This policy explains how OKAYiT ("we", "us") collects and uses personal data when you use the OKAYiT BLIS app and website ("BLIS"). It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
Who we are
OKAYIT LTD (registered office 71-75 Shelton Street, London WC2H 9JQ) is the data controller for personal data processed through BLIS. Contact: support@okayit.org. Website: blis.okayit.uk.
Please do not share identifiable information
BLIS is a learning tool and is not a care record. Do not enter names, dates of birth, addresses, room numbers, NHS or case numbers, photographs or any other detail that could identify a patient, resident, service user, child, family member or colleague. This includes free-text areas such as scenario responses, reflections, Digital Coach conversations, debriefs, journals and supervision notes. If identifiable information is entered by mistake, please delete it or contact us and we will remove it.
Information we collect
- Account details: email address, a display name (a nickname is fine), work setting and role. First name, surname and organisation are optional
- Security data: a securely hashed password and, if you turn it on, two-factor authentication settings
- Your learning content: scenario responses, reflections, Digital Coach messages, journal entries and CPD records you choose to create
- Usage data: features used, progress, streaks and basic technical information needed to run and secure the service
- Subscription status: whether BLIS Pro is active, the product and the store it was bought through. We never receive your card details
- Notification token: if you allow notifications, a device token so we can send reminders you have asked for
Information we do not collect
- Data about patients, residents, service users or other third parties (and you must not enter it)
- Precise location, contacts, photos or biometric data
- Payment card details (handled entirely by Apple or Google)
- Advertising identifiers. BLIS contains no third-party advertising and no cross-app tracking
How we use your information and our lawful bases
- To provide the service (your account, scenarios, coaching, progress, CPD records): performance of a contract, UK GDPR Article 6(1)(b)
- To keep BLIS secure and working (fraud prevention, troubleshooting, service improvement): legitimate interests, Article 6(1)(f)
- Optional reminders and research participation: your consent, Article 6(1)(a), which you can withdraw at any time in the app
- Legal obligations such as responding to rights requests: Article 6(1)(c)
BLIS is not designed to process special category data. Please do not enter health information about yourself or anyone else.
Automated decisions
Scenario feedback and Digital Coach prompts are generated by rules written by our practice team. They are for your learning only. No decision that has legal or similarly significant effects on you is made automatically, and your content is never used to train external models.
Non-punitive use
- BLIS data is never used for disciplinary proceedings, performance management or employment decisions
- Individual reflections remain private to you unless you choose to share them
- Managers receive only anonymised, aggregated team insights with a minimum group size
Who we share data with
We do not sell your personal data or share it for marketing. We use a small number of processors under written contracts:
- Hostinger: application hosting
- Supabase: managed database, hosted in London
- Expo: delivering push notifications
- Resend: sending account and security emails
- Apple and Google: app distribution, in-app subscriptions and push notification delivery, under their own privacy policies
We may disclose information where required by law.
International transfers
Some processors are based outside the UK, including in the United States. Where data leaves the UK we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where applicable), the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Data stored on your device
Some features (such as supervision notes, incident debriefs and the decision journal) are stored only on your device and are not sent to our servers. They are excluded from phone backups, so removing the app deletes them for good.
Retention
We keep your data while your account is active. When you delete your account in the app, your personal data is removed from our live systems straight away and from backups within 30 days. Accounts inactive for 24 months may be deleted after a reminder email.
Security
Data is encrypted in transit (TLS) and at rest. Passwords are hashed, sessions time out and two-factor authentication is available.
Your rights
You have the right to access, correct, erase, restrict, object to processing of, and receive a portable copy of your data, and to withdraw consent at any time. You can export and delete your data yourself from the Profile tab, or email support@okayit.org. We will respond within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to help first.
Age
BLIS is for adults working or training in health, social care and early years. It is not intended for anyone under 18.
Changes
We will tell you about significant changes to this policy in the app before they take effect.