Unpack
Last updated 30 September 2026

Privacy Policy

This policy explains what personal data Unpack (the reflection and coaching app, currently also referred to in places as “Unpack”, the name of the assistant inside the app) collects, why we process it, how long we keep it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

Contacting us about your data

For any question about this policy, or to exercise your data protection rights, email info@unpackhealth.co.uk. We aim to reply within two working days and to answer rights requests within one month.

1. Who we are

Unpack is operated by Azimuth Associates LTD t/a Unpack, designed by Rose & Co (roseand.co). Azimuth Associates LTD t/a Unpack is the data controller for the personal data described in this policy, except where you use Unpack on behalf of an employer, practice or organisation — see “Professional and organisation use” below.

Azimuth Associates LTD t/a Unpack is registered with the Information Commissioner’s Office (ICO), registration number ZB497244. Our registered address is Francis House, Coventry Road, Burbage, Leicestershire LE10 2HL.

More detail for practices and organisations — including our Data Processing Agreement, Retention Schedule, Security & Technical Measures statement and Subprocessor Register — is published in our Trust & Security Pack.

You can contact us about anything in this policy at info@unpackhealth.co.uk.

2. What Unpack is — and is not

Unpack is designed for documentation, retrieval and organisation of previously discussed information, communication analysis and professional development. It helps professionals record and reflect on conversations, prepare draft documentation, build a personal learning journey and prepare for their next conversation. It is not a substitute for the clinical, dental or other professional records you are required to keep. It is not intended to diagnose, prevent, monitor, predict, prognose, treat or alleviate disease or injury; determine patient-specific treatment suitability; or recommend patient-specific treatment, medication, investigation, dosage or referral. Clinical decisions remain with the treating clinician. Nothing produced by Unpack should be relied on as a clinical record or as clinical, legal or regulatory advice.

3. What data we process

Account and profile data

  • Email address and authentication credentials (managed by our auth provider).
  • Your mobile telephone number, if you choose to give one. It is optional contact detail only, used for essential service messages, never for marketing, and it plays no part in signing in. No text-message provider is involved in authentication, and phone sign-in is switched off. Any account may switch on two-step verification with a free authenticator app, which we recommend; once switched on, that account is asked for a code at every later sign-in. The codes are generated and checked by our authentication provider (Supabase Auth) and are never stored by us. Privileged administrative functions always require an authenticator-app code. If you lose access to your authenticator app, contact Unpack support: we verify who you are before replacing the factor, and there is no password-only self-reset.
  • Your name, clinical roles and other profile details you choose to add.
  • Your practice or organisation name and, where applicable, your membership of a practice or coaching group.
  • Enquiry-form content if you request access to Unpack (name, email, practice, roles and any message you write).

Recordings, transcripts and imported content

  • Audio you record in the app. When you start a recording, audio is captured on your device, stored in our secure audio store and sent to our transcription provider to be converted into text. The audio file is kept only while it is being processed: once transcription and the related processing have completed successfully, the audio is deleted automatically. If processing fails or is interrupted, the audio is kept temporarily for retry. Its designed seven-day expiry was not enforced by a registered scheduled sweep at audit; remediation and verified deletion remain outstanding. No seven-day deletion guarantee is made. The transcript text is kept. You can delete a recording and its audio yourself at any time.
  • Transcripts. Transcripts are stored in our database, linked to your account, so that Unpack can re-analyse them, build your history and generate preparation for future conversations. They are stored as text and are protected by access controls (see “Security”), but they are not encrypted at application level and are not anonymised.
  • Uploaded and imported content. Audio, text, Word and PDF files you upload; transcripts and summaries delivered into your Unpack inbox from an external recorder (for example a Plaud device forwarded via an automation service); handwritten diary pages you photograph; and reference or philosophy documents uploaded by an administrator.

Transcripts and uploads can contain information about other people — colleagues, team members and, if you record clinical conversations, patients. That may include health information, which is “special category” data under UK data protection law. See “Your responsibilities when recording” below.

Content Unpack generates about you

  • Summaries, themes and coaching observations derived from your transcripts.
  • Your learning journey, journey events, patterns, understanding and perspective insights, current concerns, focus items and practice/development items.
  • Daily diary entries and reflections, and Ask Unpack conversation history.
  • Coaching notes, session memories and preparation briefs, including notes made by a coach about a coaching client where you have joined a coaching programme.

Unpack does not score, grade or rank you, and it does not produce a performance rating or a league table. Some views do show counts and rates — for example how often a particular kind of evidence appears in your own recorded conversations over time. These are descriptive measures of what is present in your own material, shown to support reflection; they are not a judgement of competence and are not used to assess or compare people.

Technical and security data

  • Authentication tokens and session information stored in your browser’s local storage (or in the app on iOS) so you stay signed in.
  • Push notification tokens. If you allow notifications, the device token issued by Apple and Google Firebase Cloud Messaging is stored against your account so we can send you app notifications. Firebase Cloud Messaging (Google) delivers those messages. You can turn notifications off in your device settings.
  • Saved sign-in details on iOS. If you tick “Remember me” in the iOS app, your email address and password are stored in the device’s own iOS Keychain, protected by Face ID, Touch ID or your device passcode. They stay on your device — they are never sent to us in that form and we cannot read them.
  • Server and platform logs generated when you use the app, including timestamps, request/error information and IP address, used for security, abuse prevention and debugging.
  • Records of inbox/webhook deliveries so you can see what an external recorder sent.
  • Administrative audit records (for example account deletion events, access-request handling and impersonation used for support/testing).

4. How we use your data, and our lawful bases

  • To provide the service you have asked for — creating your account, transcribing recordings, producing analyses and coaching output, maintaining your learning journey and history, re-analysis, “Prepare for next time”, diary, Ask Unpack and coaching features. Lawful basis: performance of a contract with you (or steps taken at your request).
  • To keep the service secure and working — logging, abuse prevention, diagnosing faults, backups. Lawful basis: legitimate interests (running a secure, reliable service).
  • To respond to enquiries and provide support. Lawful basis: legitimate interests, or contract where you are already a user.
  • To improve Unpack — understanding how features are used and fixing what does not work, using the minimum data necessary. Lawful basis: legitimate interests. We do not submit your content for the purpose of training AI models. We cannot, however, claim a contractual training exclusion at supplier level: our AI requests are routed through the Lovable AI Gateway on the Lovable Pro plan, and the model-training opt-out Lovable offers on its Business plan is not available to this account. This is recorded as an open supplier governance item in our Subprocessor Register.
  • To meet legal obligations — for example responding to a valid rights request or a legal requirement. Lawful basis: legal obligation.
  • Optional device features — microphone access, and Face ID / Touch ID app lock on iOS, are used only where you enable them. Lawful basis: consent, which you can withdraw in your device settings.

Special category (health) data. Unpack does not ask you to record patient conversations, but the app can be used that way. Where such content is uploaded, the appropriate Article 9 condition will normally depend on the professional context in which you are recording, and on your own organisation’s arrangements with the people concerned. This position must be confirmed with a data protection adviser and reflected in the contract between Azimuth Associates LTD t/a Unpack and your organisation before it is relied upon.

5. Your responsibilities when recording

  • You are responsible for having the authority and any consent needed to record, upload or import a conversation, and for telling the other people involved.
  • Only record where it is lawful and appropriate to do so, and follow your employer’s, practice’s and professional regulator’s rules. Agreeing in the app that a recording may go ahead is an operational check that you have handled this properly; it is not, by itself, a GDPR lawful basis or a record of the patient’s consent. Our Patient Recording Guidance explains the difference.
  • Recording only ever happens when you start it. Unpack does not listen in the background, and the app requests microphone permission from your device before any recording can begin.

6. Professional and organisation use

If you use Unpack as part of a practice, employer or coaching programme, that organisation may be the controller of the content you create about its patients or staff, with Azimuth Associates LTD t/a Unpack acting as processor for that content under a written agreement. Coaches within a coaching programme can see the coaching material for clients assigned to them, including sessions, notes and preparation briefs, and administrators can see practice-level content shared with the practice. The precise controller/processor split is recorded in your organisation’s agreement with Azimuth Associates LTD Associates t/a Unpack.

7. AI and transcription providers

Unpack sends recordings and text to third-party AI services in order to transcribe and analyse them, and to answer your questions. Based on the app’s current configuration:

  • Lovable AI Gateway (Lovable) is the routing layer through which every AI request is made. It passes each request to the company that runs the model.
  • OpenAI receives, through that gateway: audio recordings and voice notes, to convert them into text; and your typed or spoken Ask Unpack questions and patient conversation preparation, together with the relevant context for that feature (earlier conversations, analyses and profile details).
  • Google (Gemini models) receives, through that gateway, transcripts and document text, with relevant history and profile context, to produce analyses, summaries, draft notes, coaching observations, journey, insights and preparation content.
  • Supabase provides our database, authentication and file storage, and our application is hosted on the Lovable platform (Cloudflare infrastructure).

Your agreement before AI is used. Before any of your content is sent to these AI services, Unpack shows a “How Unpack uses AI” screen that names them and asks you to agree. Until you agree, Unpack’s AI features are switched off on our servers, and the rest of the app still works. We record the version of the wording you agreed to and when. You can review or withdraw your agreement at any time in Profile → AI processing; withdrawal stops future AI processing but does not delete content or analyses already created. If we change the providers or materially change this processing, we ask again. Separately, each recording, upload or pasted transcript asks you to confirm that everyone taking part agreed to it.

Recorders connected to your practice. Where a Plaud recorder is connected to a practice so that transcripts are analysed automatically on arrival, that automatic analysis only happens once you have agreed on the “How Unpack uses AI” screen. Until then, arriving transcripts are held in your Unpack inbox and nothing is sent to an AI service. Transcripts delivered to your personal inbox are only analysed when you choose to.

Content is routed through the Lovable AI Gateway to these providers so that they can return the requested transcription or analysis. We do not hold direct contracts with OpenAI or Google for this processing, so we do not say that they act on Azimuth Associates LTD’s direct instructions. Model providers may operate outside the UK/EEA. Their published terms may include the EU standard contractual clauses as amended by the UK Addendum, or an equivalent mechanism, but the mechanism that actually applies to our arrangement through the Lovable gateway is still being confirmed. The exact processing locations, retention periods and model-training positions of each provider are verified against current provider terms and recorded in our Subprocessor Register, which shows what is confirmed and what remains open. Items still marked open there are outstanding before our production governance position can be treated as complete; we do not make guarantees here that we have not verified.

Transcription and analysis models are reached through the Lovable AI Gateway, not under a direct Azimuth Associates LTD account with OpenAI or Google, so we do not present ourselves as a party to those providers’ own data processing agreements. Our database, authentication and file storage run in the Supabase eu-central-1 region (Frankfurt, Germany), inside the European Union. This is where Unpack’s core database data — including account data, transcripts, analyses and stored files — is hosted. AI, transcription, network and application-platform providers may process data elsewhere, so we do not claim UK-only hosting or that every processing activity remains in the EU.

8. How long we keep data

  • Audio recordings: kept only until processing has completed successfully, then deleted automatically. Audio from failed or incomplete processing is kept for retry. A seven-day expiry is designed but the scheduled sweep was missing at audit; verified remediation remains outstanding. No seven-day guarantee is made. Transcript text is kept.
  • Transcripts, analyses and journey content: retained for as long as your account is active and the material is needed to provide the historical, coaching and preparation functionality you use. There is currently no fixed retention period for this material; it is held for as long as the account is active, and setting a defined period is an open item. Our published Retention Schedule sets out what we currently hold, and for how long, category by category. You can delete individual sessions, inbox items and transcripts yourself at any time.
  • Account and profile data: retained while your account exists.
  • Platform and provider logs: infrastructure and platform logs are held and rotated by our providers on their own schedules. We have not verified the exact periods, so we do not state one.
  • Unpack audit records: account-deletion records and administrative audit records currently have no fixed expiry and there is no automated clean-up job; agreeing a formal period is an open item. What we hold, and the current position for each category, is set out in our Retention Schedule.

9. Deleting your account

You can delete your account yourself from Profile → Delete my account in the app. The process is:

  • You confirm in several steps (including re-authentication and typing DELETE), and deletion is then scheduled for 30 days later.
  • During that 30-day grace period your account works as normal and a banner shows the exact deletion date with a Cancel deletion option. Nothing is deleted before that date.
  • After the deadline, an automated daily purge permanently deletes your account and your personal content: your sessions, meetings, transcripts, analyses, diary entries and diary page images, Ask Unpack threads, concerns and focus items, journey events, patterns, understanding and perspective content, timeline entries, profile and login. This is not reversible.
  • Some records are retained: minimal audit records that an account was scheduled, cancelled or purged; and shared or practice-level material you contributed (for example approved evidence or shared knowledge), which remains but is de-identified.
  • Deleted data may persist for a short period in routine encrypted backups held by our infrastructure providers before those backups expire. We cannot erase an individual record from a historical backup immediately.

10. Security

Data is transmitted over TLS and stored in a managed database with row-level security policies so that, in normal operation, your content is only accessible to you and to those you have shared it with (for example your coach or practice administrator). Access to production systems is restricted, destructive operations require dedicated server-side secrets, and administrative actions — including any support access to an account — are recorded in an audit log that the application cannot write to from the browser. Privileged administrative functions require a verified second factor (a time-based one-time code) and fail closed without one. Transcripts are protected by access control rather than by application-level or end-to-end encryption, and they are not anonymised. We do not hold ISO 27001, Cyber Essentials or SOC 2 certification, and we have not completed an independent penetration test; the full position is set out in our Security & Technical Measures statement. No system can be guaranteed completely secure, and we cannot promise absolute security, but we take appropriate technical and organisational measures and will notify you and the ICO where required if a breach occurs.

11. Cookies, storage and analytics

Unpack does not use advertising cookies, third-party analytics or cross-site tracking, and it does not track you across other apps or websites. We use only the storage that is strictly necessary to run the app: your sign-in session is kept in browser local storage (or the app’s storage on iOS), and small preferences such as whether a panel is collapsed are kept locally on your device. Because this storage is strictly necessary for a service you have requested, no cookie consent banner is required.

12. The iOS app

  • The iOS app is a native wrapper around the same Unpack service, so everything in this policy applies equally there.
  • Microphone: iOS asks your permission before Unpack can record. Recording only occurs when you start it.
  • Face ID / Touch ID: if you turn on the app lock, the biometric match is performed entirely by iOS on your device. Unpack receives only a success/failure result — we never receive or store your Face ID or Touch ID biometric data.

13. Children

Unpack is for professional use by adults only. You must be 18 or over to hold an account. Accounts are issued by invitation or approved enquiry, the app is not intended for children, and we do not knowingly create accounts for anyone under 18.

14. Your rights

Under UK data protection law you have the right to:

  • access a copy of your personal data;
  • have inaccurate data corrected;
  • have your data erased (see “Deleting your account”);
  • restrict or object to certain processing, including processing based on our legitimate interests;
  • data portability for data you provided to us;
  • withdraw consent at any time where we rely on consent (for example microphone or biometric app lock, via your device settings).

Much of this can be done in the app directly. To exercise any other right, email info@unpackhealth.co.uk. If you use Unpack through your employer or practice, please contact them first, as they may be the controller for that content.

You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would appreciate the chance to address your concern first.

15. Changes to this policy

We may update this policy as Unpack develops. The “last updated” date at the top always reflects the current version. If we make a material change — for example a new category of data, a new purpose, or a new provider — we will tell you in the app before or when the change takes effect, and by email where the change significantly affects how your data is used.

Back to Unpack