Privacy Policy

1. Zero-Data Ingestion Architecture\nPowerThrough is designed around strict privacy by design. When you use any prompt instruction from our library, your operational documents never leave your corporate network and are never uploaded, stored, or processed by PowerThrough servers.\n\n- Client-Side Clipboard Workflow: When you select Copy instruction, the prompt text is transferred directly to your device clipboard.\n- Enterprise Execution: You paste the instruction into your organisation's approved Microsoft Copilot tenant. The evaluation, summarisation, or analysis occurs wholly within your organisation's secure boundary.\n- Zero Document Leakage: We have no visibility into, nor access to, your confidential papers, patients' records, medical reports, or commercial data.\n\n## 2. Information We Collect\nWe collect only the minimum information strictly necessary to provide and secure authentication, billing, and access:\n\n- Account & Identity: When you sign in with your NHS email or NHS Microsoft 365 account via WorkOS, we process your verified work email address, name, and identity token to verify that you belong to an authorised NHS organisation.\n- Subscription & Billing: Subscriptions are billed through Stripe. Payment card details, billing postal codes, and bank accounts are handled directly by Stripe in compliance with PCI-DSS. PowerThrough never stores complete payment card numbers.\n- Telemetry & Safety: We maintain anonymised technical logs of website requests (including approximate geolocation, browser type, device type, and timestamp) and aggregate copy event counts to monitor capacity and prevent abusive scraping.\n\n## 3. Lawful Basis for Processing (UK GDPR)\nWe process personal data under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 under the following lawful bases:\n\n- Contract Performance: Providing your 14-day free trial or active monthly subscription access to the prompt library.\n- Legitimate Interests: Maintaining service availability, stopping automated abuse, and verifying NHS professional domain eligibility.\n- Legal Compliance: Retaining financial transaction records for statutory accounting and tax compliance.\n\n## 4. Third-Party Service Providers\nWe partner with established enterprise infrastructure providers who maintain high security certifications:\n\n- Cloudflare: Global content delivery, web application firewall (WAF), and edge compute.\n- WorkOS: Enterprise Single Sign-On (SSO) and passwordless authentication.\n- Stripe: PCI-DSS Level 1 certified subscription billing.\n- Brevo: Transactional email notifications and customer support delivery.\n\n## 5. Data Retention & Your Rights\nWe retain account records for the duration of your active subscription and up to statutory limitation periods. Under UK GDPR, you have the right to request access to, rectification of, or erasure of your personal data, and to object to processing.\n\nTo exercise your data protection rights or contact our privacy lead, please reach out via our Contact Page.