This Privacy Notice explains how Calside — Practice training for UK general practice ("Calside", "we", "us") collects, uses and looks after personal data when you use the Calside training platform. We take your privacy seriously and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Calside is a training platform created by Grant Cameron Anthony for GP practice teams across the UK. For the purposes of UK GDPR, the data controller is:

Grant Cameron Anthony, Calside — Practice training for UK general practice
Contact: Grant.Anthony2@nhs.scot
WhatsApp / phone: 07590 335390

When your practice invites you to Calside using a practice invite code, your Practice Manager acts as the primary data controller for progress and completion records related to your employment; Calside acts as processor for that content and as controller for the platform account itself.

2. What personal data we collect

Account data: your name, work email address, hashed password, role (learner / Practice Manager / super admin), and the practice you belong to.
Learning data: which courses and lessons you have opened, quiz scores, flashcard spaced-repetition state, completion timestamps, and downloaded certificates.
Technical data: IP address at login, browser type, and session cookies necessary for authentication.

Special category data: we do not routinely collect health, ethnicity, religion or other special-category data. You should never enter patient-identifiable information into any Calside field.

No paid tier, no card data on Calside. Calside itself is 100% free — there is no subscription and no paid tier. Optional donations are handled entirely by Stripe on Stripe-hosted pages; card details are entered on Stripe's own checkout and are never seen, transmitted through, or stored by Calside.

3. Lawful bases (UK GDPR Article 6)

Contract (Art. 6(1)(b)): to provide the training platform you or your practice have signed up for.
Legitimate interests (Art. 6(1)(f)): to keep the platform secure, improve the learning experience, and communicate essential service updates.
Legal obligation (Art. 6(1)(c)): to keep financial records where payments are processed, and to respond to lawful requests from regulators or the courts.
Consent (Art. 6(1)(a)): where we ever ask for optional analytics or marketing consent, we will do so explicitly and you can withdraw at any time.

4. Who we share your data with

We use a small number of vetted processors, each bound by a data-processing agreement:

MongoDB Atlas / hosting provider — stores the account and learning database in encrypted form. UK / EEA region unless notified.
Your Practice Manager — sees your progress and completion status as part of practice-level oversight of mandatory training.
Stripe Payments Europe, Ltd. — only if you choose to make an optional donation via the footer "Keep it afloat" links. You are redirected to Stripe's own hosted checkout; Stripe processes the payment and holds the card data, not Calside. See Stripe's privacy policy.

We do not sell your personal data to anyone, and we do not use it for advertising. We use no AI processors and no advertising networks. The only payment processor we interact with is Stripe, and only when you voluntarily make a donation.

5. International transfers

All personal data is stored in the UK / EEA. Where any sub-processor operates outside the UK / EEA, we rely on the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) in accordance with UK GDPR. All transfers are encrypted in transit.

6. How long we keep your data

Account and learning records: retained while your practice remains on Calside, and for a further 12 months after you leave your practice, so that certificates and progress records remain retrievable for revalidation and appraisal.
Backups: encrypted backups are kept on a rolling 30-day cycle and are then overwritten.

7. Your rights under UK GDPR

You have the following rights, free of charge:

Right of access — request a copy of the personal data we hold about you.
Right to rectification — ask us to correct inaccurate data.
Right to erasure ("right to be forgotten") — ask us to delete your data, subject to legal retention obligations.
Right to restrict processing — pause our use of your data while a dispute is resolved.
Right to data portability — receive your account and progress data in a portable format.
Right to object — object to processing based on legitimate interests.
Rights in relation to automated decision-making — we do not use automated decisions with legal effect. Calside is a learning platform, not a decision-maker.

To exercise any right, email Grant.Anthony2@nhs.scot. We will respond within one month.

8. Security

Passwords are hashed using bcrypt. All traffic is served over HTTPS/TLS. Access to production databases is restricted to named administrators and logged. We follow industry-standard practices around role-based access control, secret management and vulnerability patching. In the unlikely event of a personal-data breach that meets the reporting threshold, we will notify the Information Commissioner's Office (ICO) within 72 hours and affected users without undue delay, in accordance with UK GDPR Articles 33-34.

9. Cookies & analytics

Calside uses essential cookies to sign you in and keep you signed in. These cannot be disabled — without them the platform cannot function.

With your consent, Calside also uses Google Analytics 4 (measurement ID G-JTR1DTFZ9K) to understand which pages are visited and improve the platform. Analytics starts in a denied state under Google Consent Mode v2 — no analytics cookies are set and no measurement is sent to Google until you accept the banner. IP addresses are anonymised. We do not use advertising cookies, ad-personalisation cookies, or third-party tracking pixels.

You can change your decision at any time by clearing your browser's localStorage for this site — the banner will reappear on next visit and you can choose again.

10. Children

Calside is a professional training platform for adult healthcare staff. It is not directed at children under 18. If you believe a child has registered an account, please contact us at once so we can remove it.

11. Complaints

If you have a concern about how we handle your personal data, please contact us first at Grant.Anthony2@nhs.scot. If you remain unsatisfied, you have the right to complain to the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Changes to this notice

We may update this Privacy Notice from time to time. The "Last updated" date at the top of this page reflects the most recent change. Material changes will be notified to you by email or an in-app notice.

This notice is written for the whole practice team — reception, admin, HCAs, nurses, ANPs, GPs and Practice Managers. If any section is unclear, tell us — a policy that isn't understood does no one any good.