Privacy Policy

ORAVORN is operated by Oravorn, which is the controller of the personal data described in this policy. You can contact us at enquiries@oravorn.uk.

This policy applies to the ORAVORN website and diagnostic assessment. It is written under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

• Assessment answers: your answers to the structured questions and any free-text responses. These are saved when you submit the assessment to receive your summary. At that point we do not ask for your name or email address, but free-text answers can contain identifying information, so please do not include personal data about individuals or confidential information you are not entitled to share.
• Generated output: the summary produced from your answers, and the full report if you request one.
• Full report requests: your name, your email address, the option you choose (Full Assessment, Advisor or Teams), and any optional note you add. This is linked to the assessment it relates to.
• Technical data: our hosting provider, Cloudflare, may log technical information such as IP address and browser type for security and diagnostic purposes.
• Saved progress: the assessment saves your progress in your own browser storage so you can resume. This stays on your device and is not sent to us until you submit. You can clear it through your browser settings.
• We do not use advertising or analytics cookies.

We do not sell your data and we do not use your answers to train any AI model.

We may in future wish to use de-identified assessment data for research with academic partners. If we do, we will seek your fresh, explicit, opt-in consent first, separate from this policy, and it will not be a condition of receiving your summary or report.

• To generate your assessment summary and any full report you request. Basis: it is the service you have asked us to provide, and our legitimate interest in operating it.
• To follow up on a full report request, for example to send the report or arrange a conversation. Basis: your request, and your consent where required.
• To keep the service secure and to fix faults. Basis: our legitimate interest.
• To improve and evaluate the instrument. We do this with anonymised or aggregated data only.

We use the following service providers to run ORAVORN. They process data on our behalf. If we change a provider, we update this list before the change takes effect.

Assessment answers and generated summaries are kept for 12 months, then deleted.

If you request a full report, we keep your name, email address, any note you add, and the report for 12 months after our last contact with you, then delete them. The assessment linked to your request is kept for the same period.

If we begin working together, we keep the records of that work for as long as the law requires, typically six years.

Our AI provider automatically deletes the inputs and outputs it receives within 30 days, except where the law, or enforcement of its usage policy, requires it to keep them longer.

Under UK GDPR you can ask us for access to your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time. To exercise a right, email enquiries@oravorn.uk. We may need to verify your identity.

If you have not given us your name or email address, we may be unable to find your assessment unless you can tell us roughly when you completed it.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

We restrict access to stored data and use established infrastructure providers. No system is completely secure, so please take care over what you enter.

We may update this policy. Material changes, including changes to the providers listed above, will be shown by a new last-updated date.