Your safety and privacy come first.

Duty of Care UK is designed to be anonymous. When you use the Risk Signal self-reflection feature or the Open Room, we do not ask for your name, address, date of birth, or any account.

What the Risk Signal records

• Your answers and result: the ten multiple-choice responses you give, your total score, and the risk level we display (low, moderate, or high).
• A random session ID: a temporary identifier that lets the tool remember your progress during your visit. It is not linked to your name, email address, or any account.
• Optional email: if you choose to receive your result by email, we store that address only so we can send your summary and resend it if you ask. We do not use it for marketing, profiling, or any other purpose.
• Technical context: we may record basic, non-identifying device information such as browser language, device type, and coarse location (city/country) to help us understand how the tool is used and to keep the service secure. We do not collect precise GPS coordinates or sensitive personal identifiers.

What the Open Room records

The Open Room is intentionally public and anonymous. When you post, we store only the message text and a timestamp. Messages are shown without names. Please do not post anything that could identify you or anyone else.

Your rights and deletion requests

Because most of our data is anonymous, we cannot always link a record to an individual person. If you want your Risk Signal result or Open Room post removed, please contact us through the Room section or by email at privacy@dutyofcareuk.org. Include as much detail as you can, such as the approximate time you used the tool or the exact text of your Open Room post, and we will do our best to locate and delete the relevant record within 30 days.

You can also ask us to correct inaccurate information, restrict how we use it, or explain what we hold. We will respond to privacy requests as quickly as possible and always within one month.

We do not use advertising or cross-site tracking cookies. The only things stored in your browser are:

• Essential storage: a random session ID and your Risk Signal progress, so the check works and can be resumed if you step away. Your cookie choice is stored here too.
• Non-essential storage: anonymous usage measurement that tells us which sections people find useful. It does not identify you, and you can turn it off.

You can change your choice at any time below. Choosing “Essential only” clears any non-essential values already stored.

We use Lovable Cloud for backend services, which includes database, authentication, and serverless functions. The platform provides standard protections such as encrypted data at rest and in transit, network isolation, and role-based access controls.

On top of that, we have configured the following:

• Row Level Security (RLS) is enabled on every database table, so anonymous visitors can only write the specific records the application intends.
• Database constraints enforce valid email formats, score ranges, and required fields for survey and chat data.
• No open sign-ups: we do not allow anonymous account creation; only invited or social-authenticated access is supported where needed.
• Rate and scope limits are applied to our Edge Functions to reduce the chance of abuse.
• Dependency and connector scans are run regularly; you can view the latest summary on our Security Scan Status page.

Every page on this site is served over HTTPS. That means the data travelling between your browser and our servers is encrypted while in transit and cannot be easily read or tampered with by third parties on the same network.

The site uses a valid TLS certificate issued by a publicly trusted certificate authority. Modern browsers will show a padlock icon (or similar security indicator) next to the address bar when the connection is secure.

Some employers, schools, and public Wi-Fi providers run middle-box security software that decrypts and re-encrypts web traffic. When that happens, your browser sees a certificate issued by the network's own firewall rather than the site's real certificate, which can trigger a warning.

This is a local network policy issue, not a problem with the site. If you need to access Duty of Care UK from such a network, the safest options are:

• Use your mobile data or a personal hotspot.
• Use a trusted VPN that you control.
• Ask your IT administrator to allow this domain.

If you notice something that looks broken, suspicious, or that could affect the safety of visitors, please let us know. You can reach us through the contact details on this site or via the Room section.

We review security and privacy questions as part of our regular maintenance. This page is updated when our practices change.