This Privacy Policy explains how SAC Pharma Services Ltd (trading as RotaEasy) collects, uses, stores, and protects personal data in connection with the RotaEasy platform. We are committed to handling your data responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
The data controller for information collected through the RotaEasy website and signup process is SAC Pharma Services Ltd, registered in England and Wales.
For personal data that you enter into the platform on behalf of your organisation (staff records, patient check-in data, locum details), you are the data controller and we act as your data processor. Our obligations as processor are set out in Section 8.
| Category | What we collect | Why |
|---|---|---|
| Account data | Name, email address, organisation name, sector, professional registration numbers (e.g. GPhC, GDC) where provided | To create and manage your account |
| Billing data | Subscription plan, billing history. Card details are held by Stripe — we never store them. | To process payments and manage subscriptions |
| Usage data | Login events, feature usage, access timestamps | Security, audit trail, platform improvement |
| Staff data (entered by you) | Staff names, roles, contact details, rota and HR records you create | Core platform functionality — processed on your behalf |
| Patient/visitor data (entered by you) | Names, dates of birth, NHS numbers, service eligibility data entered via patient kiosk or check-in | Core platform functionality — processed on your behalf |
| Communications | Messages sent via the contact form | To respond to your enquiry |
We do not use your data for advertising. We do not sell your data to third parties. We do not use your data to train AI models.
We share data only with trusted sub-processors necessary to operate the platform:
We do not share your data with any other third parties without your explicit consent, except where required by law.
Under UK GDPR you have the right to:
To exercise any of these rights, use the contact form on our website. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Where you enter personal data about your staff, patients, or visitors into RotaEasy, you are the data controller and we process that data on your behalf. As your processor we commit to:
You are responsible for ensuring you have a lawful basis for entering personal data about staff and patients into the platform, and for maintaining appropriate privacy notices for your own staff and service users.
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include:
In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the ICO within 72 hours and affected users without undue delay.
RotaEasy uses minimal cookies and browser storage. We use:
We may update this Privacy Policy from time to time. We will notify you by email or in-app notice at least 14 days before material changes take effect. The current version is always available at rotaeasy.co.uk/privacy.
Privacy enquiries or data subject requests?
Use the contact form on our website and we'll respond within 30 days.
For complaints: ico.org.uk — Information Commissioner's Office