Security and data use
This page describes the service available now. Security and privacy information will be expanded before stored documents, payments or connected services open.
Recently opened chapters, saved topics, manual review lists and pilot flashcard schedules are kept in browser storage. They are not sent to a learning account or shared across devices. Clear topic lists from My Dashboard; clear flashcard schedules from your browser settings.
The portfolio and pay checker have moved out of the main product navigation. Their authentication, access controls and data-handling rules described below still apply.
The live site provides a saved free Passport, an optional goal-research request, one signed-in free Money Check case, public demos and Money Monitor interest registration. It does not yet accept payment or connect to a mailbox.
The free check can read an XLSX or CSV timetable, iCalendar export and one payslip PDF inside your browser. An older rota screenshot can be displayed locally as a manual reference but is not automatically extracted. The files, screenshot, extracted text, selected-month calendar, edits and calculated result are not sent to or stored by Doctor’s Passport.
You choose the payslip month before review. A file or feed may contain a wider date range, but only entries dated within the selected month enter the editable calendar; other entries are discarded from the check during parsing.
Every import is an unverified draft. Teaching, Rest/off, annual leave, study leave, sickness and bank holidays remain labelled, while blank dates remain unresolved. Every date and calendar week must be confirmed. A sickness entry must be completed with the hours and type of shift originally planned; the checker does not request a diagnosis or reason for sickness, and those details stay in your browser.
The free result calculates a monthly basic-pay reference from the confirmed England 2016-contract nodal stage and, for LTFT doctors, agreed basic-pay hours. Recognised gross, net, tax, NI, pension and student-finance amounts are shown but explicitly not assessed. Additional/enhanced hours, weekend frequency, NROC, premia, bank work and arrears require further contractual evidence.
Sign-in is required before private files are opened. The database stores only a pseudonymous account key, the activated payslip month and activation timestamp for the free-case limit. Rota, payslip, amounts and result remain browser-local. Corrections to the same month remain available.
A supported private Personal Roster link is available only for the current or immediately preceding month and is retrieved once through the Doctor’s Passport server because Allocate does not permit this browser to read it directly. Older months require a saved file, local screenshot reference or manual reconstruction. The importer accepts only the approved Liverpool Employee Online address and calendar path, blocks redirects and oversized or non-calendar responses, and does not save the link, token, calendar or result. The provider response exists transiently while the selected month is extracted. It does not stay connected or refresh automatically.
Alex’s records are invented. The public demos do not need real payslips, receipts, rota files, emails or clinical information.
The form records a minimal, unverified contact request that expires after 30 days and is then deleted on the next retention cleanup. It does not create marketing consent or a mailing-list entry. No marketing is sent until a separate double-opt-in confirmation process is available and completed.
Public analytics, interest and one-time calendar endpoints use expiring keyed-HMAC rate buckets derived from the network address supplied by the hosting edge. Raw addresses and browser user-agents are not written to those buckets, and the bucket values are not used for analytics.
The owner-only results view separates pending requests from confirmed contacts. Pending addresses are not presented as verified leads or mailing-list contacts.
A signed-in user can save a profile, current rotation and closeout checks, weekly-review time, up to twelve saved goals including completed or archived history, a career and evidence index, and a unified action plan under transparent fair-use limits. Each accepted save advances the current snapshot revision so an older tab cannot silently replace newer data. This is not document storage or a permanent version archive. Do not enter patient-identifiable information, colleague details, clinical notes, health information, private access links or confidential organisational information.
Goal research is optional. The source-led fallback does not send goal context to OpenAI. When live source research is available, only the non-confidential context needed for the request is sent; identity, organisation and uploaded rota or payslip files are excluded. Every returned action, date and source remains a draft for the doctor to check.
Mini-CEX, CbD, DOPS and reflection drafting runs in the browser from the doctor’s own non-identifiable facts. Notes and drafts are not saved or transmitted, identifier warnings are only a warning aid, and the tool never generates assessor feedback, ratings, credentials or sign-off. It is not a clinical-record or official-portfolio system.
The first email-assisted approach would use messages a doctor forwards or deliberately selects. Every proposed event, receipt or record would require confirmation; the service would not silently scan an inbox.
Questions or concerns
Email hello@doctorspassport.co.uk. Privacy requests can be sent to privacy@doctorspassport.co.uk.
Read the privacy notice