Privacy Policy

1. Who we are

Sapta Limited ("we", "us", "our") is the data controller for personal data collected through this MSF service. We are registered with the Information Commissioner's Office (ICO) under registration number ZC178340.

This service is operated by Dr Sudhir Tapase on behalf of Sapta Limited to provide GMC-compliant Multi-Source Feedback assessments for licensed medical practitioners in the United Kingdom.

Contact: [email protected]

2. What data we collect and why

From doctors (appraisees)

• Name, GMC number, email address, and workplace — to create and manage your MSF round
• Payment information — processed securely by Stripe; we do not store card details
• Self-assessment responses and reflections — to include in your MSF report
• Portal access credentials — to secure your dashboard

From colleagues (assessors)

• Email address and professional role — to send a unique, single-use feedback invitation
• Questionnaire responses — anonymised before inclusion in the doctor's report
• Submission timestamp and device fingerprint — for fraud detection only (see section 5)

From patients

• No personal identifiers are collected — patient feedback forms require no name, email, or NHS number
• Questionnaire responses — anonymised and aggregated before inclusion in the report
• Submission timestamp, IP address, and device fingerprint — for fraud detection only (see section 5)

3. Legal basis for processing

We rely on the following legal bases under UK GDPR:

• Contract (Article 6(1)(b)) — processing the doctor's data is necessary to provide the MSF service they have purchased
• Legitimate interests (Article 6(1)(f)) — fraud detection and service integrity
• Legal obligation (Article 6(1)(c)) — complying with GMC guidance on revalidation and appraisal
• Consent — colleague and patient respondents are informed of data use before submitting feedback and provide implicit consent by doing so

Where we process special category data (health professional registration details), we rely on Article 9(2)(b) — processing necessary for employment, social security, and social protection law — and Schedule 1 of the Data Protection Act 2018.

4. How we use your data

• To generate your GMC-compliant MSF report
• To send email communications related to your MSF round (invitations, reminders, your report)
• To verify the integrity of responses received (fraud detection)
• To comply with GMC and appraisal body requirements
• To maintain records required under our ICO registration

We do not use your data for marketing, profiling, or any automated decision-making that produces legal or significant effects.

5. Fraud detection

To protect the integrity of GMC assessments, we analyse each patient and colleague response for indicators of fraudulent or manipulated feedback. Signals assessed include submission timing, device fingerprints, and IP address patterns. This is a legitimate interest of Sapta Limited and of the medical profession.

Responses flagged as potentially fraudulent are placed on administrative hold and reviewed by Dr Tapase before being included in or excluded from your report. No response is permanently rejected without human review.

6. Who we share data with

We use the following third-party processors, each bound by data processing agreements:

• Stripe Inc. — payment processing (USA, EU-US Data Privacy Framework)
• Resend Inc. — transactional email delivery (USA, SCCs in place)
• Cloudflare Inc. — hosting, database, and file storage (USA, EU-US Data Privacy Framework; data stored in EU data centres)

We do not sell, rent, or share personal data with any other third party, including the GMC, without your explicit consent or unless required to do so by law.

Your completed MSF report is shared with you and, where you instruct us, with your responsible officer or appraisal body.

7. Data retention

We retain personal data for 5 years from the date your MSF round closes. This retention period reflects:

• GMC revalidation cycles (typically 5 years)
• Medical negligence limitation periods under the Limitation Act 1980
• Our ICO registration obligations

After 5 years, all personal data associated with your MSF round is permanently and irreversibly deleted from our systems, including backups.

Payment records are retained for 7 years for HMRC compliance, but contain no medical or feedback data.

8. Your rights

Under UK GDPR, you have the following rights:

• Right of access — request a copy of personal data we hold about you
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data (subject to our legal retention obligations)
• Right to restriction — ask us to stop processing your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, email [email protected]. We will respond within 30 days. There is no charge for exercising your rights.

9. Cookies and tracking

This service does not use advertising cookies, tracking pixels, or third-party analytics tools.

We use essential session storage in your browser to maintain your login state during a portal session. This data is not transmitted to any third party and is cleared when you sign out or close your browser.

10. Security

We implement the following security measures to protect your data:

• All data in transit is encrypted using TLS 1.2 or higher
• Data at rest is encrypted in Cloudflare's infrastructure
• Admin access requires two-factor authentication (email OTP)
• Portal access is protected by secure session tokens
• Daily automated backups with access controls
• Colleague invite links are single-use and expire after 90 days

In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware of it.

11. International transfers

Some of our processors (Stripe, Resend, Cloudflare) are based in the United States. Transfers to these processors are made under the UK Extension to the EU-US Data Privacy Framework, or under Standard Contractual Clauses approved by the ICO, providing equivalent protection to UK GDPR.

Cloudflare stores all MSF data in European Economic Area (EEA) data centres. No data is intentionally stored outside the EEA or UK.

12. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] so we can try to resolve the issue.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified to registered doctors by email. The "Last updated" date at the top of this page will always reflect the most recent version.

Continued use of the MSF service after a change constitutes acceptance of the updated policy.