SODA Privacy Notice

Legal name: Staying Safer Limited
Company number: 12833795
Registered address: 5 Dart View House, Baltic Way, Totnes, TQ9 5WW, United Kingdom
Contact email: adam@stayingsafer.com
ICO registration: ZB460814

Staying Safer Limited does not have a designated Data Protection Officer. The person responsible for data protection compliance is Professor Adam Winstock (contact above).

SODA is a structured digital reflection and communication tool for people receiving opioid substitution treatment (OST). It helps users summarise their treatment experience and prepare for conversations with their prescriber or treatment team.

SODA does not provide medical advice, recommend treatment changes, or make clinical decisions. It is not a medical device.

3.1 Using SODA without an account

If you use SODA without creating an account, we do not collect your name or any other direct identifier. Specifically, we do not collect:

• Your name
• NHS number, CHI number, or other health identifier
• Full date of birth
• Address
• Email address
• IP address (not retained)
• Device identifiers

Your answers and score are processed only to generate your result on-screen. Raw session responses are not stored beyond your session, whether or not you separately choose to include your anonymised, pooled answers in service-evaluation data (see Section 3.4).

3.2 Account-based use (optional)

If you choose to create an account, we collect and store:

• A self-selected username (which need not be your real name)
• No email address — SODA does not collect or require an email address for account creation, use, or recovery, at any point
• An encrypted password (we cannot see your password)
• Your SODA assessment answers and scores, with the dates they were completed

We do not require or collect your full name, full date of birth, NHS number, address, or telephone number. SODA does not ask for your year of birth either — only an age band, which is not stored under your account. Account creation is entirely optional.

Underneath your username and password, a separate, persistent internal tracking ID — never shown to you and not chosen by you — is what actually links your sessions together over time. Changing your username or password does not affect this link or your saved history. This ID cannot be used by anyone to identify you; it exists only so SODA can recognise that separate sessions belong to the same account.

3.3 Setting and treatment information

Where SODA is used in a clinical or secure setting (for example a prison healthcare service), once you have made your consent choices, a healthcare professional may enter the treatment location and setting (such as whether the session is taking place in a prison or community setting, and which service is providing treatment). The other answers are your own: you give them yourself, or tell them to the member of staff entering them for you.

3.4 Anonymised, pooled data for service evaluation and research

Before you answer any questions, you are shown a separate, unticked opt-in screen asking whether your anonymised, pooled answers may also be used to help evaluate and improve SODA and treatment services. This is entirely separate from, and has no bearing on, your account (Section 3.2) or any decision to share your own results with your clinician (Section 6.1). Declining has no effect on your care or treatment.

No name, full date of birth, NHS number, prison number, address, phone number, or email is collected with this data. SODA asks for your age as a band (for example, 25–34) — never a year or date of birth — and only that band is stored or included in pooled data. Where this data includes setting information (Section 3.3), postcode, age band, gender or medication, we are reviewing whether that specific combination of fields could, in a small group of users, be identifiable — see Section 8 for how long this data is kept while that review is ongoing.

If you also agree to research use, an extract of this pooled data (community-setting records only, age band, postcode reduced to region, no username or tracking identifier, prison-setting records excluded) is shared with researchers at Aston University (study HLS21027) under a data sharing agreement, and only if and when research ethics approval has been obtained. Aston is responsible for that extract.

3.5 Technical and operational data

For all users, our hosting infrastructure may automatically log basic technical information for security and operational purposes, including approximate geographic region and error logs. This information is not linked to individual users and is retained only for the period necessary for security monitoring.

Information about a person's drug use, opioid treatment, and health status is special category data (health data) under Article 9 UK GDPR. The exact consent wording used on screen, and the position for prison and other secure settings specifically, are still being finalised, and this section will be updated once that is complete.

The answers you provide in SODA relate to your experience of opioid substitution treatment, which constitutes health data under UK GDPR. Where you choose to create an account, we rely on the following conditions for processing:

• Article 6(1)(a) and Article 9(2)(a) UK GDPR — explicit consent (primary condition): processing is based on your specific, informed, opt-in consent, given separately at the point you choose to create an account (see Section 3.2), and which you may withdraw at any time.
• Article 9(2)(h) UK GDPR — health or social care purposes (secondary condition only): offered as a supplementary condition only. It is not relied on as the primary basis for data held on our own systems rather than under a treatment provider's own clinical governance.

If you use SODA without an account, we do not collect direct identifiers and do not intend to process personal data. The Article 9 conditions above apply where account-based use, or pooled data (Section 3.4), could identify a person in the context of their health treatment.

We use the information you provide for the following purposes only:

• To generate your SODA score and stability band and display it to you
• To allow you to view and track your previous SODA assessments over time (account users only)
• To maintain system security and prevent unauthorised access
• With your separate, specific consent (Section 3.4), to produce anonymised, pooled data to help evaluate and improve SODA and treatment services — and, only once research ethics approval has been obtained and only for data collected after that consent wording is in place, to support wider academic research on SODA's utility and impact

We do not use your information for:

• Marketing or advertising
• Sale to third parties
• Profiling or automated decision-making that affects your treatment
• Any purpose beyond what is described in this notice, without your separate explicit consent for that purpose

6.1 Healthcare professionals

We do not share your SODA results with your prescriber, keyworker, or treatment team unless you actively choose to share them. Sharing is always at your discretion. Where you choose to share your SODA summary with your clinician for it to be copied into your clinical record, that consent covers your clinician's own record-keeping only — it does not by itself cover use of that record in progression, home detention curfew (HDC) or parole decisions. Any such further use requires your separate, specific consent at that time.

6.2 Hosting and infrastructure providers

SODA is built and hosted for us by Studio-Made, which acts as our data processor under a written data processing agreement. Studio-Made uses two cloud services, Netlify and Google Firebase, with UK server locations selected where available.

6.3 Legal obligations

We may disclose information if required to do so by law, court order, or to protect the safety of any person in an emergency situation.

6.4 No other sharing

We do not sell, rent, or otherwise share your personal data with any other third parties. The only exception is the optional research extract described in Section 3.4, which contains no username, tracking identifier or other direct identifier.

In the demo version, nothing you enter is stored, so none of the retention periods in the table above currently apply. They describe how SODA will handle information once it goes live with real accounts.

SODA does not use cookies, and does not use any third-party analytics, advertising technologies, or behavioural tracking technologies.

If you create an optional continuity account (Section 3.2), SODA uses a form of persistent storage — separate from cookies — to hold a private tracking identifier that lets SODA recognise your account across visits. This identifier is never shown to you, cannot be used to identify you, and is not shared with any third party. Temporary session storage is also used to support the operation of the service during your visit; this is cleared automatically when your session ends.

We take the security of your information seriously. Security measures include:

• SSL/TLS encryption for all data in transit
• Encrypted storage of passwords (hashed; we cannot read them)
• Access controls limiting who can access system data
• Multi-factor authentication for administrative access
• Daily backups with disaster recovery arrangements
• Cyber Essentials certification (certified 13 August 2026)

No system is completely secure. Anyone who has your username and password can see your saved SODA history, so sharing your login details carries a security risk, and we suggest keeping them to yourself. If your device offers to remember your password, think about who else uses that device. If you have reason to believe your SODA account has been compromised, please contact us immediately at adam@stayingsafer.com. If you have shared your password with someone else and want to remove their access, you can change your password at any time in your account settings — this does not affect your saved history.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, and will notify affected users where required by law.

You have the following rights in relation to your personal data under UK GDPR:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate or incomplete data
• Right to erasure: to request deletion of your personal data in certain circumstances
• Right to restriction of processing: to request that we limit how we use your data in certain circumstances
• Right to data portability: to receive your data in a structured, machine-readable format and transfer it to another controller, where technically feasible
• Right to object: to object to processing based on legitimate interests, at any time, on grounds relating to your particular situation
• Right not to be subject to automated decision-making: SODA does not make automated decisions that have legal or similarly significant effects on you

To exercise any of these rights, please contact adam@stayingsafer.com. We will respond within one month. We may need to verify your identity before processing your request, and we will act on a request made through any reasonable means of contacting us — you do not need to use a particular channel or method for your request to be valid. If you're somewhere you don't have direct access to email or the internet yourself — for example, in prison — a member of your healthcare team can pass a request to us on your behalf; we'll verify it using your username, not your SODA password, which we will never ask for or need in order to action a request. If you did not create an account, nothing about your session is stored, so there is nothing to delete.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data lawfully:

Website: ico.org.uk
Telephone: 0303 123 1113

SODA is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a person under 18, please contact us immediately and we will delete it.

We may update this Privacy Notice from time to time. When we make material changes, we will update the version number and effective date at the top of this document. As SODA does not collect an email address for any user, we are not able to notify you directly of changes; please check this notice periodically, especially before relying on it after a material update.

We encourage you to review this notice periodically. Continued use of SODA after an updated notice has been published constitutes acceptance of the changes.

For any questions about this Privacy Notice, to exercise your rights, or to raise a concern:

Staying Safer Limited
5 Dart View House, Baltic Way, Totnes, TQ9 5WW
Email: adam@stayingsafer.com