Privacy notice

VUIT Data Labs Ltd (company no. 15240968), registered at 25 Roe Lane, Newcastle, England, ST5 3PH, is the data controller for personal data processed through RTT Insight. We are registered with the Information Commissioner's Office as a data controller.

For any privacy question or request, email contact@rtt.vuit.online.

RTT Insight analyses aggregate Referral-to-Treatment statistics published by NHS England at trust, ICB and specialty level. It contains no patient-identifiable data, no clinical records and no special category health data about individuals.

• Account data: name, work email address, organisation, job title, phone number (optional) and password credentials held by our authentication provider.
• Preferences: your home trust, ICB and specialty so the dashboard opens on your organisation.
• Usage data: subscription and trial status, credits, reports you create, and counts of questions asked or exports taken.
• Chat and report content: the questions you type into the analyst chat and the report briefs you write.
• Billing data: subscription and payment records. Card details are handled by Stripe and never reach our servers.
• Enquiries: the name, email, organisation and message you send through our contact form.
• Technical data: server logs, IP address and error diagnostics needed to keep the service secure and working.

• Contract — to create and run your account, provide dashboards, chat and reports, manage team seats, and take payment.
• Legitimate interests — to secure the platform, prevent misuse, diagnose faults, and improve the product. We balance this against your interests.
• Legal obligation — to keep financial and tax records.
• Consent — only where we ask for it, for example optional non-essential communications. You can withdraw consent at any time.

We do not sell personal data. We share it only with the service providers that make the platform work, each under contract and only for our instructions:

• Our cloud application and database hosting provider (account, subscription and report data).
• Tableau Cloud (Salesforce), which hosts the published RTT dataset queried by the platform.
• OpenAI, which processes the text of chat questions and report briefs to generate answers. Chat content is not used to train their models.
• Stripe, for subscription billing and invoicing.
• Our transactional email provider, for account, billing and enquiry emails.

Some providers process data outside the UK. Where that happens, transfers are covered by UK adequacy regulations or the International Data Transfer Addendum to the EU Standard Contractual Clauses.

• Account and profile data: for the life of your account and 12 months after closure.
• Reports and saved configurations: until you delete them, or 12 months after account closure.
• Chat conversations: held in your browser session only and not stored as a permanent transcript.
• Contact enquiries: 24 months from your last message.
• Billing records: 7 years, as required by UK tax law.

Under UK GDPR you have the right to access, rectify, erase, restrict, object to processing of, and port your personal data, and to withdraw consent where processing is consent-based. Email contact@rtt.vuit.online and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

Access to the platform requires an account and password. Data is encrypted in transit, database access is restricted by row-level security rules so users can only reach their own records, and payment card data never touches our infrastructure. Report suspected security issues to contact@rtt.vuit.online.

We update this notice when our processing changes. Material changes are communicated by email to account holders.