Summarex privacy.
Evidence-readiness assessment for care organisations. For your organisation's assessment content, Chronix Health Group Ltd is a processor acting on your organisation's instructions — your organisation is the controller. For accounts and billing, Chronix is the controller.
Your organisation's assessment content
Our role: processor. Chronix Health Group Ltd is a PROCESSOR for your organisation's assessment answers — the controller is YOUR ORGANISATION, which decides what to record and why.
Why: Recording whether a record exists, how current it is and where it is held — never its content. No special-category data is ingested by design.
Lawful basis: Processed on the organisation's documented instructions under the service agreement.
Who receives it: Supabase (eu-west-1), Vercel. Google Workspace hosts support@sumrex.app, so correspondence about an assessment is stored by Google — the assessment content itself is not sent there.
How long we keep it: Held for the organisation for the life of its account plus statutory record periods; report snapshots kept for the organisation's audit trail.
Accounts and billing
Our role: controller. Chronix Health Group Ltd is the controller for account and billing data.
Why: Operating user accounts and taking payment.
Lawful basis: Contract; legal obligation (tax records).
Who receives it: Stripe (payments), Supabase, Vercel, Google Workspace (hosting support@sumrex.app, so account correspondence is stored by Google).
How long we keep it: Account life plus 30 days; billing and tax records 6 years.
International transfers
Data is resident in the UK/EU. No Care World engagement data can enter Summarex — enforced by database constraints and a lint in every test run.
Your rights
You can ask for access to your data, correction, deletion, restriction, and a portable copy, and you can object to processing based on legitimate interests. Where we act as a processor, we pass your request to the controller (the organisation or clinician) without delay.
Complaints
Tell us first if you can — use the data complaints form (no account needed). We acknowledge every complaint when it is made and respond within a month. You can also complain to the Information Commissioner's Office (ICO), the UK regulator, at any time, and you have the right to an effective judicial remedy.