Privacy Policy

Last updated: 7 October 2026

1. Who we are

RotaDash is run by RotaDash Ltd ("we", "us"), a company registered in Scotland (company number SC904237), registered office Clyde Offices, 48 West George Street, Glasgow, Scotland, G2 1BP. RotaDash Ltd is the data controller for the personal data described in this policy. ICO registration number: ZC265151. Contact: hello@rotadash.com.

2. What we collect

Category	Examples
Account details	Name, email address, password (stored securely by our authentication provider)
How you found us	Only if you answer the optional question at sign-up (for example "A colleague" or "TikTok"). Used to see which ways of telling people about RotaDash work
Profile details	GPhC number, home/business address, default mileage rate
Banking details	Bank name, account name, sort code, account number — used only to print on your own invoices
Work records	Shifts, pharmacies you work with (their names and addresses, and an accounts email if you add one), invoices, payment status, mileage
Billing	Subscription status; card payments are handled entirely by Stripe — we never see or store your card details
Problem reports	Only if you use Report a problem: your message, your device and browser, and a short log of recent app activity (screens opened, saves, errors). The log holds no shifts, invoices, addresses or bank details
Preferences	Display settings such as theme, text size and which tab to open on, saved with your account; your theme choice is also stored on your device so pages load in the right colours

RotaDash is for working professionals and isn't meant for anyone under 18. We don't knowingly collect children's data; if you think a child has signed up, email hello@rotadash.com and we'll delete the account.

3. Why we process it

To provide the Service you've signed up for (performance of a contract), to process payment for subscriptions, and to maintain the security of the Service (legitimate interest). We don't use your data for advertising, and we don't sell it.

4. Who we share it with

We use third-party processors to run the Service, who only handle data on our instructions:

Supabase — hosts our database and handles account login. Data is stored in the European Union (Ireland).
Stripe — processes subscription payments. Stripe sees your payment details directly; we don't.
Cloudflare — hosts the rotadash.com website and the app's files. Like any web host, it sees your IP address and browser details when you visit.
Resend — sends our emails to you (account confirmation, password resets, a welcome email, and reminders before a locked account's data is deleted), and delivers problem reports you send us. It receives your email address and, for a problem report, what's in it. Invoices and payment reminders to pharmacies are sent by you, from your own email app, not through us.
Google Maps — used only when you tap Calculate on a pharmacy, to work out the driving distance, and when you search Google for a pharmacy in Northern Ireland or one that isn't in the NHS lists. It receives your address and the pharmacy's address, or the search text you typed, nothing else.

Two public services are also used, without any account details: when you search for a pharmacy that isn't in the England or Scotland lists built into the app, the text you typed goes to the NHS Organisation Data Service directory; and if Google can't work out a distance, the two postcodes go to postcodes.io to estimate it. The app's font and code are served from rotadash.com itself, so no font or code provider sees your visit.

We don't share your data with any other third party, and never with the pharmacies you invoice (your invoices go directly from you to them).

Transfers outside the UK. Your account and work records are stored in the European Union (Ireland), which the UK recognises as protecting personal data adequately. Stripe, Resend, Cloudflare and Google are US companies, so the data they handle for us (listed above) may be processed in the United States. Where that happens it's protected by the UK–US data bridge, for companies certified under it, or by the UK's standard contract clauses (the International Data Transfer Addendum) in our agreements with them.

5. How long we keep it

We keep your data for as long as your account is active.

If your free trial ends without a subscription, or you cancel, your account is locked but your data is kept for 3 months so you can pick up where you left off. During that time you can still download a full copy from the app. We'll email you before it's deleted. After 3 months it's permanently deleted, except for anything we're required to keep for legal reasons (for example, records of payments you've made to us).

You can delete your account and all its data yourself at any time, in the app under Profile → Account → Delete my account. It happens straight away and cancels any subscription. Or email hello@rotadash.com and we'll do it for you.

6. Your rights

Under UK GDPR, you can ask us to: give you a copy of your data (you can also export it yourself, any time, from within the app), correct it, delete it, or restrict how we use it. Email hello@rotadash.com for any of these. You can also complain to the Information Commissioner's Office (ico.org.uk) if you think we've mishandled your data.

7. Security

Access to your data is protected by row-level security on our database, meaning your records are only ever visible to your own account. Passwords are handled by our authentication provider and never stored by us in plain text.

So nothing is lost if something goes wrong, we make an encrypted backup of the database every night. Backups are stored with Cloudflare in the European Union, can only be opened with a key we keep offline, and are deleted automatically after 35 days (one copy a month is kept for 13 months). When your account is deleted, your data drops out of the backups as they expire.

8. Cookies and local storage

RotaDash doesn't use cookies of its own, and we don't use any tracking, analytics or advertising cookies, so there's nothing to accept. The app keeps a few things in your browser's local storage, all needed for it to work:

Your login, so you stay signed in (set by Supabase, our login provider). Logging out removes it.
Your theme (light, dark or automatic), so pages open in the right colours before you sign in.
A half-typed pharmacy, if your phone closes the app part-way through, so you don't lose it. Cleared once you save or discard it.
A short activity log (screens opened, saves, errors; no shifts, invoices, addresses or bank details). It never leaves your device unless you send it with Report a problem.
A note that this device has used RotaDash before, so it shows the login page rather than sign-up.

Stripe's payment pages, which you use to subscribe, are run by Stripe and set their own cookies for payment and fraud checks; see Stripe's privacy policy.

9. Changes to this policy

We'll update this page if how we handle data changes, and post the date at the top.