Privacy policy.

Who we are.

The data controller is Hotline Labs Ltd, registered in England and Wales, company number 11873778. Registered address: Enterprise Centre, Tonypandy Enterprise Park, Llwynypia Road, Tonypandy, CF40 2ET. ICO registration ZA519999.

Contact: hello [at] dosetrend [dot] com.

What we collect.

• Application data
  Name, work email, company, phone, molecule of interest.
  Provided by you when you apply for access.
• Account data
  Name, work email, company, role, sign-in records.
  Created when we grant access to the platform.
• Correspondence
  Emails and call notes.
  Kept so we can answer follow-up questions.
• Technical data
  IP address, browser, device, pages viewed.
  Logged for security and to keep the service running. See the cookie policy for detail.

The prescribing data itself is public NHS data. It contains no patient identifiers.

Tender Desk.

If your organisation uses the Tender Desk, we hold what you put into it: the tender schedules and product listings you import, your offers (prices, GTINs, licence numbers and the other fields a tender asks for), your product catalogue, comments and sign-offs with the name of the colleague who made them, the activity log of each tender, and your company profile, which can include named contacts and is stored encrypted. Only your organisation sees it. DoseTrend staff can view it read-only when helping you, never change or download it, and every such view is recorded. It is kept for as long as the account, and we delete it sooner if you ask. Market notes on a tender line are written by DoseTrend from public figures only; your prices and other entries are never sent.

AI assistants.

If you connect Claude, ChatGPT or another AI assistant to DoseTrend, the assistant calls our connector at dosetrend.com/connector. For each call we record the tool it used, the molecule it asked about, whether the call succeeded, how long it took, the name the assistant's software reports, and a keyed fingerprint of the connection. We do not record your IP address for these calls. When you sign in to DoseTrend from an assistant, we also record the connection itself: your account, your organisation, the assistant's web address, and when you connected and last used it. Access tokens are stored only as one-way hashes.

We never receive your conversation, the question you asked or the answer your assistant gave, and we store no tool input other than the molecule. Your assistant's provider, such as Anthropic or OpenAI, handles your conversation under its own terms and privacy policy. We have no access to it, and we send the provider only the figures your assistant asked for.

We use these records to apply rate limits, to show you and your organisation's owners which assistants are connected, to see which tools and molecules are used, and to spot misuse. The lawful basis is contract for signed-in use and legitimate interests for the public tools. Call records are kept for 12 months, and a connection you disconnect is deleted 12 months after you disconnect it. You can see and disconnect your assistants at any time under Settings, AI assistants, and an owner or admin can disconnect any assistant in the organisation.

Why we use it, and the lawful basis.

• Legitimate interests · Art. 6(1)(f)
  Reply to your application, run the platform, keep it secure.
• Contract · Art. 6(1)(b)
  Deliver the monthly report and dashboard you're paying for.
• Legal obligation · Art. 6(1)(c)
  Keep accounting records and respond to lawful requests.
• Consent · Art. 6(1)(a)
  Optional analytics cookies and the Insights email list. You can withdraw at any time.

How long we keep it.

Applications that don't turn into accounts: 12 months, then deleted. Active accounts: for as long as the subscription runs, plus 24 months. Accounting records: 6 years, as required by HMRC. Server logs: 90 days. AI assistant call records: 12 months.

Who we share it with.

We use a small number of processors under written data-processing agreements: cloud hosting (EEA/UK regions), transactional email, and our accountants. Our application and signup forms use Cloudflare Turnstile to filter automated submissions; it checks browser signals to tell humans from bots and does not track you across sites. Site analytics run on our own Matomo server with truncated IP addresses; nothing is shared with Google or any advertising network, and its cookies are set only with your consent. We do not sell personal data, and we do not use it for advertising. Where a transfer outside the UK is necessary, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

Your rights.

You have the right to access your data, correct it, delete it, restrict or object to processing, and to data portability. To exercise any of these, email hello [at] dosetrend [dot] com. We reply inside a working day and act within one month.

If you're not happy with our response, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes.

If we materially change this notice, we'll email active account holders and update the date at the top.