Privacy policy

Last updated: 12 September 2026

This policy explains how North West Data Products Ltd collects, uses, shares and protects personal information. It covers this website and Hujra, our software for handling enquiries, appointments and the records that come out of them.

1. Who we are

North West Data Products Ltd (“we”, “us”) is a company registered in England and Wales, company number 17388764. Our registered office is Unit A, 82 James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE.

For questions about this policy or about how we handle personal information, contact us at privacy@northwestdata.io.

2. Our two roles

We handle personal information in two distinct roles, and your rights differ slightly depending on which applies.

As a controller

For information about visitors to this website, people who contact us, and our own clients and suppliers, we decide why and how the information is used. We are the data controller for that information.

As a processor

When an organisation uses Hujra to handle enquiries from the people who contact it, that organisation decides why and how their information is used. It is the controller; we act as its processor, handling that information on its instructions. We act as a processor only under a written agreement with that organisation, which sets out what we may do with the information and what happens to it when the arrangement ends. If you have contacted an organisation that uses Hujra, that organisation is your first point of contact — though you may also contact us and we will help.

3. Information we collect, and why

3.1 Visitors to this website

This website sets no cookies and loads no analytics, advertising or tracking scripts of any kind. We do not build profiles of visitors. Our hosting provider records standard server logs, which may include IP addresses, for security and to keep the site running reliably; we see aggregate visit counts derived from those logs, and nothing that identifies you.

3.2 People who contact us

If you email or call us, we hold your contact details and the content of your message, so that we can reply and keep a record of our correspondence.

3.3 Information handled through Hujra

When someone messages an organisation that uses Hujra, we handle the following on that organisation's behalf:

• contact details — the telephone number the message was sent from, and the sender's WhatsApp profile name;
• the content of every message in the conversation, in both directions, kept as it was written;
• any photograph, voice note, document or other file attached to a message;
• details about each message — an identifier for it, the date and time, whether it was incoming or outgoing, what kind of message it was, whether it reached us from an import of past conversations or from live traffic, which member of the organisation's staff sent an outgoing message, and whether and when a message was deleted;
• the original record of each message exactly as the WhatsApp Business Platform delivered it, kept unaltered alongside the version above, so that what we hold can be checked against what was actually received;
• records of setting up and running the deployment — for example that a stretch of past conversation was imported, and when — which hold no message content.

That list is the whole of it. Hujra has no field for an address, a date of birth, a payment or account number, or a reference number of any kind: it stores the message as it was sent, and the telephone number and profile name it came from. Anything else is there only because someone wrote it into a message.

The first setting Hujra is being built for is a clinic, so this deserves stating plainly. The enquiries it is built to take are administrative — appointment times, opening hours, what to bring — and anything clinical is passed whole to a person rather than partly answered first. But people write what they write, and a message sent to a healthcare provider can contain health information whether or not it was asked for. We therefore treat everything Hujra handles for a healthcare client as capable of containing health information and handle it accordingly. Where that information is special category data under the UK GDPR, the condition for processing it is the client organisation's to establish, not ours, and we act only on its instructions.

We use this information only to deliver the service to the organisation that instructed us: recognising and classifying enquiries, reporting on them, keeping the record of a conversation accurate, answering them where a deployment is configured to reply, and supporting and securing the system. We do not use it for our own marketing, we do not sell it, and we do not share it with anyone for their own purposes.

4. Messaging channels, including WhatsApp

Hujra receives messages over the WhatsApp Business Platform, operated by Meta, and sends them where a deployment is configured to reply. Telephone, web form and email are planned, and this policy will be updated before any of them starts carrying messages. Where a conversation happens over WhatsApp:

• we receive the messages sent to the organisation, along with the sender's telephone number and WhatsApp profile name;
• where a deployment is configured to reply, we send those replies on the organisation's behalf, through the same channel;
• Meta handles the delivery of those messages, and its own handling of your information is governed by the WhatsApp privacy policy, not by this one.

Hujra is in active development, and its first release sends nothing at all. It observes, classifies and reports: it receives messages, records them, and produces reports for the organisation's own staff. No message it handles reaches anyone who wrote in. Replies are described here because the software is built to send them and this policy is written to cover them from the outset.

Messaging an organisation is voluntary. You can stop at any time by asking the organisation not to contact you further, and that request will be honoured.

5. Automated processing and AI

Parts of Hujra are automated. Incoming messages may be classified by topic and urgency, structured details may be extracted from them, and replies may be drafted automatically. Some of these steps use AI language models supplied by third-party providers.

Three things are worth stating plainly:

• A person stays in control. Automated replies follow rules the organisation sets, and staff can review, edit or override them. Anything falling outside those rules is escalated to a person, and for a healthcare client that includes anything clinical, which goes to a person whole rather than being partly answered first.
• No solely automated decisions with legal or similarly significant effects are made about you within the meaning of Article 22 of the UK GDPR.
• Your information is not used to train AI models. We do not permit our providers to use information handled through Hujra to train or improve their models, and we do not do so ourselves.

6. Our lawful bases

Where we act as a controller, we rely on:

• Legitimate interests — to respond to enquiries, to run and secure our business, and to maintain our records. We have considered your rights and do not believe this processing overrides them.
• Contract — to provide our services to clients and to take steps at their request before entering a contract.
• Legal obligation — to meet our accounting, tax and other legal duties.

Where we act as a processor, the lawful basis is determined by the organisation that instructed us, not by us.

7. Who we share information with

We share personal information only with service providers who help us run the service, each bound by contract to protect it and to use it only on our instructions. These fall into the following categories, not all of which apply to every deployment:

• cloud hosting and database providers;
• Meta Platforms, for delivery of WhatsApp messages;
• AI language model providers, for the automated steps described in section 5;
• email and communication providers.

We may also disclose information where the law requires it, or to establish, exercise or defend legal claims. We do not sell personal information, and we do not share it for advertising.

8. Where information is stored

For information we hold as a controller — this website, and people who contact us — we store it within the United Kingdom or the European Economic Area wherever we can. Where a provider processes information outside those areas, we rely on UK adequacy regulations or on standard contractual clauses together with the UK International Data Transfer Addendum, so that your information keeps an equivalent level of protection.

Hujra is deployed one client at a time, and where it sits is part of that arrangement. Where a client organisation is required to keep the information inside its own country — as a healthcare client may be — the deployment runs on that organisation's own equipment, in the country where it operates, rather than on infrastructure we provide, and we do not hold the messages it handles on our own systems. Where that is the arrangement, it is recorded in the written agreement described in section 2.

9. How long we keep it

We keep personal information only as long as it is needed for the purpose it was collected for.

• Enquiries to us: up to two years from our last contact.
• Information handled through Hujra: for as long as the organisation that instructed us remains our client, and in line with its instructions. When our agreement with that organisation ends, we return or delete the information within the period that agreement sets, unless the law requires us to keep it.
• Records we must keep by law, such as accounting records: for as long as the relevant law requires.

10. Security

We take appropriate technical and organisational measures to protect personal information, including encryption of data in transit and at rest, access controls restricting who can reach it, and logging and monitoring. No system can be perfectly secure, but we take this seriously and review our measures as the service develops.

11. Your rights

Under the UK GDPR you have the right to:

• ask for a copy of the personal information we hold about you;
• have inaccurate information corrected;
• ask us to delete information, in certain circumstances;
• ask us to restrict how we use it, in certain circumstances;
• object to processing carried out on the basis of legitimate interests;
• receive information you gave us in a portable format, in certain circumstances;
• withdraw consent at any time, where we relied on consent.

To exercise any of these, contact us at privacy@northwestdata.io. We will respond within one month. There is no charge. If your request concerns information we hold as a processor for another organisation, we will pass it to that organisation promptly and support them in answering it.

12. Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

13. Children

Our services are provided to organisations and are not directed at children. We do not collect information from children directly, and neither this website nor Hujra is offered to them.

A message sent to an organisation can still mention or concern a child — a parent writing about an appointment for one, for example. Where that happens, the information is in the message because the sender put it there, and we handle it as that organisation's processor, on its instructions and under section 2, for nothing beyond delivering the service. If you believe we hold information about a child that should not be held, contact the organisation you messaged, or contact us and we will help.

14. Changes to this policy

We may update this policy as our services develop or as the law changes. The date at the top shows when it was last revised. Where a change materially affects how we use your information, we will take reasonable steps to tell you.

15. Contact us

North West Data Products Ltd
Unit A
82 James Carter Road
Mildenhall
Bury St. Edmunds
IP28 7DE
privacy@northwestdata.io