This policy explains how Reduce Admin collects, uses, stores and protects personal data. It covers this website, our booking and assessment tools, our business communications and our client engagements. It is written to be read rather than endured, and it names every third party involved rather than hiding behind the phrase trusted partners.
Reduce Admin provides AI and automation services that reduce administrative work for UK care providers and commissioners. Registered in England and Wales, company number [COMPANY NUMBER], registered address [REGISTERED ADDRESS]. Registered with the Information Commissioner's Office under registration number [ICO NUMBER].
For personal data collected through this website and our own business activity, Reduce Admin is the data controller. In client engagements we usually act as a processor or sub-processor, which is covered in section 10.
Data protection enquiries: nicky@reduceadmin.com.
When you browse the site. Technical information including IP address, browser type, device type, pages viewed and referring source. Some of this is collected by our host as part of delivering and securing the site. Analytics information is collected only where you have consented.
When you use the footer contact form. Your name, work email, organisation and the content of your message.
When you book an Admin Reduction Audit. Your name, email, organisation, chosen time, timezone and anything you add in the booking notes.
When you complete the Admin Tax Calculator. Your name, work email and organisation, together with the operational information you provide: organisation type, headcount, estimated role split, repetitive admin hours by role group, the admin areas you select, the systems you use, how often information is moved between them, how often reviews or submissions are returned and why, how governance checks are carried out and how quickly they can be evidenced, and your answers on capacity and growth constraints. We also store the figures calculated from those inputs.
When you complete the Maturity Map. Your name, work email and organisation, together with your self-assessed level for each of the five pillars and the overall result.
When you correspond with us. Email, telephone and video call records, meeting notes and any documents you choose to share.
We do not ask for special category data, and we do not ask for information about patients or service users through this website, any form, any assessment tool or any booking. Please do not send it. Where identifiable information is necessary during a client engagement, it is handled under a separate written agreement and through appropriate channels, never through this website.
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights. If you think we have that balance wrong, tell us and we will reconsider it.
We use a small number of established providers to run the business. Each processes personal data on our instructions under that provider's standard data processing terms, which incorporate the safeguards required by UK GDPR Article 28. We do not sell personal data, and we do not share it for advertising.
The specific providers involved in a client engagement are named in the data processing agreement for that engagement before any build begins. If you are assessing us as a supplier and need the current sub-processor list with contractual detail, ask and we will send it.
Some pages load content directly from other organisations. When that happens your browser connects to them, which discloses your IP address and basic technical information to that provider. This happens whether or not you interact with the content.
We do not make decisions about you by solely automated means that produce legal or similarly significant effects. The Data (Use and Access) Act 2025 sets requirements for such decisions, including transparency, a route to human review and a right to contest the outcome. Our tools do not fall into that category.
The Admin Tax Calculator and Maturity Map perform arithmetic and rule-based scoring on the figures you supply. They produce an indicative estimate and a self-assessment, not a decision about you or your organisation. No AI model is involved in producing those results.
Where AI is used in client service delivery, it supports administrative tasks such as extracting, checking, comparing, routing and flagging information. A person makes every material decision. We use enterprise model configurations that exclude customer data from provider training, and we name every model provider in the relevant agreement.
We prefer UK or EEA processing and choose it where the use case allows. Several of the providers above are based in, or transfer data to, the United States. Where that happens we rely on an appropriate safeguard, which is either UK adequacy regulations covering the provider's certification, or the International Data Transfer Addendum to the European Commission's standard contractual clauses, as incorporated in that provider's standard data processing terms.
In client engagements, data residency is agreed as part of the design and documented before anything is built. Where a component cannot meet a residency requirement, we say so before the build rather than after it.
You can ask us to delete your data sooner and we will, unless we are required to keep it.
Reduce Admin holds Cyber Essentials certification, the UK Government-backed scheme covering baseline technical controls. We apply role-based access and least privilege, use multi-factor authentication on business systems, keep the number of systems holding personal data deliberately small, and design client builds so that identifiable data stays within the client's own environment wherever the use case allows.
We do not hold ISO 27001 or ISO 42001 certification and do not claim to. If you need a supplier with certification to a specific standard, tell us early and we will be straight about what we can evidence.
If a personal data breach occurs that is likely to result in a risk to individuals, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and notify affected individuals and any relevant controller without undue delay.
When we build or run systems for a client, the client is the controller and we act as processor. Where a commissioner sits above the client in the chain, the commissioner may be the controller, the client the processor and Reduce Admin the sub-processor. We document that chain in writing before processing starts rather than leaving it to be worked out afterwards.
In those engagements, the client's own privacy information governs the processing and we act only on their documented instructions. We support the client's Data Protection Impact Assessment by supplying the technical detail it depends on, including data flows, categories of data, retention, sub-processors, security measures and the human oversight design. The DPIA remains the controller's responsibility and their Data Protection Officer signs it off, not us.
If you are a patient, service user or member of staff of one of our clients and want to exercise your rights, contact that organisation directly. We will support them in responding, but we cannot act on your request without their instruction.
Under UK data protection law you have the right to be informed about how your data is used, to access a copy of it, to have inaccurate data corrected, to have data erased in certain circumstances, to restrict processing, to object to processing based on legitimate interests, to data portability, and to withdraw consent at any time where processing is based on consent.
To exercise any of these, email nicky@reduceadmin.com. We respond within one month and will not charge you for it. We may ask you to confirm your identity, but only to the extent needed to be sure we are not disclosing your data to someone else.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113. We would rather you raised it with us first so we can put it right.
Our Cookie Policy sets out what is placed on your device, what requires consent and how to change your preferences at any time.
We update this policy when our processing changes, including when we add or remove a provider. The date at the top shows the current version. Where a change materially affects how we use data you have already given us, we will tell you directly rather than relying on you noticing.
