The short version
- Public guidance can be read without an account.
- An account is needed for member features and stores the information needed to provide them.
- Profile and Community information is visible only within the audiences described below; login email addresses are not shown to members.
- GP Navigator uses Supabase for account and application data, Cloudflare for hosting, Resend for transactional email and Google Workspace for human correspondence.
- Do not enter patient-identifiable or confidential clinical information anywhere on GP Navigator.
Who is responsible for this service
GP Navigator is independently developed and operated under the Arah brand.
Arah is the umbrella brand behind GP Navigator and its planned organisational-workspace products.
The confirmed legal operator will be the controller for personal information used to run GP Navigator. That legal identity must be added before this draft is released. For privacy questions or rights requests, use the public work address contact@gpnavigator.co.uk.
What GP Navigator may collect
Accounts and profiles
Account ID, sign-in email, display name and optional photo, bio, training stage, broad area and professional label.
Community and blog
Posts, replies, drafts, reports, moderation records, follows, votes, saves, policy acceptance and blog submissions or byline choices.
Saved and personal features
Saved guidance, preferences, checklist progress and private notes that you deliberately save to an account. Signed-out versions may stay only in this browser.
GP Exam Navigator
Exam plans, broad availability and location, matching preferences, practice requests, group membership, discussions, sessions, meeting links and files you choose to upload.
Feedback and access
Page or place concerned, your message, optional source link, organisation, optional contribution text and an email address when it is required or you choose to provide it.
Technical and aggregate use
Security and delivery logs handled by hosting and database providers, plus daily aggregate content-open counts keyed to a stable page ID. The popularity counter does not store names, email addresses, search terms, raw IP addresses or browser fingerprints.
Some fields are required to create an account or use a particular feature. Profile details, photographs, feedback contact details, broad location, attempt history, meeting links and uploads are optional unless the form says otherwise. If required information is not provided, the relevant account or feature may not work.
Most information comes directly from you. Supabase supplies account confirmation and session state; other members may create replies, invitations or reports connected with your account; and authorised staff may record access, moderation, safety or support decisions. GP Navigator does not buy personal profiles from data brokers.
Why the information is used
The table below records the current proposed bases for owner review. It is not presented as a final legal decision while this notice remains a draft.
| Purpose | What this covers | Basis for owner confirmation |
|---|---|---|
| Provide accounts and requested member features | Account access, saved state, Community, Blog, Exams and private group features. | Proposed: performance of the service requested by the member. |
| Operate, protect and improve GP Navigator | Security, abuse prevention, moderation, service reliability, feedback review and aggregate popularity ranking. | Proposed: legitimate interests in operating a useful and safe service, balanced against users’ rights. |
| Send necessary service messages | Email confirmation, password recovery, owner recovery and an owner-issued guest invitation. | Proposed: the service request and legitimate operational interests; not marketing consent. |
| Meet applicable legal duties | Responding to rights requests, complaints or a valid legal requirement. | Proposed: legal obligation where one applies. |
GP Navigator does not use registration or acceptance of this notice as blanket consent for every purpose. It does not send routine marketing email.
Who can see information
- You: your account, preferences, private notes, saved state and member activity available through your account.
- Verified members: your display name or chosen pseudonym, optional profile details and photo, and contributions shared with the relevant Community or Exams audience.
- Accepted group members: private group membership, messages, sessions, meeting links and shared files.
- Authorised owner or staff: only the operational, safety, moderation, feedback or account information allowed by their current permission. GP Navigator’s protected Owner has broader operational access. Owner/admin safety review of private Exams groups is audited.
- Service providers: the limited information needed to host, store, deliver or secure the service.
Login email addresses and saved preferences are not displayed to other Community members. Some public Blog articles can show the byline choice the writer selected after editorial approval.
Services that process information
Cloudflare
Hosts and delivers the website and may process request, security and diagnostic information needed to serve it.
Supabase
Provides authentication, PostgreSQL data storage and private file storage for profile photographs and Exams group files.
Resend
Delivers transactional messages such as account confirmation, password recovery, owner recovery and owner-issued guest invitations.
Google Workspace
Receives messages sent to the public GP Navigator work address. The website does not have access to the private mailbox password.
OpenFreeMap
The Southampton map loads third-party map tiles. The tile service receives technical request information such as IP address and the map area requested.
These providers may process information outside the UK. The operator must verify and record the applicable provider locations, contractual safeguards and how a copy can be obtained before this draft is released. A London database region alone is not a promise of UK-only processing.
How long information is kept
- Account and member-feature data is kept while the account and feature are active, then reviewed or deleted when it is no longer needed, subject to safety, dispute, security and legal needs. There is not currently a self-service account-deletion tool.
- Feedback, access requests and correspondence are kept while needed to review, respond, maintain an audit trail or resolve a problem. A final routine retention period has not yet been approved.
- Deleted Community wording and moderation records are currently retained for restricted safety and accountability review. A proposed 90-day routine policy has not been activated and is not promised here.
- Exams study groups initially expire after six months and can be extended one month at a time. When an expired group is claimed by the hourly cleanup, its messages, memberships, sessions and files are deleted after storage deletion succeeds. If cleanup is delayed, access stays blocked and deletion is retried.
- Daily aggregate popularity rows are kept for 45 days and ranked over the most recent 30 days.
Browser storage, location and external resources
GP Navigator uses browser storage for useful preferences and temporary state, including appearance, selected training area, recently viewed pages, Quick tools introduction, Browse sorting, checklists, draft buffers and signed-out saved pages or private notes. A short session value prevents the same content page being counted repeatedly within about 30 minutes.
When you choose Use my location, the browser asks permission and supplies coordinates to the page in memory. GP Navigator compares them with reviewed reference points in your browser; it does not send or save the raw coordinates. If you then save a broad training area, that selection follows the existing form or browser-storage behaviour. Your browser or operating system may use its own location provider, which is outside GP Navigator’s control.
GP Navigator does not currently use advertising trackers or a general third-party analytics product. The first-party popularity counter stores only daily aggregate opens by stable content ID. No cookie banner is currently shown. The operator must reassess whether consent controls are needed if the storage, tracking or third-party technology changes.
Matching and access checks
GP Navigator uses automatic rules to check allowed signup addresses, apply current account and feature access, filter content, deduplicate aggregate page opens and rank opted-in Exams partner suggestions. Matching uses the plan fields members choose to share and produces suggestions; members decide whether to contact, accept or form a group.
The current application does not make solely automated decisions intended to have legal or similarly significant effects. This must be reviewed if payments, employment decisions, professional verification or materially different profiling are introduced.
Your information and data-protection rights
Depending on the information and the confirmed lawful basis, you may have rights to ask for access, correction, erasure, restriction, portability or to object to use. Where processing genuinely relies on consent, you may withdraw it. These rights can have qualifications and do not always require every record to be deleted.
You can edit profile details, replace or remove your photo, manage saved state and remove your own Community contributions through current controls. For an account-level request or a copy of information that is not available in the interface, contact contact@gpnavigator.co.uk. GP Navigator does not currently promise an automated export or deletion tool.
Contact GP Navigator
Email contact@gpnavigator.co.uk for a privacy question, rights request or concern. Do not include patient-identifiable or confidential clinical information.
You can also complain to the UK Information Commissioner’s Office. See ICO data-protection complaints guidance (opens in a new tab) or call 0303 123 1113.