enable database/hosting, messaging, error monitoring, Google Gemini or Anthropic services. No free or consumer AI account should receive identifiable health information.

Some providers may process information outside the UK or EEA. The responsible controller must identify destinations, contracts and an appropriate transfer mechanism and complete any required transfer-risk assessment. See the AI use notice for the product’s local-first and human-review controls.

The product can run on operator-controlled hardware, a trust server or separately configured hosting; self-hosting is not a promise that no data ever leaves the device. Optional relay, messaging, monitoring and AI features have separate data flows. Clinical capture uses local parsing first and cloud fallback is off by default.

RQAI normally keeps beta enquiries and support correspondence for up to 12 months after the last interaction unless longer retention is needed for security, disputes or law. Hosting/security logs follow the hosting provider’s configured retention. Local beta and clinical records are controlled by the evaluator and must be kept only for documented purposes and periods, subject to legal hold, care, audit and records-management requirements. Operators must apply access control, encryption, backups, patching, logging and incident response appropriate to health data. No internet service can be guaranteed completely secure.

Depending on the law and circumstances, individuals may have rights of access, rectification, erasure, restriction, objection, portability and review of certain automated decisions. Requests about a clinical deployment should go to its named controller. Website or beta-support requests can be raised via the contact page or hello@rqai.co.uk. Individuals may also complain to the UK Information Commissioner or their competent EEA supervisory authority.

See the cookie and storage notice. This sales website is not directed to children. Patient questionnaires may concern children only where the deploying controller has authority, suitable age information and safeguards. Material changes will be shown by the date above; clinical deployments use versioned notices and re-acknowledgement where required.