Privacy Policy

NGA Dynamics Ltd (“we”, “us”, “our”) is the controller of personal data collected on this website and through the LUCY platform. We are registered in England and Wales and operate from Hull, UK.

Contact us about data protection matters at info@ngadynamics.co.uk.

Account and billing data: name, email address, organisation name, and payment information (processed by Stripe, we do not store card numbers).

Usage data: pages visited, features used, session timestamps, and error logs, used to operate and improve LUCY.

Business data you upload: client records, invoices, notes, messages, documents, and any other data your organisation stores in LUCY. This data belongs to you (see Section 5).

Communications: emails you send us, support requests, and feedback.

If your organisation uses LUCY in a health or social care context, for example, a care home, nursing home, or supported living service, you may store personal data about residents or service users that is classified as special category data under UK GDPR Article 9, including health information and care records.

In this context, your organisation is the data controller and NGA Dynamics Ltd is the data processor. We process this data only on your documented instruction and apply the same technical and organisational security measures as for all data.

You are responsible for:

• Identifying a valid Article 9 condition for processing health data (e.g. Art. 9(2)(h)).
• Maintaining an appropriate policy document under Schedule 1 of the Data Protection Act 2018.
• Restricting access to health records to authorised staff only, using LUCY's role-based access controls.
• Applying retention periods appropriate to your regulatory obligations (CQC, NHS records management, or equivalent).

To request a Data Processing Agreement (DPA) covering special category data, contact info@ngadynamics.co.uk.

We use personal data to:

• Create and manage your account and organisation.
• Process payments and manage billing.
• Provide, operate, and improve the LUCY platform.
• Send you service communications (account alerts, product updates), not marketing unless you opt in.
• Investigate and resolve support requests.
• Meet our legal obligations under UK GDPR and the Data Protection Act 2018.

Our lawful bases are:

• Contract, to perform our agreement with you.
• Legitimate interests, operating and improving the platform, fraud prevention.
• Legal obligation, where required by law.
• Consent, for marketing communications.

The business data you store in LUCY, clients, invoices, notes, messages, documents, belongs to you. We process it only to provide and improve the Service.

We do not sell your data, share it with third parties for advertising, or use it to train AI models without your explicit consent. On deletion of your account, your data is permanently deleted within 30 days.

We share personal data only with:

• Supabase, our database provider (data hosted in EU-West).
• Stripe, payment processing.
• Resend / Twilio, transactional email and SMS delivery.
• Anthropic, AI features (Ask LUCY, AI insights). Prompts may include business data you have stored in LUCY.
• Legal authorities, where we are required to do so by law.

All sub-processors are contractually bound to protect your data in accordance with UK GDPR.

Our sub-processors may process data outside the UK and EEA. Where this occurs, we ensure adequate safeguards are in place (Standard Contractual Clauses or an equivalent mechanism approved by the ICO).

We keep your account data for as long as your account is active. On deletion:

• Business data is permanently deleted within 30 days.
• Billing records are retained for 7 years as required by HMRC.
• Security and access logs are retained for 90 days.

If you operate in a regulated sector with specific retention obligations (e.g. care records), you should export and retain records before deleting your account.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”) in certain circumstances.
• Restrict processing in certain circumstances.
• Port your data in a machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where consent is the lawful basis.

To exercise any right, contact info@ngadynamics.co.uk. We will respond within one calendar month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

We use essential cookies only, for authentication sessions and security (CSRF). We do not use tracking or advertising cookies without your consent.

See our Cookie Policy for full details.

We protect your data using:

• TLS encryption in transit for all connections.
• Row-level security (RLS) in our database, every query is scoped to your organisation.
• HMAC-signed cookies and webhook signatures.
• Optional two-factor authentication (TOTP) for staff accounts.
• Least-privilege service roles, no single key has unrestricted database access.

We may update this Privacy Policy from time to time. We will notify account owners by email at least 14 days before material changes take effect. The “last updated” date at the top of this page always reflects the current version.

info@ngadynamics.co.uk
NGA Dynamics Ltd · Hull · United Kingdom