Privacy Policy

1. Who we are

DocRide is operated by DocRide Tech Ltd, a company registered in England and Wales under company number 16944760. DocRide Tech Ltd trades as DocRide.

For privacy enquiries, contact Adeem, Data Protection Lead at info@docride.co.uk. We are in the process of registering with the UK Information Commissioner's Office where required.

Our registered office is recorded at Companies House. For security and privacy reasons, we use the contact details above for data protection correspondence unless and until a separate business correspondence address is published.

2. Our role as controller and processor

DocRide may act as a data controller or a data processor, depending on the processing activity.

• We are usually a controller for account administration, billing, website analytics, marketing, platform security, support, professional membership features and DocRide business administration.
• We are usually a processor when a customer organisation uses DocRide to store or manage personal data about its employees, contractors, consultants, visitors, suppliers, clients, auditors, assessors or other individuals.

Where we act as processor, the customer organisation is responsible for providing privacy notices to relevant individuals and for ensuring that it has a lawful basis for using DocRide.

3. Personal data we process

Depending on how DocRide is used, we may process the following categories of personal data:

• Account data: names, email addresses, telephone numbers, usernames, authentication data, job titles, profile photos, organisation names, roles and permissions.
• Social sign-in data: information received from Google or Facebook when you choose their signup or login option, including your provider account identifier, name where available, email address and authentication information, as explained below.
• Business and subscription data: business details, sites, account administrators, plan details, invoices, billing status and Stripe payment references.
• Employee, contractor and consultant data: job roles, competence records, training records, certificates, qualifications, professional memberships, licences, assessment records and sign-off records.
• OHS documentation: risk assessments, RAMS, method statements, safe systems of work, construction phase plans, permits to work, emergency plans, inspections, audits, legal registers, corrective actions, contractor documents and performance reports.
• Incident and investigation records: incident details, near misses, hazards, injuries, witness details, investigation findings, photographs, root cause analysis and corrective actions.
• Uploaded files: PDFs, images, certificates, inspection evidence, audit evidence, contractor records, medical or occupational health documents if users choose to upload them, and related metadata.
• Communications: support requests, emails, feedback, demo requests, messages and service notifications.
• Technical data: IP addresses, device and browser data, login records, audit logs, security logs, error logs, usage events, cookie identifiers and local storage preferences.
• AI input and output data: user prompts, selected source records, generated drafts, AI-assisted risk assessments, audit support, compliance suggestions, summaries and user edits.

4. Special category and sensitive data

DocRide is not a dedicated medical records system. However, customers may upload or create records that include health data, injury details, sickness information, occupational health reports, disability-related information or other special category data.

Customers are responsible for ensuring that any special category data they upload is necessary, proportionate and supported by a lawful basis and an Article 9 UK GDPR condition. Customers should avoid uploading excessive medical information and should redact information where appropriate.

Incident or investigation records may also include criminal offence-related information. Customers must ensure that any such processing is lawful.

5. How we use personal data

• to provide, operate and secure the DocRide platform;
• to create and manage user accounts, permissions and authentication;
• to provide optional Google and Facebook signup and login and verify the identity of returning users;
• to store, organise and display OHS records and customer content;
• to support risk assessment, audit, inspection, competence, contractor, incident and corrective action workflows;
• to provide AI-assisted drafting, analysis and recommendations;
• to process payments and subscriptions through Stripe;
• to send platform emails, notifications and transactional messages using Amazon SES;
• to provide customer support and respond to enquiries;
• to monitor service performance, investigate errors and prevent misuse;
• to produce aggregated or anonymised benchmarking and performance insights;
• to comply with legal, regulatory, tax, accounting and security obligations;
• to send permitted marketing communications and manage opt-outs.

6. Lawful bases

Where DocRide acts as controller, we rely on one or more of the following lawful bases:

• Contract: to provide the platform, account, support and subscription services.
• Legal obligation: for tax, accounting, regulatory, security and compliance obligations.
• Legitimate interests: to operate, secure, improve and promote DocRide, prevent misuse, manage customers and develop our services.
• Consent: for certain cookies, marketing and optional features where required.
• Legal claims / substantial public interest / employment and social protection conditions: where special category data is processed and an applicable condition is required.

For Google and Facebook signup and login, we rely on contract to provide the account access you request and on legitimate interests to secure authentication and prevent misuse. Choosing a provider and granting its requested permissions does not opt you into marketing or analytics cookies.

7. AI processing

DocRide currently uses Google Gemini to support AI-assisted features, including document drafting, risk assessment support, audit support, performance analysis and compliance-related suggestions.

Customer content submitted through DocRide is not used to train Google Gemini's general AI models. AI processing is used to generate outputs requested by users and to provide the DocRide service.

AI outputs are intended to assist human users. They may be incomplete, inaccurate, unsuitable for a particular site or out of date. Users must review and approve AI outputs before relying on them.

8. Performance records, profiling and automated decisions

DocRide does not currently score individuals or make automated decisions about individuals. The platform may display performance records, activity records, competence records, training records, sign-off records and audit trails entered or generated through customer use of the platform.

These records are intended to support human review and management. They should not be used as the sole basis for decisions that materially affect an individual, such as employment, disciplinary, competence, contractor approval or safety-critical decisions.

9. Cookies and analytics

We also measure visits to six public pages (home, join as consultant, principal contractors, subcontractor signup, start and pricing) from requests received by our server, whether you accept or refuse analytics cookies. This uses no analytics cookies, browser storage or tracking scripts. We convert the connection IP address into a keyed, pseudonymous identifier to estimate distinct visitors; this report does not store raw IP addresses, account details, browser details or arbitrary query strings. Daily page counts and identifiers are retained for up to 90 days, with deletion scheduled daily, and are accessible only to superusers. They are not sent to Google. Shared or changing connections mean these figures are estimates of visitors, not identified people. We rely on our legitimate interests in understanding demand for our public services. You can contact info@docride.co.uk to object to this processing or exercise your data protection rights.

We use essential cookies for authentication, security and session management. Google Analytics is used on our public website only if you accept analytics cookies in our cookie banner. Until you accept, analytics cookies are not set.

Social sign-in uses DocRide's essential session and security mechanisms to complete your login. When you proceed to Google or Facebook, that provider may use its own cookies or similar technologies on its sign-in service, governed by its own privacy and cookie information.

See our Cookie Policy to manage your preferences.

10. Sharing personal data

We may share personal data with:

• authorised users within a customer organisation;
• Stripe for payment processing;
• Amazon SES for email delivery;
• Google or Facebook (Meta) to authenticate you when you choose that provider's signup or login option, as described in section 3.1;
• Google Gemini for AI-assisted processing;
• Google Analytics for website analytics when you have accepted analytics cookies;
• UK hosting, infrastructure, backup and security providers;
• professional advisers, insurers, regulators, courts and public authorities where required;
• successors or prospective buyers in connection with a business sale, merger, investment or restructuring.

See our Subprocessor Policy for more information about third-party providers.

11. International transfers

We aim to host customer platform data in the United Kingdom. Some suppliers, including payment, analytics, email or AI providers, may process personal data outside the UK or EEA. Google and Meta may also process social sign-in information internationally under their own privacy policies. Where required for transfers for which DocRide is responsible, we use appropriate safeguards such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, EU Standard Contractual Clauses and transfer risk assessments.

12. Retention and deletion

Social sign-in account details and linked provider identifiers are retained with your DocRide account to support access and account administration. After account closure, retention is subject to the administration, security, dispute and legal purposes described in our Data Retention Policy. Disconnecting DocRide in your provider's settings does not automatically delete information already held by DocRide.

Customer-controlled OHS records are generally retained for as long as the customer keeps them in the platform or for the duration of the customer contract, unless deleted earlier by the customer or required to be retained.

Customers may delete tenant data, subject to contractual, technical, backup, legal, audit and regulatory limitations. Tenant data means the data held in a customer DocRide workspace, including users, business records, sites, documents, risk assessments, safety plans, incident records, audits, inspections, training records, competence records, contractor records, uploaded files, reports and related metadata.

Where a consultant, auditor, reviewer or competent professional signs off, approves, reviews or submits a document for a customer organisation, that sign-off or approval record forms part of the customer's safety, compliance and audit trail. Such records may not be deletable by the consultant or reviewer after submission.

13. Security

We use technical and organisational measures designed to protect personal data, including access controls, authentication, encryption in transit, role-based permissions, audit logging, backups, security monitoring, supplier controls and incident response procedures.

No service can guarantee absolute security. Customers must manage users, passwords, roles and access permissions responsibly.

14. Your rights

You can review or remove DocRide's connection through your Google Account connections or Facebook's Apps and Websites settings. This may prevent future sign-in through that provider; it does not close your DocRide account or necessarily end an existing DocRide session. You can use Forgot password with your DocRide account email to set a password for email login. To request removal of your linked provider identifier, deletion of your DocRide account or other privacy assistance, contact info@docride.co.uk. We may need to verify your identity before acting on a request.

Depending on the applicable law, you may have rights to access, correct, erase, restrict, object to processing, request portability, withdraw consent and object to marketing.

Data protection rights are not absolute. We may refuse or restrict deletion requests where continued retention is necessary for legal obligations, legal claims, regulatory compliance, health and safety records, audit trails, security, fraud prevention, contractual enforcement or the rights and freedoms of others.

If your personal data is held in a customer-controlled workspace, we may refer your request to the relevant customer organisation.

15. Children

DocRide is intended for business and professional use. It is not directed at children. Customers should not create accounts for children unless legally permitted and appropriate safeguards are in place. Some safety records may refer to young workers, apprentices, visitors or students where relevant to OHS compliance.

16. Complaints

Please contact us first at info@docride.co.uk so we can try to resolve your concern.

You may also complain to the UK Information Commissioner's Office: https://ico.org.uk, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

17. Changes

We may update this policy from time to time. If changes are material, we will take reasonable steps to notify users or customers.

18. Related legal documents

• Legal Centre
• Cookie Policy
• Data Processing Agreement
• AI Processing Notice
• Subprocessor Policy
• Data Retention Policy
• Data Breach Response Policy
• International Data Transfers
• User Agreement