P3 data statement

What P3 holds

Clinicians' own professional records: activities, reflections, personal development plan goals, a profile, and files they attach (PDF, JPEG or PNG).

Account details: name and email address from the person's Microsoft account, when they first and last used P3, and their role in P3.

A record of use: sign-ins, pages viewed and administrator actions, kept for security and support.

P3 does not accept patient-identifiable data. Users agree to this before first use and are reminded wherever they can enter text or files.

Where it is kept

The application runs on Vercel in London. The database is Postgres on Railway in the EU (Amsterdam). Attached files are private objects in Vercel Blob storage in London. Sign-in is through Microsoft Entra ID in the Strasys tenant.

Nightly encrypted copies of the database are kept for 30 days as backups. The key that unlocks them is held separately, in Microsoft Azure Key Vault.

Who can see it

Each person sees only their own portfolio; this is enforced by the application and again by the database itself.

Two-step verification is required on every sign-in. Access is by invitation, and an administrator can remove it at any time.

An administrator can view a person's portfolio only with a recorded reason, read-only, for up to 30 minutes, and the person can see every such view.

Keeping and deleting

A person can delete their whole portfolio from their profile page at any time. Entries remain in the encrypted backups for up to 30 days; attached files are deleted immediately.

Suppliers

Vercel (application hosting and file storage, London), Railway (database, Amsterdam), Microsoft (sign-in and the backup key), and GitHub (encrypted database backups).