Privacy Policy

Last updated: 4 October 2026 · Version 2

The short version Your records, prescriptions, costs, notes and health profile stay in your own browser. FairWait never receives them. They only leave your device if you choose to create a share link, and then only the sections you tick, until the link expires. If you create an account, we hold your name, email and sign-in times so you can sign in. We don't use tracking cookies, advertising or third-party analytics.

Who is responsible for your data

FairWait (fairwait.uk) is run by its founder, an individual based in England. FairWait is not yet a registered company. The founder is the data controller for the personal data described here. Contact: privacy@fairwait.uk. We reply within one month, as UK GDPR requires.

What stays on your device

Everything under My records (referrals, appointments, quotes, costs, status history and notes), prescriptions, insurance details, family profiles and the Health profile used by the Healthcare Passport (emergency contact, allergies, conditions) is saved only in your browser's local storage on the device you're using.

We can't see it. FairWait has no copy and no way to read it. There is no automatic backup or sync to our servers.
It's readable by anyone using this device unless you encrypt it. By default it's stored as plain text, like any website's local storage. Settings → Protect with a passphrase encrypts it on your device (AES-256, with a key made from your passphrase). If you forget the passphrase, the data can't be recovered.
It can be lost. Clearing your browser data, using private browsing, or switching device or browser loses it. Safari can clear a site's storage after about 7 days without a visit. Use Settings → Export to keep a backup.
Exports are plain text. An exported file contains your health information unencrypted. Store it somewhere private, and delete copies you no longer need.
Correct or delete it any time: edit or delete any entry, or Settings → Erase everything on this device.

What leaves your device, and where it goes

What	Why, and lawful basis	Who processes it, where	How long
Account: name, email, hashed password, consent and email-preference choices, sign-in times	To let you sign in and keep the service secure (contract; legitimate interests for sign-in records)	Supabase (database and sign-in), EU — Ireland	Until you delete your account; then deleted immediately
Account emails: email address and first name	Confirming your address, password resets, one welcome email; updates only if you opt in (contract; consent for updates)	Resend (email delivery), USA — under standard contractual clauses	Resend keeps delivery logs for a limited period under its own policy
A share link you create: only the sections you tick (e.g. allergies, current medications)	To show a doctor or carer your summary (your explicit consent, UK GDPR Article 9(2)(a))	Supabase, EU — Ireland	Until the expiry you choose (1 hour, 24 hours or 7 days) or until you revoke it. After that it can no longer be opened.
Price or wait quotes you submit	To improve the figures everyone sees (legitimate interests)	Supabase, EU — Ireland	Kept anonymously; if your account is deleted, the link to you is removed
Your location, only if you allow it	To show the nearest hospitals and your town's name (consent, given in your browser's prompt)	Your browser sends coordinates directly to BigDataCloud (place-name lookup). A postcode you type goes to OpenStreetMap Nominatim.	FairWait never stores your location; it's kept in memory while the page is open
Questions to the AI assistant, when it's available	To answer your question (legitimate interests)	Anthropic (AI model), USA — under standard contractual clauses	FairWait doesn't store chats. Don't enter personal health details in the assistant.
Usage counts: page and day; which kind of link brought a visit (e.g. "TikTok")	To see whether the service is used (legitimate interests)	Supabase, EU — Ireland	Daily totals only. No cookie, no visitor ID, no IP address, no browsing path.
Web requests: your IP address and browser details, as with any website	To deliver the site securely	Vercel (hosting), Cloudflare (DNS), jsDelivr (a code library), Frankfurter (exchange rates)	Short-lived server logs under each provider's policy

We don't sell personal data, show adverts, or use third-party analytics or tracking cookies. Fonts are hosted on our own site, so loading a page sends nothing to Google.

Health information

Health information is "special category" data under UK GDPR. FairWait is built so that it doesn't need to receive yours: the tracker works entirely on your device. The only way your health information reaches our servers is a share link you create yourself, with the sections you choose, after an explicit confirmation step. You can revoke a link at any time from the Healthcare Passport page.

How we protect data

All connections use HTTPS.
Database rules ensure each account can only read its own data. A share link can only be opened with its own long random code, which never contains health details.
Optional on-device encryption for your records, as described above.
A weekly check of every outside link we show, and regular reviews of our data sources.

Your rights

Under UK GDPR you can ask to access, correct, export or delete your personal data, and object to or restrict how it's used. You can withdraw consent at any time.

Records on your device: you control these directly (edit, export, erase).
Your account: Account → Delete account removes it and everything tied to it straight away. For anything else, email privacy@fairwait.uk.
Complaints: you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

Losing access to your account

Use "Forgot password?" on the sign-in page. Your records aren't stored in your account, so losing account access never loses them, and getting it back doesn't restore records from another device.

Children

FairWait is intended for adults. Under-18s should use it with a parent or guardian. If you record information about a child or another person, make sure you have the right to.

Cookies and local storage

No tracking cookies. Sign-in uses the browser storage Supabase needs to keep you signed in. FairWait also stores your records, theme and settings, and remembers whether you've already been asked for your location. All of this stays on your device.

Not medical advice

FairWait helps you explore and check your options. It isn't medical, financial or legal advice. Discuss treatment decisions with a qualified clinician.

Changes

If this policy changes in a way that matters, we'll update the date and version above and tell account holders by email.