Independent service

CrewVisa is a private information tool. It is not run or endorsed by HM Government, the Home Office, or GOV.UK — even when we summarise or cite public official sources.

Who decides how data are used?

For this public-facing product layer, HealthCrew AI determines purposes and means alongside your organisation when you operate a private deployment — document the controller / joint controller split in governance records. Employer users processing staff or candidate datasets remain responsible for their own employment-law and ICO registration duties.

Personal data categories

Chat messages you type — may incidentally contain names, NI numbers you should not paste, or contact details where you voluntarily include them.
Sponsor / employer search queries typed into retrieval fields.
Technical & security data — IP-derived metadata permitted by networking stacks, HTTP headers, timestamps, hashed identifiers necessary for telemetry you enable, diagnostics, and SIEM ingestion.
Optional persisted transcripts or query logs when operators configure PostgreSQL persistence (can be switched off via feature flags referenced below).

Purposes & lawful bases (outline)

Map each deployment to GDPR Article 6 (and Article 9 only if you knowingly process special-category data — ordinarily avoid prompting for health data in chats). Typical candidate bases employers document with counsel:

Performance of a contract / steps prior to contract — delivering SaaS dashboards and APIs to paying customers where applicable.
Legitimate interests — fraud prevention, product security debugging, aggregated analytics — supplemented by LIA artefacts where relied on heavily.
Consent — optional analytics cookies loaded only after you accept via our banner ( to reopen choices).
Legal obligation — rare for base product telemetry; record where applicable (e.g. court order response).

Recipients & international transfers

Depending on deployment configuration, subprocessors often include AI inference / embeddings providers, vector-search hosts, relational databases you operate, and infrastructure vendors. Maintain an up-to-date annex from commercial contracts rather than trusting this short list alone.

Large language models & embeddings (e.g. OpenAI APIs) — prompt content may transit outside the UK / EEA; require DPAs + transfer tools (UK IDTA, EU SCCs, UK extension addendum).
Pinecone or equivalent — vectors derived from enquiries and excerpts.
Operational data stores — PostgreSQL, Redis cache, Elasticsearch.
Optional Google Analytics, only after consent — see cookie notice.

Retention

Fix retention schedules in operational policy (for example ephemeral chat mirrors vs 30-/90-day log retention). When persistence flags disable database storage for chat or searches, artefacts should clear according to infra policy — audit backups separately.

Automated decisions

CrewVisa is not designed to substitute caseworker adjudication — it retrieves and summarises sources. If you bolt on automated refusal / approval workflows downstream, undertake separate DPIA obligations.

Technical safeguards (this build)

Logs support pattern-based PII redaction by default (LOG_REDACT_PII).
Operators can disable Postgres persistence for chat transcripts and search analytics (FEATURE_PERSIST_CHAT, FEATURE_PERSIST_SEARCH_QUERIES).
Operational visibility via /health/ready exposes non-secret feature posture for auditors.

Engineering backlog & DPIA scaffolding: spec/requirements/SPEC-DATA-PROTECTION-GDPR.md

Your ICO rights pathway

Data subjects can request access, rectification, erasure (where applicable), restriction, portability, and human review of contested automated outcomes. Route requests first through the controller named in your procurement contract; unresolved concerns may escalate to the UK Information Commissioner's Office (complaints). Public enquiries may also reach contactus@healthcrew.global — escalate to designated DPO or EU representative arrangements if implemented.

Privacy & data