Privacy notice

Last updated: 14 October 2026

This notice has two parts. Part 1 covers this website, including the demo-request form and any message we send you first. Part 2 covers the WardLab platform: the app that universities license for their nursing students and staff.

Part 1: this website

Who we are

This website is run by WardLab Ltd ("we"), a company registered in England and Wales, company number 17348120. We are registered with the UK Information Commissioner's Office under registration reference ZC204147.

What we collect, and why

• Demo and contact requests. When you submit the form on this site we receive what you typed: your name, university email, institution, role and message. We use it to answer your enquiry (sending demo links, quotes or pilot information you asked for) and for nothing else. No mailing lists, no marketing follow-ups you didn't request, no sharing or selling.
• If we contacted you first. We sometimes write to nursing, midwifery and simulation staff at universities to tell them about WardLab. To do that we use your name, work email address, job title and institution, which we take from your university's public staff pages, from professional networks such as LinkedIn, or from a colleague who introduced us. Our lawful basis is legitimate interests: telling staff whose work it fits about a teaching tool. We only ever write to your work address. If you tell us you're not interested, we won't contact you again, and we keep only a note that you asked so that it stays that way. Otherwise we delete your details within 12 months of our last contact.
• This website sets no analytics or advertising cookies and loads no third-party trackers. Fonts and media are served from this site, not from external CDNs.
• The sign-in page runs a security check. To stop automated scripts from requesting sign-in codes, the sign-in page uses Cloudflare Turnstile. Your browser connects to Cloudflare, a US company, for this check. Cloudflare sees your IP address and technical information about your browser and connection to tell a person from a script; it does not receive your email address. Cloudflare runs the check for us and says it also uses those signals, as its own controller, to improve its bot detection. It runs only on the sign-in page where you ask for an emailed code, and we keep nothing from it.
• Signing in with Microsoft is optional. If you choose it, you sign in with Microsoft directly, under Microsoft's own privacy terms. We receive only your email address and whether Microsoft has verified it, Microsoft's issuer name, a pseudonymous account identifier and your organisation's Microsoft tenant ID. We do not receive your name, photograph or any other profile detail.

Where it lives and how long we keep it

Form submissions are processed by our hosting provider and delivered to our email. We keep enquiry correspondence for as long as the conversation is live and for up to 12 months afterwards, then delete it.

Part 2: the WardLab platform

Who controls your data

When your university licenses WardLab, your university is the data controller and decides why your data is used. WardLab Ltd is the data processor: we process your data only on your university's documented instructions, under a data processing agreement. To exercise your rights you can contact your university or us.

WardLab is for the students and staff of the institutions that license it, and only people their institution has added can sign in. Some students start their course before they turn 18. Their university is responsible for making sure its use of WardLab suits them, as it is for its other learning tools. We never ask for your age, because we don't need it.

What we hold, and why

Every patient in WardLab is fictional. The records in the app are simulated patients written for teaching, and contain no real patient data. The only real personal data is about you, the user:

• Your university email address: to check that your institution's licence covers you, to send your one-time sign-in code, and to attribute your work. Lawful basis (your university's): public task, or legitimate interests in delivering education.
• Your role (student, staff or admin) and your institution: to show you the right tools and keep institutions apart.
• Sign-in records (sign-in times and one-time codes): to run secure sign-in without passwords. Lawful basis: legitimate interests in account security.
• Microsoft sign-in details, only if you choose that option: the details listed in Part 1, and nothing more.
• The name you type when you join a live session: so the facilitator and others in the session can see who is there.
• What you document in a session (each observation, note, medication, referral and so on, stamped with your email and the time): to give your educator a faithful, attributed record for the debrief and for feedback. Lawful basis: public task, or legitimate interests in assessment and feedback.

We don't use your data for advertising, we don't sell it, and we make no automated decisions about you. We don't use it to train artificial intelligence or machine-learning models either: WardLab contains no AI system. Its clinical scores are the published national tools (NEWS2 and the NHS national PEWS charts) applied as fixed rules, and the debrief compares what a session documented against a checklist written by a registered nurse.

What the app stores in your browser

The app uses no cookies or storage for tracking or advertising. It keeps three things in your browser, each one needed for something you asked it to do:

• Your sign-in token, so that you stay signed in. Signing out removes it.
• Your display settings (text size, spacing and colour tint), so they apply the next time you use the app on that device.
• A session join code, while you join a session from a QR code. It lasts only as long as that browser tab.

The security check on the sign-in page is Cloudflare's, as described in Part 1. All of this is strictly necessary for the service you are using, so UK law (the Privacy and Electronic Communications Regulations) does not require a consent banner, and we don't show one.

How long we keep it

• Live-session data (the simulated patients, the attributed activity log and the list of who took part) is deleted automatically 30 days after the session ends. It exists only for the debrief.
• Your account record (email, role and institution) is kept while your institution licenses WardLab for you. When the licence ends, or you are removed from it, the record is removed.
• Unfinished sign-in attempts (an email that started signing in but never finished) are cleared within 24 hours.

Copies your educator downloads

Teaching staff can export a session debrief, showing who documented what, as a PDF or Word file for a debrief, for feedback, or as evidence that you took part. An exported file is no longer inside WardLab. The 30-day deletion can't reach it, we can't see, change or delete it, and we keep no record of what was exported. It remains your university's data, kept under its own records and data protection policies. To see, correct or delete an exported copy, ask your university. Every exported file carries this explanation printed on it.

Where it is held, and who else handles it

Your records, meaning everything you write in the app, stay in Europe. We use a small number of sub-processors purely to run the service:

• Supabase, on Amazon Web Services in Ireland (eu-west-1): the database, sign-in and live sync. Your records are held here.
• Resend, EU region: sends the sign-in code emails.
• Netlify, United States: serves the website and app files to your browser. It does not hold your records and cannot see them. Like any web host, it sees your device's IP address and basic details of each request in its logs.
• Cloudflare, United States: the sign-in security check described in Part 1. It never receives your email address or your records.
• Infomaniak, Switzerland: our business email. It only sees what you choose to put in an email to us, and has no access to the app.

Transfers to Netlify and Cloudflare are covered by the UK Extension to the EU–US Data Privacy Framework and, where that does not apply, by the UK International Data Transfer Agreement (Netlify) or the EU Standard Contractual Clauses with the UK Addendum (Cloudflare). Switzerland is covered by UK adequacy regulations. Sign in with Microsoft is your choice, and Microsoft is not our sub-processor.

How it is protected

• You only ever see data you are entitled to see, and one institution can never see another's.
• Each documented action is attributed to the person who signed in. No one can record an action as someone else, or change a record after it has been made.
• Data is encrypted in transit and at rest.
• Administrative access needs two-factor authentication.

Your rights on the platform

You can ask to see your data, correct it, erase it, restrict or object to its use, and take a copy of it. Because your university is the controller, please ask your university first; we will help them. You can also email us at info@wardlab.co.uk.

When we erase someone's data, their entries in session logs are anonymised and their name is replaced with "Removed participant". Any patient they saved to their institution's shared library is kept, without their email address, and their sign-in and licence are deleted. Erasure can't reliably reach free text that someone typed, or names that other people typed into their own entries. Those stay until the 30-day deletion removes the whole session. A student's erasure is carried out by WardLab, at the student's request or through their university. A member of staff can also be erased by their institution's WardLab administrator.

Your rights, complaints and contact

Under UK GDPR you can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email info@wardlab.co.uk, or use the contact form on the main page if you prefer. We'll respond within one month, as the law requires, and usually much sooner. If you're unhappy with our answer, you can complain to the Information Commissioner's Office (ico.org.uk).

For anything about this notice or your data, email info@wardlab.co.uk. If you would rather write to us by post, email us and we will give you a postal address.

The fonts and open-source software WardLab uses, and their licences, are listed in our third-party licences.