GDPR Commitments

Our Commitment

NurtureArc is committed to complying with the UK General Data Protection Regulation (UK GDPR) and the EU GDPR. This page summarises our key obligations and how we meet them.

Lawful Basis for Processing

We process your personal data on the basis of legitimate interests — specifically, to provide you with the wellness assessment service you have requested. Where we process sensitive wellness information, we rely on your explicit consent given when you begin the assessment.

Data Minimisation

We collect only the data necessary to provide the service. Name, email, and role are optional. Wellness answers are the minimum required to generate a personalised report.

Data Retention

Assessment data is retained for 12 months. After that period, it is automatically deleted from our systems.

Data Transfers

Data is processed and stored in the EU. Any transfer of data to third-party processors (Anthropic, Neon, Render) is governed by appropriate data processing agreements.

Your Rights Under GDPR

• Right to access — request a copy of the data we hold about you
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion ("right to be forgotten")
• Right to restriction — limit how we use your data
• Right to portability — receive your data in a machine-readable format
• Right to object — object to processing based on legitimate interests

To exercise any of these rights, email hello@nurturearc.polsia.app. We will respond within 30 days.

Supervisory Authority

If you believe we have not handled your data in accordance with GDPR, you have the right to lodge a complaint with the relevant supervisory authority. In the UK, this is the Information Commissioner's Office (ICO).

Contact

For GDPR enquiries, email hello@nurturearc.polsia.app.