Reflectio EM is built for UK Emergency Medicine trainees to write reflections and workplace-based assessments for their RCEM ePortfolio. This page explains what we collect, why, how long we keep it, and the rights you have over your data.
Reflectio EM is currently in closed pre-pilot testing with a small group of invited Emergency Medicine trainees (May–July 2026). Features, subprocessors, and data-handling practices described in this policy may change before the public pilot launch in August 2026.
If we make a material change — for example, adding a subprocessor, changing data residency, or transferring data controller status to a different legal entity — we will notify you in the app and at your registered email before the change takes effect, and increment the version number at the top of this page.
No payment is processed during the pre-pilot. All features are provided free of charge to invited testers during this period.
Version 2.5 (May 2026): Subprocessor disclosure refactored from fully-named list to category-level disclosure with specific names available on request — aligning with standard B2B SaaS practice. No subprocessors have changed.
UK GDPR Article 25 requires Privacy by Design. Reflectio EM applies it in five concrete ways:
Under UK GDPR, we must tell you what personal data we process and the legal basis for it. Here is the full picture:
What: Your email address and a hashed password (we never see or store your actual password — it is hashed by our authentication provider using industry-standard bcrypt).
Why: To authenticate you and prevent unauthorised access to your account.
Lawful basis: Performance of a contract — UK GDPR Article 6(1)(b). You cannot use the service without an account.
What: The text and structured data of the entries you create in the app — reflections, workplace-based assessments (CbD, DOPS, mini-CEX, ACAT, ESLE), RPL, SDL, hit list items, and related learning records.
Why: So you can draft, edit, and reread your own entries.
Where: In your browser's local storage on the device you used to create them. Not uploaded to our servers unless you turn on cloud sync.
Lawful basis: Performance of a contract — Article 6(1)(b).
What: The same entry content, additionally uploaded to a secure database hosted in the United Kingdom.
Why: So you can access your entries from more than one device (for example, draft on your phone, finish on your desktop for pasting into your ePortfolio).
Lawful basis: Explicit consent — Article 6(1)(a) for the personal data, and Article 9(2)(a) in respect of any health-related content that may be inferred from entries. You can withdraw consent at any time by toggling cloud sync off in Settings and deleting the cloud copies.
What: Customer and subscription identifiers, subscription status, current period end, and trial-end date held by our payment provider. Payment card details are handled by our payment provider directly and are never seen or stored by us.
Why: To operate paid subscriptions (active during the paid pilot from August 2026 onwards; not collected during the current free pre-pilot).
Lawful basis: Performance of a contract — Article 6(1)(b).
What: Per-user (pseudonymous, not anonymous — linked to your user ID) records used for cost control, billing accuracy, and product improvement:
No clinical content is logged in any of these tables.
Why: Cost control (we enforce monthly generation and daily audio caps), billing accuracy, and understanding how the product is used so we can improve it.
Lawful basis: Performance of a contract — Article 6(1)(b) for the cost-control and billing slice — and legitimate interests — Article 6(1)(f) — for the product-improvement slice. We have assessed that this minimal telemetry is necessary to maintain the product and does not override your interests.
Entries about your clinical practice may include health-related information about yourself (for example, how you felt during a difficult case) or, despite our guidance and technical safeguards, may inadvertently touch on information about patients. Under UK GDPR Article 9, health information is a "special category" of personal data with extra protections.
When special category processing occurs. Special category processing can occur in two situations:
Lawful basis. We rely on your explicit consent under UK GDPR Article 9(2)(a) for both situations:
Withdrawing consent. You can withdraw consent at any time. Stop using AI generation and voice features to end transient processing; toggle cloud sync off (with the "delete cloud copies" option) to end cloud storage. Withdrawal does not affect the lawfulness of processing before withdrawal.
What we will never do with special category data. It is never shared with advertisers, never sold, and never used to train third-party AI models. Cloud-synced content is stored exclusively in the United Kingdom. Transient AI processing takes place under contractual safeguards: our AI subprocessors do not use your content to train their models. Specific retention practices vary by provider — our AI generation provider may retain inputs and outputs for up to 30 days for trust and safety review in line with their standard commercial terms; our voice transcription providers process requests on a zero-retention basis where available, or retain transiently for the duration of the request. Specific provider names, retention periods, and contractual terms are available on request to privacy@reflectio.io.
Under UK GDPR you have the following rights. We will respond to data subject requests within one month, as required by UK GDPR Article 12(3). For complex or numerous requests we may extend this by a further two months and will tell you within the first month if we need to do so.
The technical safeguards in Reflectio EM are a failsafe — not a substitute for professional responsibility. Under GMC confidentiality guidance, the duty to protect patient information rests with you as the clinician.
To support that duty, Reflectio EM layers several controls:
None of these layers removes your professional duty. Treat them as belt-and-braces — your own anonymisation discipline remains the primary control.
If a personal data breach affects you, we will:
Our subprocessors are contractually required to notify us promptly of any security incidents affecting your data — our database provider commits to 48 hours, the others to "without undue delay". This gives us a buffer to assess the impact and meet the ICO deadline.
We use third-party processors to run Reflectio EM. Each is bound by a written Data Processing Agreement or equivalent contractual safeguards. We disclose them publicly by category here, and provide the full specific list — including company names, jurisdictions, DPA terms, and the contractual basis with each — on request to privacy@reflectio.io. We aim to respond to subprocessor-list requests within one month, mirroring our response commitment for data subject rights requests.
Categories of subprocessors we use:
| Category | What it does | Where |
|---|---|---|
| Database, authentication, and email infrastructure | Stores your account data and, if enabled, your cloud-synced entries. Sends authentication and transactional emails. | UK (data at rest); EU (transactional email delivery) |
| Application hosting and routing | Hosts the web application and routes requests. No personal data stored at rest. | Global edge |
| AI generation | Generates reflective text from the input you submit (and, for educational-activity entries, any slide or schedule photos you choose to attach). | USA |
| Voice transcription | Converts your dictated voice input into text. Used as primary and backup transcription providers. | USA |
| Optional read-aloud playback | Optional text-to-speech playback of reflective prompts. | USA |
| Payment processing | Handles paid subscriptions from August 2026 onwards. Card details handled directly by the payment processor as an independent data controller. | UK / EU / USA |
| In-app feedback | Processes any text and screenshots you submit through the in-app feedback widget. Feedback content may flow through the provider's own AI sub-processors for sentiment and classification. | Australia (AWS US hosting) |
Specific subprocessor names available on request. If you would like the full subprocessor list, including the specific company name, jurisdiction, applicable DPA, and contractual safeguards for each category above, email privacy@reflectio.io. We will respond within one month.
International transfers. Transfers to processors outside the UK/EEA take place under contractual safeguards — the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or each provider's auto-incorporated Data Processing Addendum, as applicable. If you do not want any transfer outside the UK/EEA, do not use AI generation or voice dictation, and avoid the in-app feedback widget.
Subprocessor changes. Routine subprocessor changes (e.g. a sub-region added, a provider acquired by another company, replacement with an equivalent-tier provider in the same category) will be reflected in our internal subprocessor register and disclosed on request. Material changes — adding a new subprocessor category, changing data residency for an existing category, or moving an existing processor to a new jurisdiction — will be notified in the app and at your registered email before the change takes effect, and will trigger a version bump of this policy.
Reflectio EM helps you draft content for your professional ePortfolio (for example, the Royal College of Emergency Medicine ePortfolio hosted by your ePortfolio provider). We are not affiliated with any ePortfolio provider and have no contractual relationship with them in respect of your data.
Where our responsibility ends. Once content is written into your ePortfolio — whether by using the Reflectio EM Autofill extension to auto-fill fields, or by copying and pasting from Reflectio EM — that content is held by your ePortfolio provider as a separate data controller under their own terms and privacy policy. We are not the data controller for content held in your ePortfolio, and we have no ability to access, modify, or delete it.
Practical implication. Deleting your Reflectio EM account removes content from Reflectio EM only. To remove content from your ePortfolio, you must use your ePortfolio's own deletion tools or contact your ePortfolio provider and (where applicable) your training body directly.
Reflectio EM is intended for use by qualified clinicians. It is not directed at, or intended for use by, children under 18. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, please contact privacy@reflectio.io and we will delete it.
We will revise this policy when the service changes in a way that affects your data, or when the law requires. Every update increments the version number at the top of this page. If we make a material change (for example, adding a new subprocessor, changing data residency, or transferring data controller status to a different legal entity), we will also notify you in the app before the change takes effect.
Reflectio EM is designed to align with the following frameworks and professional standards:
For any privacy question, data subject request, or concern, email privacy@reflectio.io. We respond within one month.