Privacy policy

Senysolutions provides practical, safety-aware integration support for healthcare organisations, including connections between EPR/EMR platforms, departmental systems, specialist platforms, and interface engines.

The controller is the organisation that decides why and how personal data is used. The legal identity for that controller has not been confirmed in this repository and must be completed before publication as a final legal notice.

The current company contact channel provided for Senysolutions is senysolutions@polsia.app. Please do not use this site to send patient records, credentials, or other confidential clinical information.

Depending on how you use the site, we may receive:

• Project inquiries: organisation name and type, the integration need, relevant standards, contact name, work email, and optional phone number.
• Project intake: source and downstream systems, message types, environment, and optional key risks and deployment notes.
• Form protection data: the text challenge response, an empty honeypot field, and a keyed, pseudonymous identifier derived from the network address for rate limits. The app does not store the raw challenge answer or network address.
• Site and analytics data: ordinary technical information about visits and interactions, together with cookie and analytics choices where those tools are enabled.

The forms tell you not to include patient-identifiable data or credentials. We do not ask for those details and the forms are not designed to accept them. If you submit information by mistake, contact us promptly so the owner can assess the appropriate handling.

We use information for the following purposes:

• to respond to an enquiry and take steps at your request before entering into a contract, such as understanding the systems, standards, and delivery context;
• to review, administer, and keep an accurate record of project inquiries and intake submissions;
• to protect the forms and service from spam, automated abuse, and invalid requests;
• to operate and improve the public site where consent has been given or another documented lawful basis applies; and
• to send marketing communications only where the required consent or another lawful basis has been obtained.

The relevant UK GDPR lawful basis will normally be taking steps at your request or performing a contract for an enquiry, our legitimate interests in administering and protecting the service, and consent for optional analytics or future marketing where consent is required. The owner must confirm the final basis and balancing assessment for each processing activity before launch.

Public form submissions are sent to /api/project-inquiries or /api/projects. The server validates the submitted fields, checks a locally managed text challenge, applies rate limits, and rejects submissions that fill the hidden honeypot. It stores accepted records in the Prisma-backed ProjectInquiry or ProjectIntake record.

Administrative listing and status or reply operations are protected by the installed `requireAdmin()` admin guard. A project inquiry triggers best-effort confirmation to the submitted work email and an admin notification; an email failure does not undo a saved inquiry. Project intake and integration-readiness submissions do not currently send automated email. Those forms show an on-screen receipt or saved summary.

Challenge answers are converted to a keyed digest before storage. Challenge records expire after 30 minutes; rate-limit records have 15-minute issuance windows and one-hour submission windows. Expired protection records are removed during later protection requests. The submitted network address and raw answer are not stored by the application.

Access to submission records is intended for authorised Senysolutions administrators and service operators who need it for the purposes described here. We do not make inquiry or intake records public.

The site keeps the existing cookie-preference control. Essential site behaviour does not depend on optional analytics consent. The first-party senysolutions_cookie_consent cookie records whether optional analytics were accepted, rejected, or selected in preferences. This policy does not remove or replace that control.

If you consent to optional analytics, the site can load the Meta Pixel with ID 1546964729948103. The current implementation sends page-view events after consent and supports a lead event in the sign-up flow. It does not load the Meta script when optional analytics have not been consented to.

Separately, the deploy-injected Polsia visitor beacon may run when POLSIA_ANALYTICS_SLUG is configured. It creates a pseudonymous polsia_vid value in browser localStorage and sends a pixel request to the configured Polsia analytics base. The owner should confirm its final notice, legal basis, retention, and consent treatment for each deployment.

Repository inspection found no LinkedIn Insight Tag and no LinkedIn Lead Gen Forms integration in the current implementation. We therefore do not state that LinkedIn currently receives data from this site.

If LinkedIn campaign measurement is enabled later, the Insight Tag could be used to measure visits, conversions, and campaign performance, subject to the required cookie and consent controls. If LinkedIn Lead Gen Forms are used, information entered into a LinkedIn form could be collected by LinkedIn and shared with the configured campaign controller or lead recipient under the notice shown at the time.

A reply to an inquiry is an operational communication about the request you made. It is not the same as subscribing you to marketing. The current public implementation has no general marketing subscription capture or mailing-list provider connected to these forms.

If Senysolutions introduces marketing email or similar communications, it will obtain consent where required, explain what you are agreeing to, keep the consent record, and provide a clear unsubscribe or opt-out route. You can also contact senysolutions@polsia.app to ask about marketing preferences.

We only describe services confirmed in this implementation. Depending on your choices and the action you take, information may be handled by:

• Meta, only where the consent-gated Meta Pixel is enabled;
• Polsia-hosted analytics and email infrastructure used by the deployed app; and
• LinkedIn only if the conditional campaign tools described above are activated.

We do not name other hosting providers or subprocessors here because they are not identifiable from this repository. Access may also be given to authorised personnel who need it to operate the site, respond to enquiries, or provide the requested services.

We keep information only for as long as it is needed for the purpose collected, to establish or defend legal claims, or to meet another legal or operational requirement. The codebase does not contain confirmed retention periods, so this notice does not invent them.

Confirmed controls include server-side field validation, locally managed text challenges, per-form rate limits using a keyed network identifier, a honeypot field, restricted administrator routes for submission records and replies, and prominent instructions not to provide patient-identifiable data or credentials.

No policy should imply an encryption standard, certification, or security control that has not been verified. If you believe you have sent sensitive information by mistake, contact Senysolutions promptly at senysolutions@polsia.app.

Subject to the conditions and exemptions in UK data-protection law, you may have the right to ask for access to your personal data, correction of inaccurate data, erasure, restriction of processing, objection to processing, and data portability where applicable. Where processing relies on consent, you can withdraw that consent at any time; withdrawal does not affect processing that happened before withdrawal.

You may also have rights relating to automated decision-making and profiling where applicable. The current site does not describe a decision that produces legal or similarly significant effects solely by automated means, but the owner should review this if campaign or lead-scoring tools are added.

To exercise a right or ask a privacy question, email senysolutions@polsia.app and include enough information for us to understand the request. The owner must confirm the identity-verification and response process.

You can complain to the UK supervisory authority, the Information Commissioner's Office (ICO), if you are concerned about how your personal data is handled. We would appreciate the opportunity to address your concern first where possible.

We may update this policy when the site, forms, analytics, campaign tools, suppliers, or legal requirements change. We will publish the revised version on this page and update the date at the top. Material changes should be communicated through an appropriate notice where required.

This version was last updated on 7 September 2026.