Privacy notice

Last updated 25 October 2026 · Version 1.4 (in the app, the short version is called privacy-6). The version history is at the end.

The short version

• Your records, documents and journeys stay on your phone, locked with your passphrase. There is no Taxdose account.
• We don't see your records. We don't sell data, show adverts or track you across other apps.
• AI reading is optional. When your phone can't read a document well, Taxdose offers to have AI check it, and you can ask AI to read a document yourself. One agreement covers both. You see exactly what will be sent, and what was hidden, before anything goes. Nothing leaves your phone until you tap Send, unless you turn on "Send without previewing" in Settings. Your personal details are hidden on your phone first. This can occasionally miss something, so check the preview. Documents your phone reads clearly are never sent.
• Apple or Google take your payments, not us.
• Please don't add documents that contain patient information.
• You can object, withdraw, ask for a copy or ask us to delete what our server holds. If you're unhappy with how we've handled your information, complain to us first (section 15). We'll acknowledge it within 30 days. You can also go to the ICO.
• Taxdose is for adults only. It isn't meant for anyone under 18.

1. Who we are

Taxdose is made by Praelion Ltd ("we", "us"). We're a company registered in England and Wales, company number 17209225. Our registered office is First Floor, Swan Buildings, 20 Swan Street, Manchester, M4 5JW, United Kingdom.

We're the data controller for the information described in sections 5 and 6, and for our website (section 5.5). We can't see the records on your phone (section 3), so you're in control of those.

• ICO registration number: ZC149009
• Privacy questions: privacy@praelion.com
• Everything else: hello@praelion.com
• Data protection officer: we aren't required to have one, so we don't. Our privacy contact above deals with every privacy question.

2. What Taxdose is

Taxdose helps UK doctors keep their tax records in order and prepare drafts of a P87 claim or a Self Assessment return. You check each draft and send it to HMRC yourself. Taxdose never sends anything to HMRC.

3. What stays on your phone

Almost everything Taxdose handles stays on your phone and never reaches us:

• the documents and photos you add (payslips, P60s, invoices, receipts, statements);
• the figures read from them, your answers and your edits;
• your drafts and the PDFs made from them;
• your mileage journeys and where they went;
• your settings, and "Your choices" (what you agreed to, and when).

How it's protected. Your records sit in an encrypted database on the phone. Its key is locked with your passphrase. If you turn on Face ID, Touch ID or fingerprint unlock, the phone's secure hardware keeps a copy of the key for that phone only. Nobody, including us, can reset your passphrase or recover your records without it.

Phone backups. We leave Taxdose's records out of iCloud and Google device backups on purpose. To keep a copy, make an encrypted Taxdose backup (see section 8).

Reading documents. Taxdose reads documents on your phone. On phones that have one, an AI model built into the phone (for example Apple's on-device model) helps with hard layouts. Nothing leaves the phone for this.

What the app stores on your phone. Taxdose stores information on your phone only to do what you ask of it: your records, your settings, the unlock key, the sign-in it uses for AI reading, and, for automatic AI checks, a note of which fields AI checked (never the values), and a list of each document sent to AI or not sent: when, how many pages, what kinds of detail were hidden and a fingerprint of each page, never its contents (Settings › Your choices › What was sent to AI). It has no advertising IDs, analytics or tracking. Because this storage is strictly necessary for the service you asked for, the law doesn't require a separate cookie-style consent for it.

4. Permissions Taxdose asks for

Location, in more detail

• Taxdose records location only between the start and end of a journey, or until the journey ends by itself after 30 minutes stopped. After 10 minutes stopped, Taxdose sends you a notification to check you've arrived.
• Your journeys stay on your phone. We never receive them. Journeys only count once you've said whether they were for work.
• Maps and place names. To name where a journey started and ended, show your route on a map, and measure along the road any stretch where GPS lost signal, Taxdose sends those places from your phone to Apple Maps (iPhone) or Google Maps (Android). Apple and Google handle them under their own privacy terms; Taxdose doesn't send them your name or link them to you. The map service also sees the area of any map you open. This only happens after you turn on mileage recording under the text that explains it.
• iPhone: a journey you start in the app keeps recording while the phone is locked, using "While Using" access (you'll see the blue location indicator). Taxdose asks for "Always" only if you turn on one-tap journeys (Siri, widgets, Control Centre or car automations). With one-tap on, anyone holding your unlocked phone can start or end a journey.
• Android: Taxdose doesn't ask for background location ("Allow all the time"). Each journey runs from a screen you can see, with an ongoing notification and an End button.

5. What we hold, and why

If you never use AI reading, we hold nothing about you, apart from emails you send us and the short-term logs any website keeps when you visit it. If you do use AI reading, this is what our server keeps. It comes from your phone, except the subscription and device checks, which also come from Apple or Google (sections 5.1 and 5.2).

Do you have to give it? No. Both kinds of AI reading are optional. If you don't agree, nothing is sent and the rest of Taxdose works as usual.

We don't store the pictures, the page text or the figures the AI reads. The page fingerprints can't be turned back into the pages. We don't store your name, email, NI number, tax reference, address, date of birth or bank details. As a backstop, our server also removes anything in the AI's reply that looks like an NI number, tax reference, sort code, account number or card number.

Logs. Our server writes short technical notes about each request: a request number, the result, how long it took, the number of pages, whether it was text or a picture, the cost and the kind of document. They never contain anything from your documents. Our hosting provider also keeps short-term logs of the requests reaching our server, which can include your IP address and device details. We use these only to keep the service secure and working. Lawful basis: legitimate interests (keeping our network and systems secure).

5.1 Checking your subscription for AI reading

Taxdose checks your subscription on your phone. To give your phone its AI page allowance, the app can also send our server the proof of purchase that Apple or Google gave your phone. Our server checks it with Apple or Google. We keep:

• the store's reference for the purchase (for Apple, the original transaction number; for Google, a one-way fingerprint of the purchase token, never the token itself);
• the product, the expiry date, and whether it's a test purchase;
• which random IDs it's linked to.

Apple or Google may also tell our server when that subscription renews, ends or is refunded, so the allowance stays right. We use this to apply your allowance, and to stop one subscription unlocking unlimited phones (up to 5 phones share one subscription's 200 pages). Lawful basis: contract. We never receive your Apple ID, Google account, card or address.

5.2 Protecting the service from misuse

To stop abuse of AI reading, the app can ask Apple (App Attest) or Google (Play Integrity) to confirm it's a genuine copy of Taxdose on a real device. We keep the result and, on iPhone, a device key reference, linked to your random ID. This doesn't identify you. Lawful basis: legitimate interests (keeping the service secure and affordable).

5.3 If you email us

If you email us, we keep your email address and what you send while we help you, and for up to 2 years after our last reply, in case you come back to us. Lawful basis: legitimate interests (answering you). Please don't send us your documents or any patient information.

5.4 On your phone, for your subscription

Taxdose keeps a count of the PDFs you've made on your phone, because your first PDF is free. It travels with your encrypted backups and never reaches us.

5.5 Our website

www.taxdose.co.uk sets no cookies and has no analytics, advertising or tracking. Like any website, our hosting provider (Vercel) handles your IP address and browser details to deliver the pages and protect the site, and keeps short-term logs. Lawful basis: legitimate interests (running a secure website). If you email us from the website, section 5.3 applies.

6. AI reading in detail

• AI reading is optional. You can use all of Taxdose without it. One agreement (cloud-ai-auto-3) covers both ways in: Taxdose offering to check a hard document, and "Ask AI to read it" on a document you choose. How AI reading works explains both step by step, with the exact wording you agree to.
• Preview first. Before anything is sent, you see exactly what will go, page by page, and a list of what was hidden. Nothing leaves your phone until you tap Send. Closing the preview sends nothing, and that decision is recorded on your phone too.
• "Send without previewing" is a switch in Settings, off unless you turn it on. With it on, hard documents are sent for checking without the preview. You can turn it off at any time.
• Redaction can miss something. Taxdose hides your details automatically. It can occasionally miss something, so check the preview. Taxdose reads each outgoing page again and won't send one where it can still find one of your identifiers. Our server also refuses text that still shows an NI number, a sort code with an account number, or a UK IBAN.
• An earlier agreement. If you agreed to "Send to AI" (cloud-ai-2) before 25 October 2026, that agreement still covers sending blacked-out pictures of one document you choose, until you agree to the new one.
• What is blacked out first, on your phone: names (yours, other people's, employers' and practices'), addresses and postcodes, your National Insurance number, tax and PAYE references, payroll and other reference numbers, bank account numbers, sort codes, IBANs and card numbers, email addresses, phone numbers, web addresses, NHS and GMC numbers, dates of birth and other dates that could be one, sick, maternity and other statutory pay lines, and signatures and handwriting. Amounts and tax codes stay visible, because that's what AI needs to read.
• Who reads it: the pictures go to our server, hosted by Supabase in London, which passes them to OpenAI. Both act for us as processors, under contract.
  • OpenAI may process the pictures in the United States.
  • OpenAI doesn't use them to train its models. We ask it not to store them as part of the request.
  • OpenAI may keep them for up to 30 days to check for misuse, then deletes them. Pictures its safety checks flag may be kept longer for review.
• Always checked by you. Every value AI reads or checks is marked "Checked by AI". It can be wrong. You confirm every figure, and nothing counts until you do.
• Lawful basis: your consent. If a page happens to show something sensitive about you, such as a trade-union subscription, you give your explicit consent to it being read only to find your figures.
• Withdrawing. Tap "Withdraw and stop sending" in Settings › Your choices. Nothing new is sent after that. A reading already under way at that moment may still finish. Values the AI already read stay in your records until you change them.
• Allowance. Taxdose Pro includes up to 200 AI pages per tax year (6 April to 5 April), as fair use. Send to AI and automatic checks share it.

6A. Automatic AI checks

• You agree once (cloud-ai-auto-3). Taxdose offers the agreement when you start, when you upgrade, or the first time a document is hard to read. After that, Taxdose offers a check when a document is hard to read, and shows you the preview. With "Send without previewing" on, the check is sent without the preview.
• Only hard documents. A document is checked only when a key figure (amount, date, who paid you, tax) isn't certain, its sums don't add up, its kind is unknown, or two readings on your phone disagree. Documents your phone reads clearly are never sent. Bank statements and pension documents are never sent.
• What is sent: the text of up to 4 pages of that document. When a page has no clear text, a picture of the page goes too, with the text your phone read from it.
• What is hidden first, on your phone: your name and other people's names, your home address, postcodes, your National Insurance number, tax reference (UTR) and date of birth, bank and account numbers, sort codes, IBANs and card numbers, staff, payroll and employee numbers, NHS and GMC numbers, email addresses, phone numbers, signatures, sick, maternity and other statutory pay lines, and anything about patients.
• What is sent as it is: who paid you (employers, trusts, practices, agencies, shops and professional bodies), including a payer's business address, such as the street and town on a payslip or invoice; amounts, dates (other than dates of birth), tax codes, your employer's PAYE reference, and invoice and receipt numbers.
• Checked twice. Taxdose reads each outgoing page again and won't send one where it can still see your details. Our server also refuses text that still shows an NI number, a sort code with an account number, or a UK IBAN.
• Who reads it: our server (Supabase, London) passes it to OpenAI (model gpt-6-luna). If that reading leaves something unclear, a second OpenAI model (gpt-5.4-mini) reads the same hidden text and pictures. OpenAI may process them in the United States, doesn't use them to train its models, and may keep them for up to 30 days to check for misuse (longer if its safety checks flag something), then deletes them. We ask it not to store them as part of the request.
• Always checked by you. Values are marked "Checked by AI". It can be wrong. You confirm every figure, and nothing counts until you do.
• Lawful basis: your consent. Some documents can show that you belong to a trade union, for example a BMA membership receipt or the name of a union you pay. By agreeing, you give your explicit consent for that information to be sent for the check. It's read only to find your figures, and nothing from it is kept on our server.
• Turning it off and withdrawing. Turn off "Check hard documents with AI" in Settings and nothing more is sent automatically. Withdrawing in Settings › Your choices stops all AI reading and is recorded on our server. A check already under way may still finish.
• What we keep about each send. On our server: the usage row (section 5) with a fingerprint of each page. On your phone: the list in Your choices. Neither holds what was sent or what was read from it.
• Allowance. Pages checked count towards your 200 pages, including pages a second model reads.

7. Patient information and sensitive data

Taxdose is for your own tax records. Please don't add documents that identify patients, and never send them for AI reading. If a document shows patient details, black them out before adding it, or leave it out.

We don't set out to handle sensitive data, such as health information, religious beliefs or trade-union membership. Some financial documents can reveal it by accident, for example a BMA subscription or a sick pay line on a payslip. Taxdose hides sick, maternity and other statutory pay lines before sending, but can't recognise everything. Automatic checks send payer names as they are, so the name of a union or professional body you pay can be sent. Any such detail is read only to find your figures, and nothing from it is kept on our server. For both Send to AI and automatic checks, it's handled under the explicit consent you give in that agreement.

On your phone, this information stays in your encrypted records, which we can't see.

8. Backups and files you share

• Encrypted backups are files you make and save wherever you choose (Files, iCloud Drive, Google Drive, a computer). They're locked with a passphrase. We never receive them.
• PDFs, mileage spreadsheets and other exports go wherever you send them. Once shared, that app or service looks after them, not us.

9. Who else is involved

We don't sell data or share it for advertising. Taxdose contains no advertising, analytics or crash-reporting tools.

Sending data outside the UK. Our server and database are in London. OpenAI may process page pictures and page text in the United States. Supabase and Vercel are US companies, and they or their sub-processors may access our hosted data from outside the UK to run the service. In each case we rely on the UK International Data Transfer Addendum to the standard contractual clauses in each company's data processing agreement. You can ask us for a copy of the relevant safeguards at privacy@praelion.com.

10. How long we keep things

How these periods are kept. A clean-up runs on our server automatically every day. It deletes usage counts from before the previous tax year (the first deletion is due on 6 April 2028), agreement records 6 years after an ID's last one, ended subscriptions, expired device checks, and random IDs nothing refers to any more. It also removes the sign-in Taxdose uses for AI reading after 30 days unused if nothing is linked to it.

11. Your rights

Under UK data protection law you have the right to:

• be told how your data is used (this notice);
• get a copy of your data;
• have it corrected;
• have it deleted;
• restrict how it's used;
• move it to another service;
• withdraw your consent at any time. This doesn't affect what happened before.

Your right to object. Where we rely on legitimate interests (agreement records, misuse and security checks, logs and emails), you can object at any time, for reasons to do with your situation. We'll stop unless we have strong legitimate grounds to carry on, or need the information for a legal claim. Email privacy@praelion.com.

Most of your data is on your phone, so you can see, export, correct and delete it yourself.

For what our server holds:

• Delete it: Delete all data in Settings asks our server to delete what it holds for your random ID. Deleting your data explains exactly what happens.
• Anything else: email privacy@praelion.com. We don't know who you are, so please include your random ID from Settings › Your choices. Without it we can't find your records.
• We keep your agreement records even after a deletion request, for the time in section 10, because they're our proof of what you agreed to.

We reply within one month. If a request is complex, we may need up to two more months, and we'll tell you why within the first month. There's no charge in most cases. We'll make a reasonable and proportionate search for your information.

Automated decisions. Taxdose makes no decisions about you with legal or similarly significant effects. AI and on-phone reading only suggest figures for you to check. Automatic limits (your page allowance, daily limits and misuse checks) can pause AI reading. If you think that's wrong, email us and a person will look at it.

12. Children

Taxdose is for qualified doctors working in the UK. It isn't meant for anyone under 18, isn't designed for or marketed to children, and we don't knowingly hold children's data.

13. Security

• Records are encrypted on the phone, with a key protected by your passphrase.
• Connections to our server use HTTPS.
• The app can't reach our database directly. Every request is checked first.
• Agreement records can't be edited or deleted through the service. Each one is chained to the one before, so changes would show, and your phone keeps its own receipt of each.
• Spending and usage limits stop runaway use.

No system is perfectly secure. If a breach affects you and is likely to put you at risk, we'll tell you and the ICO, as the law requires.

14. Changes to this notice

If we change this notice in a way that matters, Taxdose will show you the new version before you carry on. Your phone keeps a record of each version you've seen and agreed to, in Settings › Your choices. Smaller changes (clearer wording, new contact details) are listed in the version history below.

15. Questions and complaints

Questions: email privacy@praelion.com.

Complaining to us. If you're unhappy with how we've used your information, please tell us first. We'll do our best to put things right.

1. Email privacy@praelion.com, with "Complaint" in the subject. Say what went wrong and, if it's about what our server holds, include your random ID from Settings › Your choices.
2. We'll acknowledge your complaint within 30 days, and usually within a few working days.
3. We'll look into it without undue delay, keep you updated, and tell you the outcome and what we've done about it.

Complaining to the ICO. If you're not happy with our answer, or you don't want to come to us first, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113. The ICO usually expects you to have raised it with us first.

16. Version history