Who we are
uPull.ai Ltd ("uPull.ai", "we", "us") is a UK-registered company providing AI adoption and workflow-redesign consultancy to NHS and public sector organisations. This policy explains how we handle personal data collected through this website (upull.ai) and the uPull.ai Academy platform (academy.upull.ai).
| Company number | uPull.ai Ltd |
|---|---|
| Registered office | London, United Kingdom |
| ICO registration | |
| Contact | support@upull.ai |
What we collect and why
| Where it comes from | What we collect | Why |
|---|---|---|
| Proof-of-value / waitlist form (index.html) | Name, email, organisation | To respond to your interest and arrange a follow-up (legitimate interests) |
| AI Readiness Assessment (readiness.html) | Name, role, organisation, organisation type, email, phone (optional), free-text notes, your assessment answers and score | To generate and send your readiness report and follow up on the findings (legitimate interests / consent for marketing) |
| Academy account (academy.upull.ai) | Name, email, organisation, course activity, case-study submissions | To provide and administer your Academy account (contract / legitimate interests) |
| Newsletter sign-up | Name, email | To send the uPull.ai Weekly newsletter (consent — you can withdraw at any time) |
| Direct email or meeting booking | Whatever you send us; calendar details for scheduling | To communicate with you and arrange meetings (legitimate interests) |
We do not knowingly collect patient-identifiable, clinical or otherwise confidential information through this website. Please do not enter it into any form or free-text field — the readiness assessment and forms say this explicitly, but it's worth repeating here.
How we use third-party processors
We use a small number of third-party services to run this website and Academy platform. Each acts as our data processor under a standard contract or their published terms:
- Web3Forms — delivers form submissions from this website to our inbox. Web3Forms briefly handles the submitted data in transit; see their privacy policy.
- Google Workspace — hosts our email (upull.ai domain) and calendar.
- Google Cloud — hosts the Academy platform's application and database.
- GitHub Pages — hosts the static marketing website you are reading now.
We do not sell personal data, and we do not share it with any third party for their own marketing purposes.
Legal basis for processing
Under UK GDPR, we rely on:
- Legitimate interests — responding to your enquiry, running the Academy platform, and following up on a readiness assessment or waitlist submission.
- Consent — the optional newsletter and marketing opt-in on the readiness assessment form. You can withdraw consent at any time by emailing support@upull.ai or using the unsubscribe link in any marketing email.
- Contract — where we need your data to provide an Academy account or service you've signed up for.
How long we keep it
We keep enquiry and assessment data for as long as reasonably needed to follow up on it, and no longer than 24 months from your last contact with us unless you become a client (in which case data is retained per the engagement contract) or the law requires longer retention. Academy account data is retained for the life of the account plus a reasonable period after closure for record-keeping. You can ask us to delete your data at any time — see "Your rights" below.
International transfers
Our processors host data within the UK or the European Economic Area, or under a data transfer mechanism recognised by UK law (such as the UK International Data Transfer Addendum) where they don't. We do not otherwise transfer personal data outside the UK/EEA.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased ("right to be forgotten")
- Restrict or object to our processing
- Receive your data in a portable format
- Withdraw consent at any time, where consent is the basis for processing
To exercise any of these rights, email support@upull.ai. We'll respond within one month. If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).
How we protect your data
We apply access controls, encryption in transit (HTTPS/TLS throughout this site and the Academy platform), and least-privilege access to any system holding personal data. uPull.ai is working towards Cyber Essentials certification and an ICO registration to formalise these practices further.
Children
This website and the Academy platform are intended for use by working professionals in health and public sector organisations. We do not knowingly collect data from children.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last revised. Material changes will be reflected here; continued use of the site after a change means you accept the updated policy.