Privacy policy: OrthoXcel Portfolio Pathway Evidence Tool
Last updated: 14 November 2026
This policy explains how OrthoXcel handles personal information in the Portfolio Pathway Evidence Tool at cesr.orthoxcel.co.uk, including the recordings library. It adds to the main OrthoXcel privacy policy at orthoxcel.co.uk/privacy.
1. Who we are
OrthoXcel (Mr Mohamed Hashem), 22 Opal Court, Slough, SL3 6LZ, United Kingdom, is the data controller for the personal information described here.
- Email: Contact@OrthoXcel.co.uk
- Registered with the Information Commissioner's Office (ICO): ZC007587
2. What we collect, why, and our lawful basis
| Information | Why we use it | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Your email address and password. The password is stored only in scrambled ("hashed") form by our sign-in provider; we cannot read it. | To create and secure your account and send sign-in and account emails | Contract |
| Your progress: counts, statuses, notes and links you enter for each evidence item | To provide the tool | Contract |
| Google Drive details: the ids of the folders the tool creates, and the id, name, link and last-modified date of each file you choose | To show your files against the right evidence items | Contract |
| A Google sign-in token for your Drive, kept on our server only and never sent to your browser | So the tool can create folders and add files when you ask it to | Contract |
| Purchases: product, amount, currency, date, Stripe payment reference and your access dates | To give and manage your access, and to keep our accounts | Contract; legal obligation (tax and accounting records) |
| If you buy the recordings library: the email address of your Google account | To share the recordings folder with you | Contract |
| Messages you send us and mentoring bookings | To reply, arrange sessions and support you | Contract; legitimate interests (answering enquiries) |
| Basic technical logs, such as the time of a request and error messages | To keep the tool secure and working | Legitimate interests (security and reliability of the service) |
You must give your email address and accept the terms to use the tool; without them we cannot provide it.
We do not collect your card details: Stripe handles them. We do not use your information for advertising, we do not sell it, and we do not make automated decisions about you that have legal or similarly significant effects.
Please do not type patient-identifiable or other sensitive information into the tool's notes. Redact your evidence as the GMC requires.
3. Google Drive: what the tool can and cannot see
- The tool asks Google only for the "drive.file" permission. This lets it see and change only the folders it creates and the files you upload or choose through it. It cannot see anything else in your Drive.
- Your files stay in your own Google Drive. We never copy or store them on our servers.
- We use the Drive information only to provide the tool's features to you. We do not use it for advertising, do not sell it, and do not let people read it, except where you ask us for help, for security, or where the law requires.
- You can disconnect at any time with "Disconnect Google Drive" on your dashboard. This deletes our token. You can also remove access in your Google account (Security, then Third-party apps and services). Your folders and files stay in your Drive.
- OrthoXcel's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Who handles your information for us
We use these service providers. They act on our instructions, and only receive what they need.
- Lovable (lovable.dev) and its infrastructure providers: host the tool, its database and sign-in, and send sign-in emails.
- Stripe: processes payments. Stripe is also an independent controller for payment information under its own privacy policy.
- Google: provides Google Drive in your own account, and the shared recordings folder if you buy the library, under Google's own terms and privacy policy.
We may also share information if the law requires it, or with professional advisers (such as our accountant) under a duty of confidentiality.
Inside OrthoXcel, only the administrator can see accounts, purchases and progress. We look at your progress only when you ask for help or to fix a problem.
5. International transfers
Some of our providers process information outside the UK, for example in the European Economic Area or the United States. Where they do, the transfer is protected as UK law requires: by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified), or by the UK International Data Transfer Agreement or Addendum. You can ask us for details.
6. How long we keep it
- Account and progress: when your access ends, your progress stops and your account becomes read-only. We keep it so that you can renew without losing work, for 24 months after your access ends, then we delete it. We email you one month before deletion. You can ask us to delete it sooner at any time.
- Google token: until you disconnect Google Drive or your account is deleted.
- Recordings folder sharing: we remove your access to the shared folder when your library access ends.
- Purchase records: 6 years after the end of the financial year of the purchase, as tax law requires.
- Messages and mentoring bookings: up to 2 years after our last contact.
- Technical logs: up to 30 days.
7. Security
Access to the tool is over an encrypted connection (HTTPS). Passwords are hashed, the Google token is never sent to your browser, and each account can see only its own data. No system is perfectly secure; if a breach affects you and creates a high risk, we will tell you as the law requires.
8. Cookies and similar storage
The tool uses only the storage needed to keep you signed in and to make the site work. It does not use analytics or advertising cookies, so no cookie consent is needed for the tool. The main OrthoXcel website has its own cookie choices, described at orthoxcel.co.uk/privacy.
9. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your information (access);
- correct it;
- delete it;
- restrict or object to our use of it (including where we rely on legitimate interests);
- give you the information you provided in a portable format.
To use any of these rights, email Contact@OrthoXcel.co.uk. We reply within one month. There is no charge in most cases.
If you are unhappy with how we handle your information, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113.
10. Age
The tool is for doctors aged 18 and over. We do not knowingly collect information from children.
11. Changes to this policy
We will post any changes on this page with a new date. If a change is significant, we will email account holders before it takes effect.