Privacy Policy

Operator: Supervision2 Ltd ("1two.one", "We", "Us", "Our")

Platform Domain: 1two.one

1. Introduction & Regulatory Roles

This Privacy Policy explains how Supervision2 Ltd collects, processes, stores, and protects personal data and special category data across our ambient supervision analysis platform (1two.one).

Under the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018:

• Customer Account & System Administration Data: Supervision2 Ltd acts as a Data Controller for subscriber account credentials, billing information, and platform telemetry.
• Supervision Content & Compliance Data: For all audio recordings, text transcripts, staff notes, and extracted CQC/Care Certificate/Ofsted compliance evidence, the subscribing organisation (your employer/care provider) is the Data Controller. Supervision2 Ltd acts strictly as a Data Processor operating under documented instructions (Schedule 1 DPA).

2. Information We Process

We process data across two primary operational tiers:

A. Subscriber & Account Data (Controller)

• Identity Data: Names, professional titles, and corporate email addresses of registered supervisors, managers, and system administrators.
• Transaction & Billing Data: Payment history, subscription tiers, branch/location IDs, and invoice metadata (processed securely via Stripe).
• Technical Logs: IP addresses, authentication timestamps, and system audit logs.

B. Supervision Content (Processor on behalf of Subscribers)

• Audio Content: Ambient audio recordings captured during formal staff supervisions, appraisals, and care assessments.
• Text Transcripts: Sanitised, machine-generated textual transcripts of supervision audio.
• Special Category Data: Health disclosures, safeguarding notes, or performance discussions arising during care supervisions (processed under UK GDPR Article 9(2)(h) and Schedule 1 of the Data Protection Act 2018 for health and social care management).
• Compliance Evidence Cards: Extracted compliance tags mapped to CQC Quality Statements, Care Certificate standards, CIW, Care Inspectorate, RQIA, or Ofsted frameworks.

3. Statutory Audio Recording Controls & Consent Policy

In strict accordance with Section 2 of our Terms of Service:

• Mandatory Pre-Recording Notice: The platform displays an explicit on-screen warning prior to audio capture: "This meeting is being recorded in line with our recording policy and requirement to gather evidence of compliance."
• Prohibition of Covert Recordings: Covert or unacknowledged audio capture is strictly prohibited. All ambient audio processing relies on full participant awareness and compulsory dual electronic sign-off from both the supervisor and supervisee/attendee before records are finalised.
• Data Controller Responsibility: Subscribing organisations warrant that they maintain valid organisational recording policies and statutory legal bases under UK GDPR before initiating any session.

4. UK Data Sovereignty & Infrastructure Mapping

To comply with NHS Data Security and Protection Toolkit (DSPT) standards and UK GDPR Article 44, all data processing is bounded exclusively within the United Kingdom:

5. Zero Model Training & Data Isolation Guarantees

• No Public AI Training: Supervision2 Ltd guarantees that raw audio, transcripts, supervisor notes, and personal health data are never used to train, retrain, or fine-tune public, commercial, or third-party foundation AI models.
• Stateless Processing & Log Exclusions: AI analysis passes are executed statelessly in RAM during inference. Active Cloud Logging exclusion filters (resource.type="aiplatform.googleapis.com/...") drop transient prompt and completion payloads, ensuring no audio or text content is stored in audit trails.
• Tenant Isolation: Multi-tenant databases are logically isolated at the database level using strict PostgreSQL Row-Level Security (RLS) rules.

6. Data Retention & Erasure Schedules

In accordance with Section 6 of our Terms of Service:

• Transient Raw Audio Purge: Raw audio files are stored in transient encrypted storage solely for transcription and validation. Raw audio is automatically and permanently hard-deleted upon dual electronic sign-off by the supervisor and supervisee, or strictly within 30 days of initial upload, whichever occurs first.
• Draft Transcripts: If a session remains in draft status past 30 days, the underlying raw audio is purged, but the sanitised text transcript remains accessible to authorised users to complete dual sign-off.
• Post-Cancellation Hard Erasure: Upon subscription cancellation, non-renewal, or termination, subscribers must complete all report downloads prior to the effective cancellation date. Immediately following cancellation (or following the 14-day billing grace period), tenant database containers, user accounts, and supervision records are queued for unrecoverable hard erasure from our UK cloud servers.

7. Security Measures

We enforce rigorous technical and organisational security controls:

• Encryption in Transit: TLS 1.3 enforced for all web and API data streams.
• Encryption at Rest: AES-256 encryption applied across all databases, backups, and transient object stores.
• Access Control: Role-Based Access Control (RBAC) and Row-Level Security (RLS) ensure branch and organisation isolation.
• Security Incident Response: In the event of a confirmed Personal Data Breach, Supervision2 Ltd will notify affected subscribing Data Controllers without undue delay and within 48 hours.

8. Data Subject Rights & Contact Details

Supervisors, care staff, and individuals whose personal data is processed within supervision records have specific rights under UK GDPR (including access, rectification, erasure, and restriction). Because Supervision2 Ltd processes supervision content as a Data Processor, individuals seeking to exercise their rights regarding transcript or audio content should contact their employing care organisation directly (the Data Controller).

Contact us

For enquiries regarding this Privacy Policy or 1two.one's data protection practices:

• Email: privacy@1two.one
• Licensor: Supervision2 Ltd, United Kingdom
• ICO Registration: ZC215901

If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.